How do I scan a GitHub repo or org for secrets?

Set mode to github and pass --repo for one repository or --org to sweep every repo. Add --token for private sources. Narrow bulk runs with --include-repos, --exclude-repos, or --include-members.

How do I exclude paths from a trufflehog scan?

Use --exclude-paths with a file of newline-separated regexes, or --include-paths to allowlist. For git sources, --exclude-globs filters at the git log level.

Can it find secrets that were committed and later deleted?

Yes. In git mode it walks full commit history, so a secret committed then removed is still recovered. Bound depth with --since-commit or --max-depth.

What sources besides git can it scan?

Set mode to github, gitlab, filesystem, s3, gcs, docker, postman, circleci, travisci, jenkins, or elasticsearch to sweep orgs, directories, buckets, images, and CI logs.

Updated Jul 14, 2026

Static Code Analysis

Find leaked credentials and verify which still work

Hunt leaked credentials and verify which still work.

Scan a repo's full git history Sweep an entire GitHub org Report only working credentials

overview

What trufflehog does

trufflehog scans git history, GitHub and GitLab orgs, filesystems, Docker images, S3, and GCS for leaked credentials. Hundreds of detectors match provider key formats instead of raw high-entropy noise.

With --only-verified, each candidate is tested against the issuing service. Output is working credentials, not every string that looks like one. --json emits structured findings; --exclude-paths skips noisy paths.

Reach for it when you need multi-source coverage with verification. Prefer gitleaks for a faster git-only regex pass. Trickest runs it as a managed Static Code Analysis node writing file and folder outputs.

source github.com/trufflesecurity/trufflehog

use cases

Where trufflehog fits

Scan a repo's full git history

Point trufflehog at a git URL or repo in git mode so it walks every commit, not only the current tree, and recovers secrets that were committed and later deleted.

Sweep an entire GitHub org

Pass an org and a token to scan every repository at once, with include and exclude globs to focus the run and include-members to reach member repos.

Report only working credentials

Enable only-verified so trufflehog tests each candidate against its provider and returns the secrets that still authenticate, cutting false positives to near zero.

Audit cloud buckets and images

Switch the mode to s3, gcs, or docker to scan object storage and container images for embedded keys without cloning anything to disk first.

reference

trufflehog inputs and flags

76 inputs

Name	Type	Flag	Description
mode	STRING	·	Scan mode that sets the source type: git, github, gitlab, filesystem, s3, gcs, docker, postman, elasticsearch, and more.
git-url	STRING	·	Git repository URL to scan in git mode (https://, file://, or ssh://).
repo	STRING	--repo	GitHub or GitLab repository to scan.
org	STRING	--org	GitHub or GitLab organization to scan in bulk.
token	STRING	--token	Authentication token for the source being scanned.
only-verified	BOOLEAN	--only-verified	Only report secrets that were verified against the live service.
json	BOOLEAN	--json	Output findings in JSON format for downstream parsing.
exclude-paths	FILE	--exclude-paths	Path to a file of newline-separated regexes for files to skip in the scan.

Showing key inputs. trufflehog exposes 76 inputs in total.

Full flag reference (76 inputs)

