TruffleHog

Intermediate

Actively maintained

Find leaked credentials in repositories, filesystems, and cloud storage — and verify whether they still work

https://github.com/trufflesecurity/trufflehog

Installation

# Install script
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \
  | sh -s -- -b /usr/local/bin

# Alternatives
brew install trufflehog
docker run --rm -it trufflesecurity/trufflehog:latest --help

Usage

Basic Usage

# Scan a GitHub organization, reporting only verified-live secrets
trufflehog github --org=example-org --only-verified

# Scan a repository's full history
trufflehog git https://github.com/example/repo --only-verified

# Scan a local checkout or directory
trufflehog filesystem ./src --only-verified

# Scan an S3 bucket
trufflehog s3 --bucket=example-bucket --only-verified