ggshield — Scan Machine

Overview

ggshield machine scan scans the entire home directory for secrets across local git repositories, dotfiles (~/.bashrc, ~/.zshrc, ~/.netrc), shell history (.zsh_history, .bash_history), cloud CLI configs (~/.aws/credentials, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.pypirc), AI agent caches (Cursor, Claude Code, Copilot), browser profile databases, archives, and abandoned project trees. Findings are stored in a local SQLite database (~/.ggshield/ggshield_machine_scan.db) and viewable in a local web dashboard.

This is distinct from secret scan (which targets a specific path, repo, image, or package). Machine scan is for the machine itself: "what credentials are sitting across this laptop, including local repositories and personal configuration files?" GitGuardian positions it as endpoint protection — typically rolled out across a fleet via MDM (Intune, Jamf), but also runnable ad-hoc by an individual developer whose workspace has it enabled.

Two things have to be set up before ggshield machine scan runs at all:

1. Endpoint scanning enabled on the GitGuardian workspace. Endpoint scanning is gated server-side; on Free, the plugin install will fail.
2. The machine_scan plugin, installed and enabled. Machine scan is not built into the base ggshield binary — it ships as a separate plugin that has to be installed via ggshield plugin install and enabled via ggshield plugin enable machine_scan. A fresh ggshield install does not include it. Until the plugin is enabled, ggshield machine scan will exit with "command not found" or a similar error.

Confirm both prerequisites before walking the user through a scan. If they're on Free, redirect them to scan-secrets (which works on Free for individual repos) and mention that machine scan requires endpoint scanning to be enabled on the workspace.

Core rule: confirm with the user before running. Machine scans inspect every file in $HOME including shell history and AI agent caches; that's invasive even when legitimate. State what will happen, ask once, then proceed.

Start Here — Read This Before Doing Anything