TruffleHog is an open-source secret scanning engine developed by Truffle Security. With 24,500 GitHub stars and over 250,000 daily scans, it’s used by security teams to find and verify leaked credentials across their entire technology stack.
TruffleHog’s secret verification capability sets it apart from other SAST tools. The scanner doesn’t just find potential secrets—it logs in to confirm whether credentials are still active.
What is TruffleHog?
TruffleHog discovers secrets in git repositories, Slack workspaces, wikis, S3 buckets, Docker images, filesystems, and dozens of other data sources. The tool classifies over 800 credential types including AWS keys, GitHub tokens, database passwords, API keys, and service account credentials.
For every secret TruffleHog identifies, it attempts verification by logging into the associated service. This distinguishes between active threats (credentials that still work) and historical leaks (revoked credentials). Security teams can prioritize remediation based on which secrets pose immediate risk.
TruffleHog maps each discovered secret to the specific identity or account it belongs to. This context helps you understand the scope of exposure and determine if an attacker could access sensitive resources.
Key features
| Feature | Details |
|---|---|
| Secret types | 800+ credential detectors with classification |
| Verification | Live credential testing for 20+ common credential types |
| Scan sources | Git, GitHub, GitLab, S3, GCS, Docker, Jenkins, Elasticsearch, Postman, filesystem |
| Output | JSON structured output, human-readable text |
| CI integration | --results=verified filter, --fail exit code (183), --since-commit for incremental scans |
| Installation | Homebrew, Docker, binary releases, from source (Go) |
| License | AGPL-3.0 (open-source), commercial plans available |
| Binary verification | cosign signature verification for releases |
GitHub organization scanning
TruffleHog scans entire GitHub organizations including member repositories, GitHub Wikis, issue comments, gist comments, and pull request comments. Use --issue-comments and --pr-comments flags to include these often-overlooked sources.
The tool handles GitHub API rate limits automatically and scans both public and private repositories with appropriate authentication. For AWS-hosted infrastructure, pass --role-arn to authenticate via IAM roles.
Active credential verification
After finding potential secrets, TruffleHog attempts authentication using those credentials. If it finds an AWS access key, it makes an API call to AWS to verify the key works. For 20+ common credential types, the tool goes further with deep analysis that maps permissions and access scope.
Filter output to only verified (active) credentials with --results=verified. This separates active security incidents from historical artifacts that have already been revoked.
Multi-source scanning
TruffleHog goes well beyond Git. It scans S3 buckets, Google Cloud Storage, Docker images, Jenkins servers, Elasticsearch clusters, and Postman workspaces. Docker scanning extracts image layers and analyzes filesystem contents, catching secrets baked into container builds.
Identity mapping
Each discovered secret gets mapped to a specific user account, service account, or API key. This context shows who owns the credential, what permissions it has, and which systems it can access. Security teams use this to assess blast radius and contact credential owners.
Getting started
brew install trufflehog on macOS, or pull the Docker image. Binary releases with cosign signature verification are available on GitHub.trufflehog git https://github.com/your-org/your-repo to scan git history. Add --results=verified to see only live credentials.trufflehog github --org=your-org --token=$GITHUB_TOKEN to scan all repositories, wikis, issues, and gists in your org.--fail to exit with code 183 when credentials are found. Combine with --since-commit to scan only new commits in pull requests.When to use TruffleHog
TruffleHog is the right tool when you need to scan beyond git repositories. If your secrets could be in Slack, S3 buckets, Docker images, or CI/CD logs, TruffleHog covers those sources.
The verification feature is what sets it apart. Instead of a list of potential secrets, you get a list of confirmed active credentials ranked by risk. This saves significant triage time on large scans.
For git-only scanning where speed matters most, Gitleaks is lighter and faster. For enterprise environments with legacy codebases, detect-secrets offers a baseline approach that lets you adopt scanning without fixing everything upfront.
Comments
Powered by Giscus — comments are stored in GitHub Discussions.