Find, verify and analyse leaked credentials
Secret scanner with hundreds of credential detectors that can verify whether a found key is live, across Git, cloud storage, chat and more.
TruffleHog classifies secrets with a large set of detectors, each tied to a specific service. For many of them it can check whether the credential is still valid by calling the provider's API, which helps teams prioritise live leaks over dead ones.
Sources include Git repositories, GitHub and GitLab organisations, file systems, S3 and GCS buckets, Docker images and several SaaS platforms. Truffle Security also sells an enterprise version; the scanner itself is AGPL-licensed.
AGPL-3.0-only · GNU AGPL v3 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: AGPL-3.0.
2 published advisories for TruffleHog in GitHub repository advisories and OSV.dev. Keep the tool updated: security tools often run with broad access.
GHSA-fg8w-m62h-jvvwmedium2026-10-08
Workflow command injection via filenames in --github-actions output
GHSA-3r74-v83p-f4f4CVE-2024-43379low2024-08-17
Blind SSRF in some Detectors
Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.
Secret scanner for Git repositories and files
Fast secret scanner for Git history, directories and stdin, with regex and entropy rules for API keys, tokens and passwords.
All-in-one scanner for images, code, IaC and clusters
Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.
Secrets, certificates and access management platform
Open-core platform to manage application secrets and environment variables across teams and infrastructure, with SDKs, a CLI and secret scanning.
Static analysis for infrastructure as code
Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.
