ggshield: protect your code with GitGuardian
macOS: upgrading to 1.54.0 triggers a Keychain prompt for ggshield-py, a second binary that now reads your saved token as part of our performance improvements. Click Always Allow; it won’t ask again.
ggshield is a CLI application that runs in your local environment or in a CI environment to help you detect more than 500+ types of secrets.
ggshield uses our public API through py-gitguardian to scan and detect potential vulnerabilities in files and other text content.
Only metadata such as call time, request size and scan mode is stored from scans using ggshield, therefore secrets will not be displayed on your dashboard and your files and secrets won’t be stored.
Table of Contents
Installation
Install script (Recommended)
The quickest way to install ggshield.
Linux / macOS:
curl -sSfL \
https://raw.githubusercontent.com/GitGuardian/ggshield/main/scripts/install/install.sh | bash
Windows (PowerShell):
irm https://raw.githubusercontent.com/GitGuardian/ggshield/main/scripts/install/install.ps1 | iex
Or, if you prefer curl (bundled with Windows 10+):
curl.exe -sSL https://raw.githubusercontent.com/GitGuardian/ggshield/main/scripts/install/install.ps1 | powershell -NoProfile -ExecutionPolicy Bypass -Command -
The script accepts options such as --instance and --plugin (install a
plugin). For the EU workspace or a self-hosted instance, set the
GITGUARDIAN_INSTANCE environment variable (or pass --instance <URL>)
before running.
See scripts/install/README.md for the full list
of options, the other install methods, and how to uninstall.
The methods below install the CLI manually instead.
macOS
Homebrew
You can install ggshield using Homebrew:
brew install ggshield
Upgrading is handled by Homebrew.
Standalone .pkg package
Alternatively, you can download and install a standalone .pkg package from ggshield release page.
This package does not require installing Python, but you have to manually download new versions.
Linux
Deb and RPM packages
Deb and RPM packages are available on Cloudsmith.
Setup instructions:
Upgrading is handled by the package manager.
Windows
Chocolatey
ggshield is available via the Chocolatey package manager:
choco install ggshield
MSI installer
Download the MSI installer from the ggshield release page and install it:
msiexec /i ggshield-VERSION-x86_64-pc-windows-msvc.msi
Standalone .zip archive
We provide a standalone .zip archive on ggshield release page.
Unpack the archive on your disk, then add the directory containing the ggshield.exe file to %PATH%.
This archive does not require installing Python, but you have to manually download new versions.
All operating systems
ggshield can be installed on all supported operating systems via its PyPI package.
It requires a supported version of Python (not EOL) (except for standalone packages) and git.
If you don’t use our packaged versions of ggshield, please be aware that we follow the Python release cycle and do not support versions that have reached EOL.
Using pipx
The recommended way to install ggshield from PyPI is to use pipx, which will install it in an isolated environment:
pipx install ggshield
To upgrade your installation, run:
pipx upgrade ggshield
Using pip
You can also install ggshield from PyPI using pip, but this is not recommended because the installation is not isolated, so other applications or packages installed this way may affect your ggshield installation. This method will also not work if your Python installation is declared as externally managed (for example when using the system Python on operating systems like Debian 12):
pip install --user ggshield
To upgrade your installation, run:
pip install --user --upgrade ggshield
Initial setup
Using ggshield auth login
To use ggshield you need to authenticate against GitGuardian servers. To do so, use the ggshield auth login command. This command automates the provisioning of a personal access token and its configuration on the local workstation.
You can learn more about it from ggshield auth login documentation.
After authenticating, run ggshield machine setup to configure AI and git hooks,
plant honeytokens, and register the machine on the Endpoints page before its first
scan. Registration includes the current user, or all honeytoken target users when
running as root. It is best effort, takes at most five seconds, and does not affect
the command’s exit code.
The scans of ggshield secret scan pre-commit, pre-push and ai-hook also send
the machine hostname, from which GitGuardian registers the users of these hooks.
Other scan commands do not send it, nor does the native AI hook that standalone and
platform-specific pip installs run.
On CI, ggshield neither registers the machine nor sends the hostname. To turn both
off elsewhere, set endpoint_registration: false in .gitguardian.yaml, or set
GGSHIELD_NO_ENDPOINT_REGISTRATION to a non-empty value.
Manual setup
You can also create your personal access token manually and store it in the GITGUARDIAN_API_KEY environment variable to complete the setup.
Getting started
Secrets
You can now use ggshield to search for secrets:
- in files:
ggshield secret scan path -r .
- in repositories:
ggshield secret scan repo .
- in Docker images (
docker command must be available): ggshield secret scan docker ubuntu:22.04
- in Pypi packages (
pip command must be available): ggshield secret scan pypi flask
- and more, have a look at
ggshield secret scan --help output for details.
Migrating a legacy configuration file
If ggshield reports that your .gitguardian.yaml (or .gitguardian.yml) config file uses a deprecated format, migrate it to the latest version with:
ggshield config migrate
By default, this looks for the configuration file in the current directory, so run it from the directory containing the file. To run it from anywhere, point ggshield to the file explicitly:
ggshield --config-path path/to/.gitguardian.yaml config migrate
The previous version of the file is kept as a .old backup next to it.
Integrations
You can integrate ggshield in your CI/CD workflow.
To catch errors earlier, use ggshield as a pre-commit, pre-push or pre-receive Git hook.
AI coding assistants
ggshield can scan interactions between you and your AI coding assistant in real time, blocking actions that contain secrets before they are executed.
You can install the hooks with the ggshield install command.
Supported tools: Cursor, Claude Code, Copilot Chat, Codex, and
Mistral Vibe 2.21+.
Learn more
For more information, have a look at the documentation
Output
If no secrets have been found, the exit code will be 0:
ggshield secret scan pre-commit
If a secret is found in your staged code or in your CI, you will have an alert giving you the filename where the secret has been found and a patch giving you the position of the secret in the file:
ggshield secret scan pre-commit
2 incidents have been found in file production.rb
11 | config.paperclip_defaults = {
12 | :s3_credentials => {
13 | :bucket => "XXX",
14 | :access_key_id => "XXXXXXXXXXXXXXXXXXXX",
|_____AWS Keys_____|
15 | :secret_access_key => "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
|_______________AWS Keys_______________|
16 | }
17 | }
Lines that are too long are truncated to match the size of the terminal, unless the verbose mode is used (-v or --verbose).
License
ggshield is MIT licensed.
评论