TruffleHog

TruffleHog is a secrets scanning tool for finding leaked credentials such as API keys, database passwords, and private encryption keys. It works in four stages: discovery, classification, validation, and analysis. It is a security tool aimed at developers, AppSec teams, and security engineers who audit repositories, infrastructure, and CI pipelines for exposed secrets.

Scanning is done through subcommands for each source. The README documents git (remote URLs or local repos via file://), github (orgs, repos, issue comments, PR comments, with --exclude-archived), s3, gcs, docker (remote registry, local daemon, or tarball images), and filesystem (individual files or directories). It also mentions scanning chats, wikis, logs, and API testing platforms. Local git repos are cloned to a temp directory before scanning to guard against malicious git configs (CVE-2025-41390). You can change the location with --clone-path, or skip the clone with --trust-local-git-config.

TruffleHog classifies over 800 secret types and maps each to the identity it belongs to, for example AWS, Stripe, Cloudflare, Postgres, or SSL private keys. For classified secrets, it logs in to check whether the credential is live, and --results=verified or --results=verified,unknown filters the output by that status. For about 20 commonly leaked credential types, the analysis step sends additional requests to determine who created the secret and what resources and permissions it has.

Output is human-readable by default, with --json for JSON and --sarif for SARIF. GitHub code scanning can ingest SARIF to show findings on pull request diffs and in the Security tab. SARIF results are buffered in memory until the scan ends. Install options include Homebrew, Docker, release binaries, an install script with optional cosign checksum verification, and building from source with Go. Release artifacts are checksummed, and the checksum file is signed with cosign.

Installation

# via Homebrew
brew install trufflehog

# via Install script
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin

# via Docker
docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys