Skip to content
Deepak Gupta markRecon Atlas

Code and secret leaks

TruffleHog

Secrets scanner for auditing your own repositories, buckets and images, with checks that confirm whether a found credential is still live.

Passive and active modesScope a pentestAudit your own exposure

29k stars · last push November 10, 2026 · v3.99.8 · AGPL-3.0

GitHub repositoryOfficial docs

What it finds

TruffleHog scans your git history, GitHub and GitLab organisations, filesystems, S3 and GCS buckets, Docker images and other sources for leaked credentials. It classifies over 800 secret types. For each it can call the provider's API to report the result as verified, unverified or unknown.

  • secrets
  • API keys
  • database passwords
  • private keys
  • cloud credentials

Does it touch the target?

Has a passive mode and active modes. The active modes need the owner's permission.

Scanning a local repo or directory (trufflehog git file://..., trufflehog filesystem) reads local data. Verification is on by default and calls each credential provider's API; README: "the AWS credential detector performs a GetCallerIdentity API call against the AWS API". --no-verification turns that off. Remote sources (github, gitlab, s3, gcs) query those platforms' APIs.

API keys: Local scans need no key; the README says unauthenticated GitHub scans are rate limited and suggests --token, and some sources (gitlab, circleci, travisci, postman) take a --token.

Install

Install with brew
brew install trufflehog

From the project's documentation

Install with source
git clone https://github.com/trufflesecurity/trufflehog.git
cd trufflehog; go install

From the project's documentation

Install with binary
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Scan a repository for verified secrets only
trufflehog git https://github.com/example-org/example-repo --results=verified

From the project's documentation

Scan your GitHub organisation for verified secrets
trufflehog github --org=example-org --results=verified

From the project's documentation

Scan files or directories
trufflehog filesystem path/to/file1.txt path/to/file2.txt path/to/dir

From the project's documentation

Gate a CI branch, failing on found credentials
trufflehog git file://. --since-commit main --branch feature-1 --results=verified,unknown --fail

From the project's documentation

Output formats: text (stdout), JSON (--json), legacy JSON (--json-legacy), GitHub Actions (--github-actions), SARIF (--sarif)

Limits the project documents

  • Unauthenticated GitHub organisation scans are rate limited; pass --token to raise limits.
  • Unverified results may be invalid, expired, or unchecked because verification was disabled.
  • SARIF output is buffered in memory for the whole scan, so very large result sets use proportionally more memory.
  • Deep analysis of a credential's permissions covers only about 20 of the most commonly leaked types.

Deepak's take

Analysis, not documentation

Use it when
Use it to audit your own organisation's repositories, buckets and images when you need to know which leaked credentials still work and should be rotated first.
Skip it when
Skip default verification when policy forbids any outbound call with a found credential; pass --no-verification or use Gitleaks, which documents no verification step.
What it will miss
It finds only secrets matching its detectors or your custom regex, and it cannot see repositories or stores you do not give it access to.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: AGPL-3.0. TruffleHog is a trademark or project name of its owners; this library is not affiliated with it.