Repolode
Submit
GitGuardian

GitGuardian/ggshield

CLI that detects and validates 500+ types of hardcoded secrets in files, git repos, Docker images and packages, usable as a pre-commit hook or in CI.

View on GitHubWebsite
Stars
2,011
Forks
221
Open issues
69
Last commit
16 hours ago

What is it?

ggshield is a command-line tool from GitGuardian for finding hardcoded secrets such as API keys and credentials before they leak. It scans local files, git repositories, Docker images and PyPI packages, and it can run on a developer's machine or inside a CI pipeline.

It calls the GitGuardian public API to detect and validate secrets, and it can be wired into Git pre-commit, pre-push and pre-receive hooks, as well as GitHub Actions. Scans store only metadata such as call time, request size and scan mode, so detected secret values are not kept on the dashboard.

The tool can also install hooks that scan interactions with AI coding assistants such as Cursor, Claude Code, Copilot Chat and Codex, blocking actions that contain secrets before they run.

Key features

  • 01Detects 500+ types of secrets with validation checks.
  • 02Scans files, git repos, Docker images and PyPI packages.
  • 03Runs as a pre-commit, pre-push or pre-receive Git hook.
  • 04Provides a GitHub Action and CI/CD integration.
  • 05Installs hooks to scan AI coding assistant interactions.
  • 06Installs on macOS, Linux and Windows via pip, pipx, Homebrew or packages.

Use cases

  • Blocking secrets from being committed to a repository via pre-commit hooks.
  • Scanning CI pipelines for leaked credentials before deployment.
  • Auditing existing git history or Docker images for hardcoded keys.
  • Preventing AI coding assistants from executing actions that contain secrets.

Quick start

  1. 1

    Install ggshield with pipx (requires Python and git)

    pipx install ggshield
  2. 2

    Authenticate against GitGuardian servers

    ggshield auth login
  3. 3

    Scan the current directory for secrets

    ggshield secret scan path -r .

Things to know

  • Requires authentication with GitGuardian servers and uses their public API to scan.
  • Requires a supported, non-EOL version of Python and git when installed from PyPI.
  • On macOS, upgrading to 1.54.0 triggers a Keychain prompt for the ggshield-py binary.

In collections

CLI & terminal toolsSecurity scanners, audits & threat intel toolsTesting frameworks & test automation tools

Topics

#secrets-detection#security#devsecops#pre-commit#cli#credentials-scanning#ci-cd#apikey#code#credentials

FAQ

What is ggshield?
CLI that detects and validates 500+ types of hardcoded secrets in files, git repos, Docker images and packages, usable as a pre-commit hook or in CI. ggshield is a command-line tool from GitGuardian for finding hardcoded secrets such as API keys and credentials before they leak. It scans local files, git repositories, Docker images and PyPI packages, and it can run on a developer's machine or inside a CI pipeline.
Is ggshield free to use? What license does it have?
ggshield is open source under the MIT license. Check the license terms before using it in commercial products.
Is ggshield still maintained?
Actively maintained. The last commit to ggshield was on Nov 6, 2026.
What can I use ggshield for?
Blocking secrets from being committed to a repository via pre-commit hooks. Scanning CI pipelines for leaked credentials before deployment. Auditing existing git history or Docker images for hardcoded keys. Preventing AI coding assistants from executing actions that contain secrets.
How do I install ggshield?
Install ggshield with pipx (requires Python and git): pipx install ggshield Authenticate against GitGuardian servers: ggshield auth login Scan the current directory for secrets: ggshield secret scan path -r .
Where can I get ggshield?
The source code and installation instructions are on GitHub: https://github.com/GitGuardian/ggshield

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects