Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Static Code Analysis

Find leaked credentials and verify which still work

Hunt leaked credentials and verify which still work.

Agent
Scan a repo's full git historySweep an entire GitHub orgReport only working credentials

overview

What trufflehog does

trufflehog scans git history, GitHub and GitLab orgs, filesystems, Docker images, S3, and GCS for leaked credentials. Hundreds of detectors match provider key formats instead of raw high-entropy noise.

With --only-verified, each candidate is tested against the issuing service. Output is working credentials, not every string that looks like one. --json emits structured findings; --exclude-paths skips noisy paths.

Reach for it when you need multi-source coverage with verification. Prefer gitleaks for a faster git-only regex pass. Trickest runs it as a managed Static Code Analysis node writing file and folder outputs.

source github.com/trufflesecurity/trufflehog

use cases

Where trufflehog fits

Scan a repo's full git history

Point trufflehog at a git URL or repo in git mode so it walks every commit, not only the current tree, and recovers secrets that were committed and later deleted.

Sweep an entire GitHub org

Pass an org and a token to scan every repository at once, with include and exclude globs to focus the run and include-members to reach member repos.

Report only working credentials

Enable only-verified so trufflehog tests each candidate against its provider and returns the secrets that still authenticate, cutting false positives to near zero.

Audit cloud buckets and images

Switch the mode to s3, gcs, or docker to scan object storage and container images for embedded keys without cloning anything to disk first.

reference

trufflehog inputs and flags

76 inputs
NameTypeFlagDescription
modeSTRING·Scan mode that sets the source type: git, github, gitlab, filesystem, s3, gcs, docker, postman, elasticsearch, and more.
git-urlSTRING·Git repository URL to scan in git mode (https://, file://, or ssh://).
repoSTRING--repoGitHub or GitLab repository to scan.
orgSTRING--orgGitHub or GitLab organization to scan in bulk.
tokenSTRING--tokenAuthentication token for the source being scanned.
only-verifiedBOOLEAN--only-verifiedOnly report secrets that were verified against the live service.
jsonBOOLEAN--jsonOutput findings in JSON format for downstream parsing.
exclude-pathsFILE--exclude-pathsPath to a file of newline-separated regexes for files to skip in the scan.

Showing key inputs. trufflehog exposes 76 inputs in total.

Full flag reference (76 inputs)
NameTypeFlagDescription
keySTRING--keyS3 key used to authenticate.
orgSTRING--orgGitHub/GitLab organization to scan.
bareBOOLEAN--bareScan bare repository (e.g. useful while using in pre-receive hooks)
fileFILE·Path to file to scan (must use the `filesystem` mode)
jsonBOOLEAN--jsonOutput in JSON format.
modeSTRING·Scan mode (available options: git, github, gitlab, filesystem, s3, gcs, circleci, docker, travisci, postman, elasticsearch, jenkins)
repoSTRING--repoGitHub/GitLab repository to scan.
debugBOOLEAN--debugRun in debug mode.
imageSTRING--imageDocker image to scan. Image registry is assumed.
nodesSTRING--nodesElasticsearch nodes
tokenSTRING--tokenAuthentication token
traceBOOLEAN--traceRun in trace mode.
branchSTRING--branchBranch to scan.
bucketSTRING--bucketName of S3 bucket to scan.
configFILE--configPath to configuration file.
secretSTRING--secretS3 secret used to authenticate.
api-keyBOOLEAN--api-keyElasticsearch API key.
git-urlSTRING·Git repository URL. https://, file://, or ssh:// schema expected (must use the `git` mode)
cloud-idBOOLEAN--cloud-idElasticsearch cloud ID.
endpointSTRING--endpointGitHub/GitLab endpoint
passwordBOOLEAN--passwordAuthentication password
role-arnSTRING--role-arnSpecify the ARN of an IAM role to assume for scanning.
usernameBOOLEAN--usernameAuthentication username
verifierSTRING--verifierSet custom verification endpoints.
directoryFOLDER·Path to directory to scan (must use the `filesystem` mode)
max-depthSTRING--max-depthMaximum depth of commits to scan.
no-updateBOOLEAN--no-updateDon't check for updates.
project-idBOOLEAN--project-idGCS project ID used to authenticate. Can NOT be used with unauth scan.
query-jsonBOOLEAN--query-jsonFilters the documents to search
concurrencySTRING--concurrencyNumber of concurrent workers (default: 1).
environmentSTRING--environmentPostman environment to scan. You can repeat this flag.
json-legacyBOOLEAN--json-legacyUse the pre-v3.0 JSON format. Only works with git, gitlab, and github sources.
pr-commentsBOOLEAN--pr-commentsInclude pull request descriptions and comments in scan.
since-commitSTRING--since-commitCommit to start scan from.
without-authBOOLEAN--without-authScan GCS buckets without authentication. This will only work for public buckets
workspace-idSTRING--workspace-idPostman workspace ID to scan. You can repeat this flag.
collection-idSTRING--collection-idPostman collection ID to scan. You can repeat this flag.
exclude-globsSTRING--exclude-globsComma separated list of globs to exclude in scan. This option filters at the `git log` level, resulting in faster scans.
exclude-pathsFILE--exclude-pathsPath to file with newline separated regexes for files to exclude in scan.
exclude-reposSTRING--exclude-reposRepositories to include in an org scan. This can also be a glob pattern. Must use Github repo full name. Example: "trufflesecurity/trufflehog", "trufflesecurity/t*"
gist-commentsBOOLEAN--gist-commentsInclude gist comments in scan.
include-forksBOOLEAN--include-forksInclude forks in scan.
include-pathsFILE--include-pathsPath to file with newline separated regexes for files to include in scan.
include-reposSTRING--include-reposRepositories to include in an org scan. This can also be a glob pattern. Must use Github repo full name. Example: "trufflesecurity/trufflehog", "trufflesecurity/t*"
index-patternBOOLEAN--index-patternFilters the indices to search
only-verifiedBOOLEAN--only-verifiedOnly output verified results.
service-tokenBOOLEAN--service-tokenElasticsearch service token.
session-tokenSTRING--session-tokenS3 session token used to authenticate temporary credentials.
filter-entropySTRING--filter-entropyFilter unverified results with Shannon entropy. Start with 3.0.
github-actionsBOOLEAN--github-actionsOutput in GitHub Actions format.
issue-commentsBOOLEAN--issue-commentsInclude issue descriptions and comments in scan.
archive-timeoutSTRING--archive-timeoutMaximum time to spend extracting an archive.
exclude-bucketsSTRING--exclude-bucketsBuckets to exclude from scan. Comma separated list of buckets. Globs are supported
exclude-objectsSTRING--exclude-objectsObjects to exclude from scan. Comma separated list of buckets. Globs are supported
include-bucketsSTRING--include-bucketsBuckets to scan. Comma separated list of buckets. Globs are supported
include-membersBOOLEAN--include-membersInclude organization member repositories in scan.
include-objectsSTRING--include-objectsObjects to scan. Comma separated list of buckets. Globs are supported
max-object-sizeSTRING--max-object-sizeMaximum size of objects to scan. Objects larger than this will be skipped. (Byte units eg. 512B, 2KB, 4MB)
no-verificationBOOLEAN--no-verificationDon't verify the results
service-accountFILE--service-accountPath to GCS service account JSON file.
since-timestampBOOLEAN--since-timestampScan git commits more recent than the given timestamp.
workspace-pathsFILE--workspace-pathsPath to Postman workspaces.
archive-max-sizeSTRING--archive-max-sizeMaximum size of archive to scan. (Byte units eg. 512B, 2KB, 4MB)
best-effort-scanBOOLEAN--best-effort-scanAttempts to continuously scan a cluster
collection-pathsFILE--collection-pathsPath to Postman collections.
archive-max-depthSTRING--archive-max-depthMaximum depth of archive to scan.
cloud-environmentBOOLEAN--cloud-environmentUse default IAM credentials in cloud environment.
environment-pathsFILE--environment-pathsPath to Postman environments.
exclude-detectorsSTRING--exclude-detectorsComma separated list of detector types to exclude. Protobuf name or IDs may be used, as well as ranges. IDs defined here take precedence over the include list.
filter-unverifiedBOOLEAN--filter-unverifiedOnly output first unverified result per chunk per detector if there are more than one results.
include-detectorsSTRING--include-detectorsComma separated list of detector types to include. Protobuf name or IDs may be used, as well as ranges.
exclude-environmentsSTRING--exclude-environmentsEnvironment to exclude from scan. You can repeat this flag.
include-environmentsSTRING--include-environmentsEnvironment to include in scan. You can repeat this flag.
exclude-collection-idSTRING--exclude-collection-idCollection ID to exclude from scan. You can repeat this flag.
include-collection-idSTRING--include-collection-idCollection ID to include in scan. You can repeat this flag.
print-avg-detector-timeBOOLEAN--print-avg-detector-timePrint the average time spent on each detector.

