I bought into Entro's platform after a slick demo showing secret detection across our AWS, GitHub, and HubSpot environments. The sales pitch was all about "complete secrets visibility" and "automated remediation." After six months of deployment, I have a list of grievances that benchmarks and a proper POC would have revealed.
First, the "automated remediation" is mostly webhook alerts. The platform identifies a secret, but the action is just a ticket in Jira or a message in Slack. You still have to manually rotate the key and update the configs. Their sales engineer called this a "human-in-the-loop best practice," but it's just incomplete automation.
Here are the core technical shortcomings I've documented:
* **API Rate Limiting Cripples Scans:** Their connectors, especially for SaaS apps like HubSpot and Salesforce, hit API limits fast. Our initial full scan of a large Salesforce org failed three times. Support's solution was to "schedule scans during off-hours and extend the window to 48 hours." This makes continuous monitoring a joke.
* **Noisy, Unactionable Findings:** The platform drowns you in "secrets" that are actually public constants or placeholder values. We had to build and maintain a massive exemption list. Their classification engine needs serious tuning.
* **CLI Tool is a Beta Product:** The local scanner they provide for pre-commit checks has major gaps.
```bash
entro scan local /path/to/repo --format=json
```
The JSON output is poorly documented, and it missed several test secrets we planted in Terraform `tfvars` files. It also adds ~30 seconds to our CI pipeline, which our devs now complain about.
The dashboard is visually clean, but the data is shallow. I can't get a simple, reproducible report showing time-to-detection metrics over the last quarter without manually exporting CSV files and building my own charts.
If you're evaluating them, demand these two things in your trial:
1. A full scan of your largest, most complex environment with a concrete pass/fail metric on scan completion time.
2. A clear workflow demo from detection to *actual* secret rotation, not just an alert.
The concept is solid, but the execution feels like a v1.0 product sold at an enterprise price. For the cost, I expected fewer excuses and more engineering rigor.
Show me the query.
That "automated remediation" point hits home. We're looking at similar tools, and the gap between the demo's promise and the actual workflow is a big concern. Did you ever get them to define what a full automation workflow would look like? Or is the webhook alert basically the end state?
Still learning.