Name	Type	Flag	Description
key	STRING	--key	S3 key used to authenticate.
org	STRING	--org	GitHub/GitLab organization to scan.
bare	BOOLEAN	--bare	Scan bare repository (e.g. useful while using in pre-receive hooks)
file	FILE	·	Path to file to scan (must use the `filesystem` mode)
json	BOOLEAN	--json	Output in JSON format.
mode	STRING	·	Scan mode (available options: git, github, gitlab, filesystem, s3, gcs, circleci, docker, travisci, postman, elasticsearch, jenkins)
repo	STRING	--repo	GitHub/GitLab repository to scan.
debug	BOOLEAN	--debug	Run in debug mode.
image	STRING	--image	Docker image to scan. Image registry is assumed.
nodes	STRING	--nodes	Elasticsearch nodes
token	STRING	--token	Authentication token
trace	BOOLEAN	--trace	Run in trace mode.
branch	STRING	--branch	Branch to scan.
bucket	STRING	--bucket	Name of S3 bucket to scan.
config	FILE	--config	Path to configuration file.
secret	STRING	--secret	S3 secret used to authenticate.
api-key	BOOLEAN	--api-key	Elasticsearch API key.
git-url	STRING	·	Git repository URL. https://, file://, or ssh:// schema expected (must use the `git` mode)
cloud-id	BOOLEAN	--cloud-id	Elasticsearch cloud ID.
endpoint	STRING	--endpoint	GitHub/GitLab endpoint
password	BOOLEAN	--password	Authentication password
role-arn	STRING	--role-arn	Specify the ARN of an IAM role to assume for scanning.
username	BOOLEAN	--username	Authentication username
verifier	STRING	--verifier	Set custom verification endpoints.
directory	FOLDER	·	Path to directory to scan (must use the `filesystem` mode)
max-depth	STRING	--max-depth	Maximum depth of commits to scan.
no-update	BOOLEAN	--no-update	Don't check for updates.
project-id	BOOLEAN	--project-id	GCS project ID used to authenticate. Can NOT be used with unauth scan.
query-json	BOOLEAN	--query-json	Filters the documents to search
concurrency	STRING	--concurrency	Number of concurrent workers (default: 1).
environment	STRING	--environment	Postman environment to scan. You can repeat this flag.
json-legacy	BOOLEAN	--json-legacy	Use the pre-v3.0 JSON format. Only works with git, gitlab, and github sources.
pr-comments	BOOLEAN	--pr-comments	Include pull request descriptions and comments in scan.
since-commit	STRING	--since-commit	Commit to start scan from.
without-auth	BOOLEAN	--without-auth	Scan GCS buckets without authentication. This will only work for public buckets
workspace-id	STRING	--workspace-id	Postman workspace ID to scan. You can repeat this flag.
collection-id	STRING	--collection-id	Postman collection ID to scan. You can repeat this flag.
exclude-globs	STRING	--exclude-globs	Comma separated list of globs to exclude in scan. This option filters at the `git log` level, resulting in faster scans.
exclude-paths	FILE	--exclude-paths	Path to file with newline separated regexes for files to exclude in scan.
exclude-repos	STRING	--exclude-repos	Repositories to include in an org scan. This can also be a glob pattern. Must use Github repo full name. Example: "trufflesecurity/trufflehog", "trufflesecurity/t*"
gist-comments	BOOLEAN	--gist-comments	Include gist comments in scan.
include-forks	BOOLEAN	--include-forks	Include forks in scan.
include-paths	FILE	--include-paths	Path to file with newline separated regexes for files to include in scan.
include-repos	STRING	--include-repos	Repositories to include in an org scan. This can also be a glob pattern. Must use Github repo full name. Example: "trufflesecurity/trufflehog", "trufflesecurity/t*"
index-pattern	BOOLEAN	--index-pattern	Filters the indices to search
only-verified	BOOLEAN	--only-verified	Only output verified results.
service-token	BOOLEAN	--service-token	Elasticsearch service token.
session-token	STRING	--session-token	S3 session token used to authenticate temporary credentials.
filter-entropy	STRING	--filter-entropy	Filter unverified results with Shannon entropy. Start with 3.0.
github-actions	BOOLEAN	--github-actions	Output in GitHub Actions format.
issue-comments	BOOLEAN	--issue-comments	Include issue descriptions and comments in scan.
archive-timeout	STRING	--archive-timeout	Maximum time to spend extracting an archive.
exclude-buckets	STRING	--exclude-buckets	Buckets to exclude from scan. Comma separated list of buckets. Globs are supported
exclude-objects	STRING	--exclude-objects	Objects to exclude from scan. Comma separated list of buckets. Globs are supported
include-buckets	STRING	--include-buckets	Buckets to scan. Comma separated list of buckets. Globs are supported
include-members	BOOLEAN	--include-members	Include organization member repositories in scan.
include-objects	STRING	--include-objects	Objects to scan. Comma separated list of buckets. Globs are supported
max-object-size	STRING	--max-object-size	Maximum size of objects to scan. Objects larger than this will be skipped. (Byte units eg. 512B, 2KB, 4MB)
no-verification	BOOLEAN	--no-verification	Don't verify the results
service-account	FILE	--service-account	Path to GCS service account JSON file.
since-timestamp	BOOLEAN	--since-timestamp	Scan git commits more recent than the given timestamp.
workspace-paths	FILE	--workspace-paths	Path to Postman workspaces.
archive-max-size	STRING	--archive-max-size	Maximum size of archive to scan. (Byte units eg. 512B, 2KB, 4MB)
best-effort-scan	BOOLEAN	--best-effort-scan	Attempts to continuously scan a cluster
collection-paths	FILE	--collection-paths	Path to Postman collections.
archive-max-depth	STRING	--archive-max-depth	Maximum depth of archive to scan.
cloud-environment	BOOLEAN	--cloud-environment	Use default IAM credentials in cloud environment.
environment-paths	FILE	--environment-paths	Path to Postman environments.
exclude-detectors	STRING	--exclude-detectors	Comma separated list of detector types to exclude. Protobuf name or IDs may be used, as well as ranges. IDs defined here take precedence over the include list.
filter-unverified	BOOLEAN	--filter-unverified	Only output first unverified result per chunk per detector if there are more than one results.
include-detectors	STRING	--include-detectors	Comma separated list of detector types to include. Protobuf name or IDs may be used, as well as ranges.
exclude-environments	STRING	--exclude-environments	Environment to exclude from scan. You can repeat this flag.
include-environments	STRING	--include-environments	Environment to include in scan. You can repeat this flag.
exclude-collection-id	STRING	--exclude-collection-id	Collection ID to exclude from scan. You can repeat this flag.
include-collection-id	STRING	--include-collection-id	Collection ID to include in scan. You can repeat this flag.
print-avg-detector-time	BOOLEAN	--print-avg-detector-time	Print the average time spent on each detector.

