29 million secrets leaked on public GitHub last year.
API keys. Passwords. Database creds. Private tokens. Yours could be one of them.
TruffleHog finds them for free.
It scans your code, git history, Slack, S3 buckets, Docker images, and 20+ other sources for leaked credentials. And it does more than pattern match — it actually verifies whether the secret is still live.
What it does:
→ Scans 800+ secret types
→ Searches full git history, including deleted commits
→ Verifies leaked credentials by authenticating with them
→ Maps access and permissions tied to each secret
→ Scans GitHub, GitLab, Slack, S3, Jira, Jenkins, Confluence, Docker, and more
→ Integrates with CI/CD to catch leaks before deploy
The scary part:
Hackers can grab exposed secrets in under 5 minutes. Companies take an average of 94 days to fix them.
TruffleHog is free, open source, and built for exactly this problem.
24.5K GitHub stars. 250K daily scans. AGPL-3.0.
github.com/trufflesecurit…
English
