JFrog Secrets Detection

Name: JFrog Secrets Detection
Brand: JFrog

Leader

On a mission to create a world of software delivered without friction from developer to device.

Est 2008|Valuation $11.7B|Raised $580M

LinkedIn 104K|Website|Web traffic 532K|FTEs 1,800|HQ Sunnyvale, California, US

MarketsApplication Security Testing (AST)Secret Scanning

Published May 16, 2026

01Common complaints

Alternative solutions should be considered when: 1) The organization does not run Artifactory/Xray: the product’s value proposition is strongest within that ecosystem. 2) The primary need is developer-facing SCM secrets governance first: dedicated SCM-focused tools typically provide faster time-to-value for commit/PR scanning and remediation workflows. 3) Budget constraints are the primary concern: community feedback indicates nontrivial licensing costs for platform advanced tiers; open-source scanners or lower-cost tools may be more appropriate. 4) Minimal operational overhead is required: user feedback indicates setup complexity and operational requirements that may not suit teams seeking a zero-maintenance solution.

Deal disqualifiers (poor fit)

Artifact storage is not JFrog-centric and adopting a large platform is not acceptable.
Primary requirement is repo/PR secrets scanning and remediation workflows at the Git provider layer.
The organization is highly constrained on licensing budget and prefers open-source scanners with in-house operations.

Publicly visible limitations

Tier gating: some customers report that secrets detection may not be included in all subscription tiers.
Operational and UX friction: user feedback references UI limitations, documentation gaps, API constraints, and performance concerns.

Roadmap / future features

No specific roadmap dates for Secrets Detection were identified in the reviewed sources.

Scale limitations

No explicit numeric scale limits for Secrets Detection were identified. The platform is targeted at large-scale artifact repositories, but performance validation should be conducted in pilot environments.

Security/compliance gaps

Feature-specific compliance disclosures were not found; enterprises should request formal compliance documentation.

02Why they buy

Unique selling points supported by evidence

Secrets detection in binaries and artifacts: the capability to scan compiled or packaged outputs provides coverage for classes of leakage that source-only scanners may miss.
Shift-right capability: the product supports post-build scanning of artifacts and container images stored in the artifact repository, which complements earlier-stage scanning.

Where competitors have advantages

Precision and recall transparency: independent evaluations of secrets scanners vary, and some market participants provide more published evaluation material on detection accuracy. Buyers should request performance data and consider independent testing.

03Field reports

Note: Review platforms rarely evaluate Secrets Detection as a standalone product; most feedback applies to the JFrog platform (Artifactory, Xray, Advanced Security). The evidence below blends platform-level reviews with comments relevant to secrets detection.

Gartner Peer Insights (enterprise review signal)

A Gartner Peer Insights page for JFrog’s software supply chain platform includes a review noting:

Positive: strong Xray integration with Artifactory, real-time dependency scanning, and SBOM support.
Negative/caveat: initial setup described as complex and resource-intensive. This feedback is platform-level but supports the integration argument for artifact-level scanning.

G2 (broader sentiment)

G2 reviews for JFrog’s platform often note that adding Xray provides security and license compliance capabilities. These reviews do not isolate Secrets Detection but reflect perceived value of integrated scanning within the platform.

PeerSpot (pros + explicit complaints)

Synthesis of PeerSpot feedback highlights strengths and weaknesses:

Strengths: reporting, policy management, vulnerability blocking.
Weaknesses: UI concerns, limited documentation, API constraints, performance issues, and database support limitations (notably PostgreSQL).

Community (Reddit) — feature gating and cost concerns

Tier gating: some users report that their subscription did not include secrets detection.
Pricing concerns: several community discussions describe pricing as relatively high compared with some alternatives.
Support dissatisfaction (platform-level): some comments report unsatisfactory responses from support during incidents.

HackerNews

A high-signal Hacker News thread focused specifically on JFrog Secrets Detection was not identified in the reviewed sources.

JFrog security research: leaked PyPI token found in a compiled binary

JFrog published research describing how its secret detection engine identified a GitHub token embedded in a compiled Python bytecode file (.pyc), and reported that the token was revoked by PyPI after notification. - What it demonstrates: scanning built artifacts can detect secrets that code-only scanners might miss (for example, embedded tokens in compiled outputs). - Critical evaluation: this is vendor-published research and represents a single documented incident. The methodology and false-positive/false-negative rates in enterprise environments are not independently benchmarked in the same report.

JFrog research: scanning a large number of OSS artifacts and reported exposed tokens

JFrog reported scanning a large number of artifacts across popular registries and identifying exposed tokens. This indicates prevalence of exposed credentials in package ecosystems.

Critical evaluation: vendor-led studies indicate prevalence, but buyers should not assume that these figures directly reflect detection performance in their own repositories.

Vendor case study: energy company program

A vendor use case describes the deployment of Secrets Detection as part of a broader DevSecOps program, claiming detection and mitigation of hardcoded secrets in near real-time.

Critical evaluation: the case study is vendor-provided marketing content and does not include independently verified metrics specific to Secrets Detection (for example, counts of secrets prevented, changes in incident rates, or false positive statistics).

04Best fit

Company sizes

Typical fit: mid-market to enterprise organizations producing significant numbers of artifacts and container images, particularly where Artifactory is already a critical dependency.

Industries

Common fits include software companies, financial services, regulated industries, and critical infrastructure, where centralized artifact governance and auditability are important.

Roles/personas

Decision makers: VP Engineering, Head of DevSecOps, CISO/Director of AppSec, Platform Engineering leaders.
End users: build and release engineers, developers (IDE integrations), security engineers responsible for policy and response.

Pain points it addresses

Secrets that bypass source scanning and end up embedded in binaries, container images, or packaged artifacts stored in repositories.
The need for centralized scanning and governance at the artifact hub.

Qualification criteria (typical fit)

The organization already uses JFrog Artifactory and is adopting Xray or JFrog Advanced Security.
The organization requires scanning and governance at the artifact level rather than only source-level scanning.

05The pitch

What the product does (objective core value)

JFrog Secrets Detection is a secrets-scanning capability within JFrog Advanced Security (JAS), delivered as part of JFrog Xray in the broader JFrog Software Supply Chain Platform. Its function is to detect exposed secrets (for example, API tokens, credentials, private keys) in source code and in built artifacts and binaries stored in artifact repositories and container registries, notably JFrog Artifactory. The product includes post-build / artifact scanning (commonly called "shift-right" detection) in addition to workflows intended for earlier stages of development.

Target market and market positioning

Target users: DevSecOps teams, platform engineering, security engineering, and CI/CD owners in organizations that use or are considering JFrog Artifactory and Xray as a central system of record for binaries.
Positioning: Not a standalone secrets scanner; provided as an integrated capability inside a platform that also covers software composition analysis (SCA), container scanning, SBOM generation, policy enforcement, and artifact governance.

Get a comprehensive analysis of JFrog Secrets Detection including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →