trufflehog

No entries match these filters. Clear filters

1. v3.99.8 Nov 2, 2026 · issue 129

   Custom regex detectors now populate SecretParts on each result, exposing named capture groups as structured metadata for downstream use.

   └──▷ GET THIS VERSIONHomebrewDockergit

   Homebrew copy

   $ brew install trufflehog
   # already installed? upgrade to this version:
   $ brew upgrade trufflehog

   Docker copy

   $ docker pull ghcr.io/trufflesecurity/trufflehog:3.99.8

   git copy

   $ git clone --branch v3.99.8 https://github.com/trufflesecurity/trufflehog.git
   # already have the repo? check out this version:
   $ git checkout v3.99.8

   Homebrew lists this version · published under the project's GitHub account · checked 3 Nov

   • New detection Composio API key detector
2. v3.99.7 Oct 24, 2026 · issue 119
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.99.7 https://github.com/trufflesecurity/trufflehog.git
   # already have the repo? check out this version:
   $ git checkout v3.99.7

   • New detection Fireworks AI API key detector
   • New detection Infisical service token detector
   • New integration xAI analyzer
3. v3.99.4 Oct 22, 2026 · issue 117

   Adds per-source debug config field for targeted logging and a Result.VerificationSkipped output field to distinguish unverified from unverifiable results.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.99.4 https://github.com/trufflesecurity/trufflehog.git
   # already have the repo? check out this version:
   $ git checkout v3.99.4

   • Adds a debug field to LocalSource in source config files, enabling debug-level logging for a single source without raising the global log level — old configs default to off and are unaffected.
   • Adds Result.VerificationSkipped field to result output, distinguishing results where no verifier ran (due to --no-verification, a per-detector override, or a source verify setting) from genuine unverified verdicts.

   2 details in Everything

   • New detection Lambda Cloud API key detector
4. v3.99.3 Oct 19, 2026 · issue 114

   Adds per-logger debug level override for source logging, giving operators fine-grained verbosity control per source.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.99.3 https://github.com/trufflesecurity/trufflehog.git
   # already have the repo? check out this version:
   $ git checkout v3.99.3

   • New detection SonarQube Server token detector
5. announced Oct 14, 2026 · issue 109

   TruffleHog adds focused S3 scanning with prefix/extension filters, OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. for custom verification, and Atlassian scan reliability improvements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Scan only config and deployment objects in a shared S3 bucket, skipping generated files and restricting to JSON, YAML, and env files — reduces download volume and works with prefix-scoped IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. credentials.
   copy

   $ trufflehog s3 --bucket=shared-bucket \
     --include-prefix=configs/ \
     --include-prefix=deployments/ \
     --exclude-prefix=configs/generated/ \
     --include-extension=json \
     --include-extension=yaml \
     --include-extension=env

   Authenticate a custom verification endpoint sitting behind an OAuth2 identity-aware proxy, using resource-owner password credentials so TruffleHog can verify secrets without opening the endpoint to unauthenticated traffic.
   yaml copy

   verify:
     - endpoint: https://verifier.example.com/
       unsafe: false
       auth:
         oauth2:
           tokenEndpoint: https://idp.example.com/oauth2/token
           tokenHeader: X-Proxy-Authorization
           ropc:
             username: scanner
             password: scanner-password
             clientId: trufflehog
             clientSecret: client-secret
             scope: verify

   • Adds --include-prefix, --exclude-prefix, --include-extension, and --exclude-extension flags to trufflehog s3 (Open Source) to limit scans to specific S3 key prefixes and file extensions, pushing included prefixes into S3 list requests so only matching keys are enumerated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds auth.oauth2 block to custom detector verification config, supporting tokenEndpoint, tokenHeader (optional, defaults to Authorization), and ropc credentials (username, password, clientId, clientSecret, scope) so verification endpoints behind an identity-aware proxy can be reached without exposing them to unauthenticated traffic.
   • Jira integrations now validate endpoint reachability and credentials at scan start, failing immediately with a clear error on bad URLs or auth problems rather than stalling.
   • Confluence pagination now follows API-returned links when enumerating spaces, preventing scanning misses caused by permissions-related pagination issues.
   • Jira Data Center skips Cloud-only status calls that previously added thousands of unnecessary requests per scan.
   • Adds --include-prefix, --exclude-prefix, --include-extension, and --exclude-extension flags to trufflehog s3 (Open Source) to limit scans to specific S3 key prefixes and file extensions, pushing included prefixes into S3 list requests so only matching keys are enumerated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds auth.oauth2 block to custom detector verification config, supporting tokenEndpoint, tokenHeader (optional, defaults to Authorization), and ropc credentials (username, password, clientId, clientSecret, scope) so verification endpoints behind an identity-aware proxy can be reached without exposing them to unauthenticated traffic.

