TruffleHog — Find and Verify Leaked Credentials

What it is

TruffleHog is a credentials scanner that finds, verifies, and analyzes leaked secrets across Git repositories, filesystems, S3 buckets, and more. Unlike basic pattern-matching scanners, TruffleHog checks whether detected credentials are actually active by making safe verification requests. This dramatically reduces false positives -- instead of alerting on every string that looks like an API key, it tells you which ones are real and exploitable.

TruffleHog targets security engineers, DevOps teams, and developers who need to audit codebases for exposed secrets. It runs in CI/CD pipelines, pre-commit hooks, or as a one-off audit tool.

How it saves time or tokens

TruffleHog's verification feature eliminates false-positive triage. Traditional secret scanners produce hundreds of alerts, most of which are test keys, revoked tokens, or false matches. TruffleHog verifies each finding, reducing actionable alerts from hundreds to the handful that actually matter. For security teams, this means spending time on remediation rather than investigation.

How to use

1. Install TruffleHog:

brew install trufflehog

1. Scan a Git repository:

# Scan a remote repo
trufflehog git https://github.com/example/repo.git

# Scan a local repo
trufflehog git file://./my-repo

# Scan a filesystem
trufflehog filesystem /path/to/code

1. Review verified findings and rotate any active credentials immediately.

Example

CI/CD integration for pre-merge scanning:

# GitHub Actions workflow
name: Secret Scan
on: [pull_request]
jobs:
  trufflehog:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: TruffleHog Scan
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

The --only-verified flag reports only credentials confirmed as active, keeping CI noise to a minimum.

Related on TokRepo

• AI Tools for Security — Security scanning and auditing tools for codebases
• AI Tools for DevOps — DevOps tools for CI/CD pipeline security

Common pitfalls

• Verification makes safe API calls to check if credentials are active. Ensure your network allows outbound requests from the scanning environment.
• Scanning the full Git history (all commits) catches secrets that were committed and later deleted. Use --since-commit to limit scope for regular CI scans.
• TruffleHog reports the location of secrets in your output. Ensure scan results are stored securely and not logged to public CI outputs.
• Always check the official documentation for the latest version-specific changes and migration guides before upgrading in production environments.
• For team deployments, establish clear guidelines on configuration and usage patterns to ensure consistency across developers.
• When integrating TruffleHog with Slack or PagerDuty notifications, filter to verified-only findings to avoid alert fatigue from false positives.