example

Run trufflehog

trufflehog · command
# scan a repo's full history, verify secrets, skip vendored pathstrufflehog git https://github.com/example-org/example-repo --exclude-paths exclude.txt --only-verified --json
sample output
🐷🔑🐷  TruffleHog. Unearth your secrets. 🐷🔑🐷Found verified result 🐷🔑Detector Type: AWSDecoder Type: PLAINRaw result: AKIAIOSFODNN7EXAMPLELine: 42File: config/deploy.ymlCommit: 3f8c9a1e2b7d4c6f0a1b2c3d4e5f6a7b8c9d0e1fRepository: https://github.com/example-org/example-repo

guidance

Choosing trufflehog

Use when you need to know whether real, working secrets are exposed in code, history, or storage. Verification is the boundary versus gitleaks: trufflehog tells you which leaked keys still authenticate.

gitleaks

Fast regex-based git scanner. No verification, so expect more candidate noise than trufflehog.

noseyparker

High-speed scanner for huge codebases. trufflehog covers more source types and verifies findings.

secretfinder

Finds keys in JavaScript files. trufflehog scans repos, history, and storage more broadly.

workflows

Workflows using trufflehog

2 workflows

  1. Find Secrets in Wayback Responses

    Pull a domain's archived URLs from web archives, fetch the stored response bodies, and scan them for leaked secrets without touching the live site.

  2. Scan GitHub for Leaked Secrets

    Enumerate an organization's public GitHub repos and scan full commit history with TruffleHog for leaked keys and credentials.

faq

trufflehog questions

trufflehog sends each candidate secret to its provider API and keeps only the ones that authenticate. Output becomes working credentials rather than every high-entropy match.

related

More Static Code Analysis tools

  1. bandit

    AST-based security checks for Python source.

  2. gitleaks

    Detect hardcoded secrets in git repos and plain directories.

  3. gosec

    Go AST security scanner for credentials, crypto, and injection.

  4. secretfinder

    Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.

  5. semgrep-scan

    Static analysis with rules that look like the code they match.

  6. dawnscanner

    Static review of Ruby source for security issues, CVEs, and OWASP risks.

Run trufflehog yourself

A repository URL feeds trufflehog, which scans its full git history, verifies each candidate against the issuing service, and writes the working secrets as a queryable output.

Open trufflehog in the libraryView the workflow

Facts on this page come from the live Trickest tool library.