ggshield vs TruffleHog

ggshield is GitGuardian’s command-line tool for finding hardcoded secrets before code is pushed. It can scan local files and repositories, run before commits or in CI pipelines, and act as a pre-receive hook for self-managed version control. It also scans Docker image layers, build arguments, and Dockerfiles. GitGuardian’s documentation describes detection for more than 600 secret types. The open-source CLI uses a closed-source secrets detection library behind GitGuardian’s public API. It runs on macOS, Linux, and Windows, with API and self-hosted options. Standard installation needs Git and a supported, non-end-of-life Python version; standalone packages are an exception. Scans require an API key for a GitGuardian workspace, and the login command can provision and store a personal access token. Files over 1 MB are ignored, and API calls accept up to 20 documents each. The free Starter plan is free, billed Always; it includes up to 25 developers, 10K API calls per month, up to 500 historical scan detections, and unlimited real-time scanning.

TruffleHog scans code repositories and other sources for exposed secrets, passwords, and sensitive keys. It checks version history across branches and can find credentials in comments and Docker images, among other locations. For detected credentials, it checks the relevant protocol or API to determine whether they are live, helping reduce false positives. Its Analyze feature identifies the resources and permissions associated with API keys and other secrets without requiring access to a provider’s user interface. Pre-commit and pre-receive hooks can scan changes before they are committed. Alerts can point to credential-rotation actions and security guidance. Integrations include GitHub, GitLab, Bitbucket, Gerrit, Docker, Jenkins, Slack, Teams, Jira, Confluence, Google Drive, S3, and SharePoint, among others. Notifications can go to Slack, Jira, Splunk, webhooks, email, or stdout. The open-source plan costs nothing and includes 800+ secret detectors.