ggshield

ggshield is GitGuardian’s command-line secret scanner for developers and teams that want checks in local work, version-control hooks, Docker workflows, or CI. It is strongest when a team wants several opportunities to catch hardcoded credentials before they spread, though its file-size cap and reliance on GitGuardian authentication make it less suitable for unrestricted or fully self-contained scanning.

Overview

The open-source CLI detects more than 600 types of secrets and can scan files and repositories before code is pushed. It also scans Docker image layers, build arguments, and Dockerfiles, bringing container materials into the same prevention workflow.

Scanning can run locally, as a pre-commit hook, in CI, or as a pre-receive hook on self-managed version-control instances. That range gives teams multiple chances to catch a secret, rather than relying on a single review stage. ggshield requires an API key for a GitGuardian workspace; its login command can provision and store a personal access token. The CLI is open source, but the secrets-detection library behind GitGuardian’s public API is closed source.

GitGuardian says scan incidents and secrets are not stored in its backend; it does retain scan metadata such as call time, request size, and scan mode. It also says it has maintained SOC 2 Type II compliance since 2022 and undergoes annual audits.

Key features

• Development-stage scanning: Local, repository, pre-commit, CI, and pre-receive options suit teams that want checks integrated at more than one point. Pre-receive support targets self-managed version-control instances.
• Docker scanning: Checking image layers, build arguments, and Dockerfiles extends coverage beyond application source. This is useful for teams building or distributing containers, but files over 1 MB are ignored.
• Broad secret detection: Detection of more than 600 secret types provides wide coverage for common credential-scanning needs. Teams seeking an open detection engine should note that only the CLI is open source.
• VCS and CI workflows: Supported VCS platforms include GitHub, GitLab, Bitbucket, and Azure DevOps; CI/CD, pull-request scanning, and push protection are supported. The product page describes CI/CD use and displays Travis CI and Jenkins logos.
• Call and installation constraints: The API accepts up to 20 documents per call and splits larger scans across multiple calls. Standard installation needs Git and a supported, non-end-of-life Python version; standalone packages avoid those requirements.
• Support route: GitGuardian directs bug reports and feature requests to the official GitHub repository, a practical fit for users comfortable with an open-source project workflow.

Pricing

ggshield uses a freemium model. Starter costs nothing, billed Always, and covers up to 25 developers, 10K API calls per month, up to 500 historical scan detections, and unlimited real-time scanning. It is a substantial no-cost starting point for teams within those caps, but the developer, API-call, and historical-detection limits may constrain larger or history-heavy use.

Business has custom pricing, and a 30-day free trial is available. Enterprise also has custom pricing, billed “Let’s Talk,” and includes unlimited teams, API calls, and custom detectors, plus a dedicated support channel. Starter is the fit for smaller teams that can work within its quotas; Enterprise is aimed at organizations needing scale and dedicated support. Business is an option to evaluate through its trial, while its included capabilities are not described.

Platforms

ggshield works on macOS, Linux, and Windows, and is available for API and self-hosted use. Standard installation requires Git and a supported, non-end-of-life Python version; standalone packages bypass those dependencies. The command-line format is suited to developers comfortable with terminals and automated workflows, rather than people looking for a graphical scanning interface.

Who it's for

ggshield suits development teams that want to scan code and Docker materials at local, commit, CI, or self-managed pre-receive stages. Its free Starter tier is especially relevant to teams of up to 25 developers whose usage fits the monthly API and historical-detection caps. It is a weaker fit for organizations that need larger individual files scanned, want a fully open detection engine, or prefer a graphical workflow.

Pros and cons

• Pro: Multiple scanning points, including local work, hooks, CI, and Docker materials, help teams catch hardcoded secrets before code is pushed.
• Pro: Starter offers unlimited real-time scanning at no cost, with defined allowances for teams up to 25 developers.
• Pro: GitGuardian says scan incidents and secrets are not stored in its backend, while its stated SOC 2 Type II compliance and annual audits may matter to security-conscious teams.
• Con: Files larger than 1 MB are ignored, which can leave large-file workflows outside coverage.
• Con: Standard installation depends on Git and a supported Python version, and use requires authentication to a GitGuardian workspace.
• Con: Starter caps monthly API calls and historical detections, while the detection library itself is closed source.

Alternatives

For more options, browse Secrets Scanning Software. Consider these alternatives when their stated pricing, limits, or requirements better fit your workflow:

• Vooda AI has a free self-hosted plan for production use, any company size, and no seat limits; choose it if those terms are a better fit.
• Amazon Deequ is a free Apache 2.0 open-source library, but requires Apache Spark and a release matching the Spark version.
• ByteHide Secrets offers a free plan for up to 2,000 secrets with no credit card; consider it if that stated allowance suits your needs.
• DeepSource has a free Open Source plan with unlimited public repositories and team members; choose it if those repository and team terms align with your project.
• Endor Labs offers free local scans via its AURI MCP server for individual developers, with no account required; its Developer plan has no UI, policies, or scan history.
• GitGuardian offers a free Starter plan with up to 25 developers, unlimited real-time scanning, up to 500 historical scan detections, and 10K API calls per month; it is the broader product to compare if you want GitGuardian’s platform beyond the CLI.
• Semgrep Code has a free edition covering code and supply chain for up to 10 repositories and 10 contributors, with 60 AI credits; consider it if those caps and scope suit your project.
• Augustus is free, Apache 2.0 licensed open-source software; API usage may require provider credentials.

Verdict

Choose ggshield if you want a command-line scanner that can check hardcoded secrets across local development, hooks, CI, and Docker materials, with a free tier that supports unlimited real-time scans for up to 25 developers. Look elsewhere if files over 1 MB must be covered, you need an open detection engine, or you want scanning without GitGuardian workspace authentication.