ggshield
ggshield is GitGuardian's command-line application for finding and preventing hardcoded secrets before code is pushed.
What ggshield is
ggshield is GitGuardian's command-line application for finding and preventing hardcoded secrets before code is pushed. It scans local files and repositories, can run as a pre-commit hook or in CI, and supports pre-receive hooks for self-managed version control instances. It can also inspect Docker image layers, build arguments, and Dockerfiles. Documentation says it detects more than 600 types of secrets. The CLI is open source, though the secrets detection library behind GitGuardian's public API is closed source. ggshield works on macOS, Linux, and Windows, as well as API and self-hosted setups. Standard installation requires Git and a supported, non-end-of-life Python version; standalone packages are an exception. Authentication uses an API key for a GitGuardian workspace, and its login command can provision and store a personal access token. Files larger than 1 MB are ignored, and each API call accepts at most 20 documents, with larger scans split across calls. GitGuardian says it retains scan metadata but not scan incidents or secrets in its backend.
Good
- Detects more than 600 types of secrets
- Scans local files, repositories, CI, and pre-commit workflows
- Can scan Docker image layers and Dockerfiles
- Open-source CLI
- Free Starter plan includes unlimited real-time scanning
Watch out
- Files larger than 1 MB are ignored
- API calls accept at most 20 documents
- Standard installation requires Git and supported Python
- Requires a GitGuardian workspace API key
Who it suits
It suits developers and teams who want to scan code repositories, commit workflows, CI pipelines, or Docker files for hardcoded secrets. Self-managed version-control operators can also use its pre-receive hook.
Verdict
ggshield offers several points in a development workflow for secret scanning, including repositories, CI, and Docker artifacts. Note the file-size and per-call limits, plus the distinction between its open-source CLI and closed-source detection library.
Plans and prices
From ggshield's own pricing page, checked 29 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Starter | Free | Up to 25 devs · 10K API calls/month · Up to 500 historical scan detections · Unlimited real-time scanning · Always |
| Business | Priced on request | Pricing not shown · ggshield page says a 30-day free trial is available · Let’s Talk |
| Enterprise | Priced on request | Custom pricing · Unlimited teams, API calls, and custom detectors · Dedicated support channel · Let’s Talk |
The facts
Each one read from ggshield's own pages, with the date it was checked.
What it does
- Authentication
- ggshield requires an API key to authenticate with a GitGuardian workspace, and its login command can provision and store a personal access token.checked 29 Sep 2026
- CI integrations
- The product page describes CI/CD pipeline use and displays Travis CI and Jenkins logos.checked 29 Sep 2026
- Detection
- The documentation says ggshield detects more than 600 types of secrets.checked 29 Sep 2026
- Docker
- ggshield can scan Docker image layers, build arguments, and Dockerfiles for hardcoded secrets.checked 29 Sep 2026
- Open source
- The ggshield CLI is open source, while the secrets detection library behind GitGuardian’s public API is closed source.checked 29 Sep 2026
- Operating systems
- ggshield works on macOS, Linux, and Windows; the standard installation requires a supported, non-end-of-life Python version and Git, except when using standalone packages.checked 29 Sep 2026
- Purpose
- ggshield is GitGuardian’s command-line application for detecting and preventing hardcoded secrets before code is pushed.checked 29 Sep 2026
- Scan data
- For ggshield scans, GitGuardian says it stores metadata such as call time, request size, and scan mode, while scan incidents and secrets are not stored in its backend.checked 29 Sep 2026
- Scanning
- ggshield can scan local files and repositories, run as a pre-commit hook, run in CI, and run in a pre-receive hook for self-managed version control instances.checked 29 Sep 2026
- Scanning limit
- Files larger than 1 MB are ignored, and the API accepts at most 20 documents per call, bundling larger scans into multiple calls.checked 29 Sep 2026
- Security compliance
- GitGuardian says it has maintained SOC 2 Type II compliance since 2022 and undergoes annual audits.checked 29 Sep 2026
- Support
- GitGuardian directs users to the official GitHub repository to report bugs or request features.checked 29 Sep 2026
The company
- Company
- GitGuardian says it was founded in Paris in November 2017.checked 29 Sep 2026
- Founded
- 2017checked 28 Sep 2026
- Headquarters
- Paris, Francechecked 28 Sep 2026
Alternatives to ggshield
- 1
DeepSource
Free planWebAPILinuxmacOS8.0From $30 a month - 2
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 3
Vooda AI
Free planWebAPILinuxmacOS6.9Free plan - 4
Arnica Secrets Security
Free planWebAPISelf-hosted6.6From $300 a year - 5
GitGuardian
Free planWebAPILinuxmacOS6.6Free plan - 6
detect-secrets
Free planLinuxmacOSSelf-hostedWindows6.5Free plan