trufflehog

trufflehog git file://.

Detect secrets in the repository with TruffleHog, verifying findings against services (valid keys) and scanning history.

Run it in the CI/CD pipeline (and on the repo) when you want detection with verification: trufflehog scans the repo (and git history) and reports findings — secrets with detail — and verifies findings against services (AWS key, GitHub token: is it valid?) with built-in verifiers. It's the secret detector with verification (the difference from pattern-based detectors): a finding confirmed as valid is the critical one. In DevSecOps, TruffleHog is the pipeline piece: a detected and verified secret is revoked immediately.

Don't use it without network for verification: secret verification queries services (AWS, GitHub...) — in isolated environments, verification doesn't apply (and pattern-based detection remains). And watch out: verification generates traffic to services (and can trigger provider alerts): configure it judiciously. History scanning is slow on large repos: the pipeline scans the PR diff, history in periodic scanning. History findings require rotation.