trufflesecurity/trufflehog

Maintainer? Show your league in your README

Card: your league's emblem, from Copper to Legendary

[![bestofgithub](https://bestofgithub.dev/badge/trufflesecurity/trufflehog.svg?style=card)](https://bestofgithub.dev/repo/trufflesecurity/trufflehog)

Flat: fits beside your other badges

[![bestofgithub](https://bestofgithub.dev/badge/trufflesecurity/trufflehog.svg)](https://bestofgithub.dev/repo/trufflesecurity/trufflehog)

Loading README…

TruffleHog

🔎 Now Scanning

🌐 TruffleHog Enterprise

What is TruffleHog 🐽

Discovery 🔍

Classification 📁

Validation ✅

Analysis 🔬

📢 Join Our Community

📺 Demo

💾 Installation

MacOS users

Docker:

Unix

Windows Command Prompt

Windows PowerShell

M1 and M2 Mac

Binary releases

Compile from source

Using installation script

Using installation script, verify checksum signature (requires cosign to be installed)

Using installation script to install a specific version

🔐 Verifying the artifacts

🚀 Quick Start

1: Scan a repo for only verified secrets

2: Scan a GitHub Org for only verified secrets

3: Scan a GitHub Org excluding archived repositories

4: Scan a GitHub Repo for only verified secrets and get JSON output

5: Scan a GitHub Repo + its Issues and Pull Requests

6: Scan an S3 bucket for high-confidence results (verified + unknown)

7: Scan S3 buckets using IAM Roles

8: Scan a Github Repo using SSH authentication in Docker

9: Scan individual files or directories

10: Scan a local git repo

11: Scan GCS buckets for only verified secrets

12: Scan a Docker image for only verified secrets

13: Scan in CI

14: Scan a Postman workspace

15: Scan a Jenkins server

16: Scan an Elasticsearch server

Scan a Local Cluster

Connect to a local cluster with username and password

Connect to a local cluster with a service token

Scan an Elastic Cloud Cluster

17. Scan a GitHub Repository for Cross Fork Object References and Deleted Commits

18. Scan Hugging Face

Scan a Hugging Face Model, Dataset, Space or Bucket

Scan all Models, Datasets, Spaces and Buckets belonging to a Hugging Face Organization or User

Scan Discussion and PR Comments

19. Scan stdin Input

❓ FAQ

📰 What's new in v3?

What is credential verification?

📝 Usage

Configuration

S3

Narrowing a scan to specific objects

TruffleHog Github Action

General Usage

Shallow Cloning

Canary detection

Advanced Usage

Advanced Usage: Scan entire branch

TruffleHog GitLab CI

Example Usage

Pre-commit Hook

Custom Regex Detector (alpha)

Regex Detector Example

Generic JWT Detection

🔍 Analyze

❤️ Contributors

💻 Contributing

Adding new secret detectors

Use as a library

License Change