R-TRU
TruffleHog
Scans git history, filesystems, and cloud sources for secrets, then actively verifies them.
OVERVIEW
TruffleHog (github.com/trufflesecurity/trufflehog) scans for hardcoded secrets across a wide range of sources beyond git repositories — filesystems, Docker images, S3 buckets, Slack workspaces, Jira, and dozens more — using detectors for hundreds of credential types from cloud providers, SaaS APIs, and package registries.
Its defining feature is active verification: rather than just flagging a string that looks like an AWS key or a Slack token, TruffleHog can make a live, low-privilege API call to the issuing service to confirm the credential still works, which cuts through the noise of expired keys and test fixtures that plague purely pattern-based scanners.
USE CASES
Practical use cases
- 01
Scanning git history, filesystems, or container images for hardcoded secrets in one pass.
- 02
Using active verification to separate live, exploitable credentials from expired or fake matches.
- 03
Scanning non-git sources (S3 buckets, Slack, Jira) that a git-only scanner would miss entirely.
- 04
Prioritizing a large pattern-match report down to the handful of secrets confirmed as still valid.
QUICK START
When a secret scan needs to separate live, exploitable credentials from expired or fake-looking matches, since it calls the provider API to check.
- Confirm which repositories, filesystems, or cloud sources are in scope, and whether active verification calls to third-party APIs are permitted.
- Install TruffleHog from a release binary, package manager, or container image.
- Run a scan against the target source with verification enabled.
- Treat only verified-live results as confirmed findings; review unverified matches manually before reporting.
- Handle and store any confirmed secret per the client's data-handling agreement.
trufflehog git file://path/to/repo --results=verifiedBEFORE YOU RUN IT
What to check before running it
Active verification makes live calls to third-party provider APIs using the discovered credential — this itself needs to be disclosed and scoped with the client before running, since it touches infrastructure outside the primary target.
Verified findings still expose the actual secret value in output; handle and store results per the client's data-handling agreement, not as a normal text finding.
AGPL-3.0 licensing has network-use copyleft implications if you modify TruffleHog and offer it as a network service — most engagement use (running the CLI as-is) is unaffected, but check before redistributing a modified build.