TruffleHog Secret Scanner: Find and Verify Leaked Credentials

TL;DR: TruffleHog secret scanner is an open-source tool that detects leaked credentials across Git repositories, Docker images, S3 buckets, Slack, and 20+ other sources. What sets this secret scanner apart: it verifies whether detected secrets are actually live by testing them against their respective APIs. With 800+ credential detectors and zero cost for the open-source version, TruffleHog has become the go-to tool for preventing credential leaks before they become breaches.

Contents show

Every security breach has a story, and many of them begin the same way: a developer accidentally commits an API key to a public repository. Within minutes, automated bots have harvested it. Within hours, the damage is done. This is exactly why tools like the TruffleHog secret scanner have become essential in modern development workflows.

TruffleHog exists to prevent these stories. Built by Truffle Security, it scans your codebase—and far beyond—for exposed secrets. But unlike tools that simply pattern-match and flood you with false positives, TruffleHog does something clever: it actually tests whether each secret works.

Quick Start

Install via Homebrew:

brew install trufflehog

Scan a GitHub repository:

trufflehog git https://github.com/your-org/your-repo --results=verified

Or scan an entire GitHub organization:

trufflehog github --org=your-organization --results=verified

The --results=verified flag is the key. It tells the TruffleHog secret scanner to only show secrets that have been confirmed as live credentials—not expired tokens or test keys.

The Verification Difference

Most secret scanners use regex patterns to find strings that look like credentials. This approach catches a lot, but it also generates noise. That test API key you committed three years ago? Still flagged. The example credentials in your documentation? Flagged. Your CI/CD pipeline drowns in alerts.

TruffleHog takes a different approach. For every potential credential it detects, it attempts to authenticate against the corresponding service. Found an AWS key? TruffleHog calls the GetCallerIdentity API. Found a Stripe key? It makes a test request to Stripe. This verification step eliminates false positives and tells you exactly which secrets represent active threats.

The tool classifies results into three categories: verified (the credential works), unverified (detected but couldn’t confirm), and unknown (verification failed due to network or API issues). This classification lets security teams prioritize effectively.

What It Scans

TruffleHog isn’t limited to Git repositories. Version 3, a complete rewrite in Go, supports a broad range of data sources:

Git repositories (including full commit history)
GitHub and GitLab (issues, PRs, comments, wikis)
Docker images (local or from registries)
S3 and GCS buckets
Slack, Confluence, Jira
Jenkins, CircleCI, TravisCI build logs
Postman collections
Elasticsearch clusters
HuggingFace models, spaces, and datasets

The TruffleHog secret scanner recognizes over 800 credential types, from AWS and Azure keys to Stripe tokens and database passwords. Each detector is purpose-built for its target service.

CI/CD Integration

TruffleHog fits naturally into development workflows. A GitHub Action can scan every pull request:

- name: Secret Scanning
  uses: trufflesecurity/trufflehog@main
  with:
    extra_args: --results=verified,unknown

For local development, pre-commit hooks catch secrets before they ever reach version control. The --fail flag returns exit code 183 when valid credentials are found, blocking the commit or failing the CI build.

If you’re building automated pipelines, you might also find value in exploring AI agents that automate coding workflows to complement your security tooling.

Beyond Detection: TruffleHog Analyze

Finding a leaked credential is only half the battle. Understanding what it can access—and how much damage it could cause—is equally important. TruffleHog Analyze addresses this by automatically mapping each secret to its associated resources and permissions.

Discover an AWS key? Analyze tells you which IAM user created it, what resources it can access, and what permissions it holds. This context transforms remediation from guesswork into informed action.

Show Image TruffleHog Analyze showing permissions and resources for a detected credential

Trade-offs to Consider

Resource intensity: Deep scanning with verification takes time. Large repositories or organizations may see longer scan durations.
No GUI in open-source version: The CLI is powerful but lacks a dashboard for tracking and managing findings over time. TruffleHog Enterprise adds this.
Network verification: Verification requires network access to external APIs. Air-gapped environments may need to disable it.
Learning curve: The extensive options and source-specific flags take time to master.

When to Use TruffleHog

Good fit:

Teams prioritizing accuracy over speed in secret detection
Organizations scanning beyond just Git repositories
Security teams tired of triaging false positives
CI/CD pipelines where blocking on verified secrets makes sense
Open-source projects wanting free, comprehensive scanning

Consider alternatives if:

You need a managed dashboard and enterprise support (consider TruffleHog Enterprise or GitGuardian)
Scan speed matters more than verification accuracy (consider Gitleaks)
You’re in an air-gapped environment without external API access

For teams migrating backend infrastructure, security scanning should be part of your checklist—similar to considerations when migrating from PHP to Go.

Resources

Documentation: trufflesecurity.com/trufflehog
GitHub: github.com/trufflesecurity/trufflehog
Enterprise: trufflesecurity.com/trufflehog-enterprise
Community: Slack (#trufflehog-community) and Discord (Secret Scanning)

The security landscape doesn’t lack for secret scanners. What makes the TruffleHog secret scanner compelling is its insistence on verification—the difference between knowing a secret exists and knowing it’s a live threat. For teams serious about preventing credential leaks, that distinction matters.