What problem it solves

Leaked credentials can be difficult to identify and assess because they may be stored across repositories, chats, wikis, logs, filesystems, and other systems. Finding a credential pattern alone does not establish whether it is active, so the project combines discovery, classification, validation, and analysis.

Key features

• Broad secret discovery — Scan sources including Git repositories, GitHub organizations, chats, wikis, logs, object stores, filesystems, Docker images, and other supported services.

  Source: README

• Credential classification — Identify the specific type and associated identity of detected secrets, including AWS, Stripe, Cloudflare, PostgreSQL, and SSL private-key credentials.

  Source: README

• Active credential validation — Test classified credentials against their corresponding service APIs to distinguish live secrets from results that cannot be confirmed.

  Source: README

• Credential analysis — For commonly leaked credential types, inspect additional details such as ownership, accessible resources, and resource permissions.

  Source: README

• Multiple output and workflow formats — Produce JSON or SARIF output, integrate scans into CI, and use TruffleHog as a GitHub Action or pre-commit hook.

  Source: README, action.yml

Quick start

Copied verbatim from the project's README.

brew install trufflehog

trufflehog git https://github.com/trufflesecurity/test_keys --results=verified

Who it may suit

Inference: This project may suit developers, security engineers, and teams that need to scan repositories, cloud storage, developer platforms, filesystems, or CI workflows for leaked credentials.

Topics to discuss

• Which source integrations or deployment workflows should receive priority for future development?

• How should teams balance verified findings with unverified and unknown results in their security workflows?

• What improvements would make credential validation safer and clearer for users scanning production systems?

Written by ReadmeX AI from the project's README, source and public GitHub data; it may contain mistakes.

Read the original README https://github.com/trufflesecurity/trufflehog#readme

ReadmeX opened this community for a trending project; it is not run by the project. Maintainers can claim it from the community page.