   3 more in Everything

6. v3.98.1 Oct 6, 2026 · issue 096

   TruffleHog v3.98.1 adds a Kong Konnect detector and a configurable API timeout for Gerrit scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.98.1 https://github.com/trufflesecurity/trufflehog.git
   # already have the repo? check out this version:
   $ git checkout v3.98.1

   • Adds api_timeout_seconds field to the Gerrit source configuration, accepting values between 0 and 3600 seconds (unset or 0 retains the existing 20 s default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a detector for Kong Konnect Platform (api.konghq.com), matching personal and system access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. with prefixes kpat_ or spat_ followed by 49 alphanumeric characters, with live verification against https://global.api.konghq.com/v3/organizations/me.

   2 details in Everything

7. v3.98.0 Oct 5, 2026 · issue 096

   TruffleHog v3.98.0 adds --no-ignore-tag flag, S3 scan progress display, and an SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. egress guard for analyzer clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.98.0 https://github.com/trufflesecurity/trufflehog.git
   # already have the repo? check out this version:
   $ git checkout v3.98.0

   └──▷ TRY IT
   Surface secrets that your team suppressed with trufflehog:ignore comments — useful for auditing whether ignores are still appropriate.
   copy

   $ trufflehog git https://github.com/my-org/my-repo --no-ignore-tag --results=verified

   • Adds --no-ignore-tag CLI flag to force reporting of secrets on lines marked trufflehog:ignore, overriding the suppression tag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Shows scan progress within individual S3 buckets during active scans.
   • Lists only the configured include prefixes during S3 scans, narrowing object enumeration to the specified scope.
   • Adds pkg/ssrf shared egress guard applied to WithNoLocalIP and analyzer clients to block server-side request forgeryserver-side request forgeryServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. attempts.
   • Verification now decorates findings rather than gating them — a credential is always reported even when its host DNS lookup fails, with the error attached.
   • Adds --no-ignore-tag CLI flag to force reporting of secrets on lines marked trufflehog:ignore, overriding the suppression tag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds pkg/ssrf shared egress guard applied to WithNoLocalIP and analyzer clients to block server-side request forgeryserver-side request forgeryServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. attempts.

   3 more in Everything

8. docs update Oct 4, 2026 · issue 094

   TruffleHog Enterprise adds Azure Repos (cloud) integration to scan Azure DevOps repositories for secrets⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Scan all projects in an Azure DevOps org every 12 hours, skipping binaries and a specific project and repo, using a local config file.
   yaml copy

   sources:
   - connection:
       "@type": type.googleapis.com/sources.AzureRepos
       organizations:
       - trufflesecurity
       ignoreProjects:
       - Project2
       ignoreRepos:
       - https://dev.azure.com/trufflesecurity/IgnoreRepo
       includeForks: false
       skipBinaries: true
       token: XXXXXXXXXXXXXXXXXXXXXXXXXX
     name: Azure Repos
     scanPeriod: 12h
     type: SOURCE_TYPE_AZURE_REPOS
     verify: true

   • Adds SOURCE_TYPE_AZURE_REPOS source type with organizations, ignoreProjects, ignoreRepos, includeProjects, includeRepos, repositories, includeForks, skipBinaries, skipArchives, endpoint, and scanPeriod config fields for scanning Azure DevOps cloud repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports includeForks: true/false to control whether forked Azure Repos repositories are included in scans.
   • Supports skipBinaries and skipArchives boolean fields to skip binary and archive files during Azure Repos scans.
   • Supports include/exclude filters via includeProjects, ignoreProjects, includeRepos, and ignoreRepos fields, with ignore filters always overriding include filters.
   • Adds Azure Repos (cloud) integration configurable via the TruffleHog Integrations UI using a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) with Code (read) scope.

   +1 more show less

   • Supports auto-resume, pre-commit scanning, and base64-encoded data detection for Azure Repos sources.

   6 details in Everything

9. docs update Oct 4, 2026 · issue 094

   TruffleHog Enterprise gains a Jira integration that scans issue descriptions, comments, and attachments for secrets⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Scan a Jira Cloud workspace for secrets, scoped to specific projects, using an API token — paste this into your TruffleHog local config file.
   yaml copy

   sources:
   - connection:
       "@type": type.googleapis.com/sources.JIRA
       endpoint: https://ourbusiness.atlassian.net
       basicAuth:
         username: [email protected]
         password: <jira-cloud-api-token>
       projects:
         - ENG
         - SEC
     name: JIRA
     scanPeriod: 12h
     type: SOURCE_TYPE_JIRA
     verify: true

   Scan a self-hosted Jira Server or Data Center instance using a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., scanning all accessible projects automatically.
   yaml copy

   sources:
   - connection:
       "@type": type.googleapis.com/sources.JIRA
       endpoint: https://jira.ourbusiness.com
       token: <personal-access-token>
     name: JIRA
     scanPeriod: 12h
     type: SOURCE_TYPE_JIRA
     verify: true

   Scan a self-hosted Jira Server instance while excluding noisy or irrelevant projects from enumeration.
   yaml copy

   sources:
   - connection:
       "@type": type.googleapis.com/sources.JIRA
       endpoint: https://jira.ourbusiness.com
       basicAuth:
         username: [email protected]
         password: <password>
       ignoreProjects:
         - SANDBOX
         - ARCHIVE
     name: JIRA
     scanPeriod: 12h
     type: SOURCE_TYPE_JIRA
     verify: true

   • Adds SOURCE_TYPE_JIRA source type with basicAuth (Jira Cloud API token or Server username/password) and token (bearer PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) authentication modes, configurable via local config file or the Integrations UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports projects field to scope scanning to explicit project keys, and ignoreProjects to skip specified project keys during enumeration.
   • Supports insecureSkipVerifyTls boolean field to skip TLS certificate verification for self-hosted Jira deployments.
   • Supports scanPeriod field (e.g. 12h) to control how frequently the Jira source is rescanned.
   • Scans Jira issue descriptions, comments, attachments, archive files, base64-encoded data, and binaries for credentials and sensitive data, with auto-resume support.

