Arnica Secrets Security vs ggshield

Arnica Secrets Security detects and validates hardcoded secrets in code repositories. For newly pushed validated secrets, it can automatically rewrite commits and remove secrets from Git history. Severity considers validation context, including whether credentials belong to a highly privileged or development account. Codebases are scanned daily, with secrets revalidated on code changes and scheduled scans. Integrations include GitHub, GitLab, Azure DevOps, and Bitbucket; alerts can go to Slack or Microsoft Teams, while tickets can be created through Jira or Azure DevOps Boards. Teams can configure regex-based detectors, ignored paths, and policies for scanning and resolution. Arnica says it does not persist source-code snippets containing detected secrets and that customer data is encrypted at rest with tenant separation. Its cloud infrastructure is hosted on AWS, with TLS 1.2 or 1.3 in transit and AES 256 at rest. The Free plan's data ingestion runs every seven days; premium plans run in real time. Prices are per identity per year: Free is free, Business is $300 a year, and Enterprise is $600 a year. A 14-day trial is available.

ggshield is GitGuardian’s command-line tool for finding hardcoded secrets before code is pushed. It can scan local files and repositories, run before commits or in CI pipelines, and act as a pre-receive hook for self-managed version control. It also scans Docker image layers, build arguments, and Dockerfiles. GitGuardian’s documentation describes detection for more than 600 secret types. The open-source CLI uses a closed-source secrets detection library behind GitGuardian’s public API. It runs on macOS, Linux, and Windows, with API and self-hosted options. Standard installation needs Git and a supported, non-end-of-life Python version; standalone packages are an exception. Scans require an API key for a GitGuardian workspace, and the login command can provision and store a personal access token. Files over 1 MB are ignored, and API calls accept up to 20 documents each. The free Starter plan is free, billed Always; it includes up to 25 developers, 10K API calls per month, up to 500 historical scan detections, and unlimited real-time scanning.