trufflehog

TruffleHog is a command-line secrets discovery tool. It scans sources such as Git repositories, GitHub, GitLab, Hugging Face models/datasets/spaces/buckets, Docker images, S3 and GCS buckets, local filesystems, syslog, CircleCI, TravisCI, Postman, Jenkins, Elasticsearch and stdin. It can also scan GitHub issues and pull-request comments, and run an experimental GitHub object-discovery scan for deleted or hidden commits. The README states that TruffleHog classifies over 800 secret types and maps findings back to specific identities, such as AWS, Stripe, Cloudflare, Postgres passwords or SSL private keys. It attempts programmatic verification against service APIs and reports results as verified, unverified or unknown; for some commonly leaked credential types it can gather permission and resource details. Private-key verification uses Driftwood technology. Output formats include plain text, JSON, legacy JSON, GitHub Actions and SARIF. SARIF results are buffered in memory and written at the end, which affects memory use on very large scans. The CLI provides flags for concurrency, detector include/exclude lists, entropy filtering, custom verifiers, archive size/depth limits, failing CI runs and result filtering. Install options include Homebrew, Docker, release binaries, go install and an install script with optional cosign checksum verification. CI usage can compare commits with --since-commit and --branch and return exit code 183 with --fail when credentials are found.