ggshield vs Secretlint

ggshield is GitGuardian’s command-line tool for finding hardcoded secrets before code is pushed. It can scan local files and repositories, run before commits or in CI pipelines, and act as a pre-receive hook for self-managed version control. It also scans Docker image layers, build arguments, and Dockerfiles. GitGuardian’s documentation describes detection for more than 600 secret types. The open-source CLI uses a closed-source secrets detection library behind GitGuardian’s public API. It runs on macOS, Linux, and Windows, with API and self-hosted options. Standard installation needs Git and a supported, non-end-of-life Python version; standalone packages are an exception. Scans require an API key for a GitGuardian workspace, and the login command can provision and store a personal access token. Files over 1 MB are ignored, and API calls accept up to 20 documents each. The free Starter plan is free, billed Always; it includes up to 25 developers, 10K API calls per month, up to 500 historical scan detections, and unlimited real-time scanning.

Secretlint is a free, MIT-licensed, open-source linting tool for finding credentials in projects and helping prevent commits that contain them. Its command-line interface scans files, glob patterns, or standard input. Detection rules are separate modules, and custom rules can be distributed as npm packages. Secret values are masked in lint error messages by default, reducing exposure in terminal output and logs. Secretlint supports Git workflows, including pre-commit integrations with Husky and lint-staged, pre-commit, and Git hooks. Documentation covers GitHub Actions checks and pull-request annotations through the GitHub formatter. Listed integrations also include Mega-Linter, SARIF formatting, a browser extension, and a macOS clipboard app. The WebExtension works with Chrome and Firefox DevTools to help notice credentials in requests and responses. Installation options include Node.js, Docker, or a single executable without Node.js; the Node.js route requires version 22 or later. It detects secrets but does not automatically fix them.