example

Run trufflehog

trufflehog · command

# scan a repo's full history, verify secrets, skip vendored pathstrufflehog git https://github.com/example-org/example-repo --exclude-paths exclude.txt --only-verified --json

sample output

🐷🔑🐷  TruffleHog. Unearth your secrets. 🐷🔑🐷Found verified result 🐷🔑Detector Type: AWSDecoder Type: PLAINRaw result: AKIAIOSFODNN7EXAMPLELine: 42File: config/deploy.ymlCommit: 3f8c9a1e2b7d4c6f0a1b2c3d4e5f6a7b8c9d0e1fRepository: https://github.com/example-org/example-repo

guidance

Choosing trufflehog

Use when you need to know whether real, working secrets are exposed in code, history, or storage. Verification is the boundary versus gitleaks: trufflehog tells you which leaked keys still authenticate.

gitleaks

Fast regex-based git scanner. No verification, so expect more candidate noise than trufflehog.

noseyparker

High-speed scanner for huge codebases. trufflehog covers more source types and verifies findings.

secretfinder

Finds keys in JavaScript files. trufflehog scans repos, history, and storage more broadly.

faq

trufflehog questions

trufflehog sends each candidate secret to its provider API and keeps only the ones that authenticate. Output becomes working credentials rather than every high-entropy match.

Run trufflehog yourself

A repository URL feeds trufflehog, which scans its full git history, verifies each candidate against the issuing service, and writes the working secrets as a queryable output.

Run trufflehog in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

mode

STRING

Scan mode that sets the source type: git, github, gitlab, filesystem, s3, gcs, docker, postman, elasticsearch, and more.

git-url

STRING

Git repository URL to scan in git mode (https://, file://, or ssh://).

repo

STRING

--repo

GitHub or GitLab repository to scan.

org

STRING

--org

GitHub or GitLab organization to scan in bulk.

token

STRING

--token

Authentication token for the source being scanned.

only-verified

BOOLEAN

--only-verified

Only report secrets that were verified against the live service.

json

BOOLEAN

--json

Output findings in JSON format for downstream parsing.

exclude-paths

FILE

--exclude-paths

Path to a file of newline-separated regexes for files to skip in the scan.

Name

Type

Flag

Description

key

STRING

--key

S3 key used to authenticate.

org

STRING

--org

GitHub/GitLab organization to scan.

bare

BOOLEAN

--bare

Scan bare repository (e.g. useful while using in pre-receive hooks)

file

FILE

Path to file to scan (must use the `filesystem` mode)

json

BOOLEAN

--json

Output in JSON format.

mode

STRING

Scan mode (available options: git, github, gitlab, filesystem, s3, gcs, circleci, docker, travisci, postman, elasticsearch, jenkins)

repo

STRING

--repo

GitHub/GitLab repository to scan.

debug

BOOLEAN

--debug

Run in debug mode.

image

STRING

--image

Docker image to scan. Image registry is assumed.

nodes

STRING

--nodes

Elasticsearch nodes

token

STRING

--token

Authentication token

trace

BOOLEAN

--trace

Run in trace mode.

branch

STRING

--branch

Branch to scan.

bucket

STRING

--bucket

Name of S3 bucket to scan.

config

FILE

--config

Path to configuration file.

secret

STRING

--secret

S3 secret used to authenticate.

api-key

BOOLEAN

--api-key

Elasticsearch API key.

git-url

STRING

Git repository URL. https://, file://, or ssh:// schema expected (must use the `git` mode)

cloud-id

BOOLEAN

--cloud-id

Elasticsearch cloud ID.

endpoint

STRING

--endpoint

GitHub/GitLab endpoint

password

BOOLEAN

--password

Authentication password

role-arn

STRING

--role-arn

Specify the ARN of an IAM role to assume for scanning.

username

BOOLEAN

--username

Authentication username

verifier

STRING

--verifier

Set custom verification endpoints.

Find leaked credentials and verify which still work

What trufflehog does

Where trufflehog fits

Scan a repo's full git history

Sweep an entire GitHub org

Report only working credentials

Audit cloud buckets and images

trufflehog inputs and flags

Run trufflehog

Choosing trufflehog

gitleaks

noseyparker

secretfinder

trufflehog questions

More Static Code Analysis tools

bandit

gitleaks

gosec

secretfinder

semgrep-scan

dawnscanner

Run trufflehog yourself

Find leaked credentials and verify which still work

What trufflehog does

Where trufflehog fits

Scan a repo's full git history

Sweep an entire GitHub org

Report only working credentials

Audit cloud buckets and images

trufflehog inputs and flags

Run trufflehog

Choosing trufflehog

gitleaks

noseyparker

secretfinder

trufflehog questions

More Static Code Analysis tools

bandit

gitleaks

gosec

secretfinder

semgrep-scan

dawnscanner

Run trufflehog yourself