ggshield

ggshield is a command-line secret scanner for developers who want checks at more than one point in a software workflow. Its open-source client and free tier make it a practical starting point, but file-size and API-call limits matter for larger scans.

Overview

GitGuardian’s CLI is built to detect hardcoded secrets before code is pushed. It can scan local files and repositories, and its documentation describes detection for more than 600 secret types. That breadth, paired with checks in local work, hooks, and CI, suits teams that want several chances to stop a credential from reaching a repository.

The CLI is open source; the detection library behind GitGuardian’s public API is not. Authentication requires a GitGuardian workspace API key, although the login command can provision and save a personal access token. GitGuardian says it retains scan metadata, including call time, request size, and scan mode, but does not store scan incidents or secrets in its backend. It also says it has maintained SOC 2 Type II compliance since 2022 and undergoes annual audits.

Key features

Multiple scanning stages: Local and repository scans, pre-commit hooks, CI checks, and pre-receive hooks for self-managed version-control instances let teams choose where to intervene. The range is useful for layered prevention, though it requires teams to configure the stages that fit their workflow.

Container checks: ggshield scans Docker image layers, build arguments, and Dockerfiles. This extends secret checks beyond source files to container build inputs and outputs.

Repository and pipeline coverage: Supported VCS platforms are GitHub, GitLab, Bitbucket, and Azure DevOps; CI/CD, pull-request scanning, and push protection are supported. The product page also depicts Travis CI and Jenkins integrations.

Custom detection rules: Teams can define custom rules, which is useful when they need detection beyond built-in secret types.

Scan boundaries: Files larger than 1 MB are ignored. Each API call accepts up to 20 documents, so larger scans are split across calls; the per-file cap is the sharper limitation for repositories containing large files.

Pricing

Starter: free, billed Always. It allows up to 25 developers, 10K API calls per month, and up to 500 historical scan detections, with unlimited real-time scanning. This is a defined free tier for small teams or teams prioritizing ongoing checks over broad historical coverage; the API quota and detection ceiling constrain heavier use.

Business: custom pricing, billed Let’s Talk. A 30-day free trial is available. The trial gives teams a way to evaluate the paid plan, but no price or included limits are given.

Enterprise: custom pricing, billed Let’s Talk. It includes unlimited teams, API calls, and custom detectors, plus a dedicated support channel. It is the fit for organizations that need those expanded limits and support, rather than Starter’s fixed developer and scan allowances.

Platforms

ggshield runs on macOS, Linux, and Windows, and supports API and self-hosted environments. Standard installation requires Git and a supported, non-end-of-life Python version; standalone packages avoid that requirement. Its pre-receive mode is specifically suited to self-managed version-control instances.

Who it's for

ggshield suits developers and security-conscious teams that want secret detection integrated into local work, repository hooks, Docker workflows, and CI. The free Starter allowance is a sensible entry point for teams within its 25-developer and monthly-call limits. Teams with larger files, substantial historical scanning needs, or a requirement to avoid GitGuardian authentication should look elsewhere.

Pros and cons

Pro: Scanning spans local files, commits, CI, self-managed pre-receive hooks, and Docker materials, giving teams multiple intervention points.

Pro: Starter includes unlimited real-time scanning, keeping ongoing checks available without a paid plan.

Pro: GitGuardian says scan incidents and secrets are not stored in its backend, while it maintains SOC 2 Type II compliance with annual audits.

Con: Files over 1 MB are ignored, leaving a clear blind spot for large files.

Con: Starter caps teams at 25 developers, API usage at 10K calls a month, and historical detections at 500.

Con: The open-source scope is the CLI, not the detection library behind the public API, and use requires workspace authentication.

Alternatives

Secrets Scanning Software is a useful starting point for comparing the category. Consider DeepSource if its Open Source plan’s unlimited public repositories and team members, with 1,000 pull request reviews per month, better match your needs. GitGuardian is the related product to consider if you want its broader platform rather than the ggshield CLI.

Vooda AI offers a free self-hosted plan for production use with no seat limits. Semgrep Code is worth considering if you want its Free Edition’s code and supply-chain coverage across up to 10 repositories. Amazon Deequ is a free, open-source library to consider when Apache Spark is already part of your stack.

ByteHide Secrets offers a free plan with up to 2,000 secrets. Endor Labs may suit individual developers seeking local scans without an account, though its Developer plan has no UI, policies, or scan history. Kingfisher is another free option.

Verdict

Choose ggshield if you want an open-source CLI that places secret checks across developer work, Docker inputs, repository hooks, and CI, with unlimited real-time scanning on Starter. Look elsewhere if the 1 MB file ceiling, Starter’s historical and API limits, or dependence on GitGuardian authentication conflicts with your workflow.