Package: ggshield
ggshield: protect your code with GitGuardianggshieldis a CLI application that runs in your local environment or in a CI environment to help you detect more than 350+ types of secrets, as well as other potential security vulnerabilities or policy breaks affecting your codebase.ggshielduses ourpublic APIthroughpy-gitguardianto scan and detect potential vulnerabilities in files and other text content.Only metadata such as call time, request size and scan mode is stored from scans usingggshield, therefore secrets and policy breaks incidents will not be displayed on your dashboard andyour files and secrets won't be stored.Table of ContentsInstallationmacOS - Using HomebrewLinux packagesOther Operating Systems - Using pipx or pipInstallingUpdatingInitial setupGetting startedSecretsInfra as Code Security (IaC)IntegrationsLearn moreOutputRelated open source projectsLicenseInstallationmacOS - Using HomebrewYou can installggshieldusing Homebrew by running the following command:$brewinstallgitguardian/tap/ggshieldLinux packagesDeb and RPM packages are available onCloudsmith.Setup instructions:Deb packagesRPM packagesOther Operating Systems - Using pipx or pipInstallingThe recommended way to installggshieldis to usepipx, which will install it an isolated environment:$pipxinstallggshieldAlternatively, you can install with pip as a user package. This will not work if your Python installation is declared as externally managed (for example when using the system Python on operating systems like Debian 12):$pipinstall--user-UggshieldggshieldsupportsPython 3.8 and newer.The package should run on MacOS, Linux and Windows.UpdatingTo updateggshieldwhen installed with pipx:$pipxupgradeggshieldIf you installedggshieldwith pip, you can add the option-U/--upgradeto the pip install command to update:$pipinstall--user-UggshieldInitial setupTo useggshieldyou need to authenticate against GitGuardian servers. To do so, use theggshield auth logincommand. This command automates the provisioning of a personal access token and its configuration on the local workstation.You can learn more about it fromggshield auth logindocumentation.Alternatively, you can create your personal access token manually and you can store it in theGITGUARDIAN_API_KEYenvironment variable to complete the setup.Getting startedSecretsYou can now useggshieldto search for secrets:in files:ggshield secret scan path -r .in repositories:ggshield secret scan repo .in Docker images:ggshield secret scan docker ubuntu:22.04in Pypi packages:ggshield secret scan pypi flaskand more, have a look atggshield secret scan --helpoutput for details.Infra as Code Security (IaC)You can also search for vulnerabilities in your IaC files using the following command:ggshield iac scan all .However, if you are only interested innewpotential IaC vulnerabilities, you can run:ggshield iac scan diff --ref=HEAD~1 .Have a look atggshield iac scan --helpfor more details.IntegrationsYou can integrateggshieldin yourCI/CD workflow.To catch errors earlier, useggshieldas apre-commit, pre-push or pre-receive Git hook.Learn moreFor more information, have a look atthe documentationOutputIf no secrets or policy breaks have been found, the exit code will be 0:$ggshieldsecretscanpre-commitIf a secret or other issue is found in your staged code or in your CI, you will have an alert giving you the type of policy break, the filename where the policy break has been found and a patch giving you the position of the policy break in the file:$ggshieldsecretscanpre-commit

🛡️⚔️🛡️2policybreakshavebeenfoundinfileproduction.rb11|config.paperclip_defaults={12|:s3_credentials=>{13|:bucket=>"XXX",14|:access_key_id=>"XXXXXXXXXXXXXXXXXXXX",|_____AWSKeys_____|15|:secret_access_key=>"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"|_______________AWSKeys_______________|16|}17|}Lines that are too long are truncated to match the size of the terminal, unless the verbose mode is used (-vor--verbose).Related open source projectstruffleHoggitleaksgitrobgit-houndAWS git-secretsdetect-secretsLicenseggshieldis MIT licensed.