   5 details in Everything

10. docs update Oct 4, 2026 · issue 094

    TruffleHog adds Bitbucket Cloud, Server, and Data Center integration with five authentication modes and full credential scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan all repos in a Bitbucket Cloud workspace using a Workspace Access Token, skipping binaries and two known noisy repos, on a 12-hour cadence.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Bitbucket
        endpoint: https://bitbucket.org/myworkspace
        token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        ignoreRepos:
          - https://bitbucket.org/myworkspace/ignore.git
          - https://bitbucket.org/myworkspace/ignore2.git
        skipBinaries: true
      name: Bitbucket Cloud Token Auth
      scanPeriod: 12h
      type: SOURCE_TYPE_BITBUCKET
      verify: true

    Scan a Bitbucket Data Center instance using OAuth and automatically keep the refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. current in AWS Secrets Manager.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Bitbucket
        endpoint: https://bitbucket.ourbusiness.com
        oauth:
          refreshToken: <refresh token generated by the helper script>
          clientId: <client ID from the Bitbucket application link>
          clientSecret: <client secret from the Bitbucket application link>
          redirectUri: <redirect URI configured in the Bitbucket application link>
          oauthAuthorizationEndpoint: https://bitbucket.ourbusiness.com/rest/oauth2/latest/authorize
          oauthTokenEndpoint: https://bitbucket.ourbusiness.com/rest/oauth2/latest/token
          oauthScopes:
            - REPO_READ
        allowSecretsManagerWrite: true
      name: Bitbucket Server OAuth
      scanPeriod: 12h
      type: SOURCE_TYPE_BITBUCKET
      verify: true

    Generate the initial OAuth refresh token for Bitbucket Data Center before configuring the OAuth block above.
    copy

    $ ./bitbucket-oauth.sh -a

    • Adds SOURCE_TYPE_BITBUCKET source type with token field (Workspace Access Token, Bearer auth) for Bitbucket Cloud, requiring at least read:repository:bitbucket and read:workspace:bitbucket scopes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds apiToken block with password (ATAT-prefix API token), email, and optional username fields for Bitbucket Cloud and Data Center API Token auth.
    • Adds basicAuth block with username and password fields for Bitbucket Server / Data Center basic auth.
    • Adds oauth block with refreshToken, clientId, clientSecret, redirectUri, oauthAuthorizationEndpoint, oauthTokenEndpoint, and oauthScopes fields for Bitbucket Server / Data Center OAuth.
    • Adds allowSecretsManagerWrite config field to automatically overwrite the OAuth refresh token in AWS Secrets Manager (requires secretsmanager:PutSecretValue) when config is pulled from a secrets manager.

    +6 more show less

    • Adds installationType config field accepting autodetect, cloud, or data center to override Cloud vs. Data Center autodetection.
    • Adds ignoreRepos config field (list of repository URLs) to skip specific repositories during enumeration.
    • Adds repositories config field for an explicit list of repositories to scan instead of full workspace enumeration.
    • Adds scanPeriod config field to set the interval between recurring scans (e.g., 12h).
    • Adds bitbucket-oauth.sh helper script with -a flag (authorize and generate initial refresh token) and -b flag (refresh an existing token) for Bitbucket Data Center OAuth setup.
    • Supports scanning Bitbucket Cloud, Server, and Data Center for credentials and sensitive data, including archive files, archived repositories, base64-encoded data, and binaries, with include/exclude filters, pre-commit, pre-receive, and auto-resume capabilities.

    11 details in Everything

11. docs update Oct 4, 2026 · issue 094

    TruffleHog adds documented AWS S3 integration with four IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. auth modes, bucket filters, and auto-resume scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan S3 buckets across multiple AWS accounts by assuming roles in each target account — no static credentials required.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.S3
        roles:
          - arn:aws:iam::111111111111:role/TruffleHogScanner
          - arn:aws:iam::222222222222:role/TruffleHogScanner
        sessionToken: {}
      name: S3
      scanPeriod: 12h
      type: SOURCE_TYPE_S3
      verify: true

    Limit an S3 scan to specific buckets, skip known-noisy buckets, and cap object size to avoid scanning huge files.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.S3
        accessKey:
          key: AKIAKEYID
          secret: XXXXXXXXXXXXXXXXXXXXXXXXXX
        buckets:
          - prod-app-logs
          - dev-secrets
        ignoreBuckets:
          - marketing-assets
        maxObjectSize: 10485760
      name: S3
      scanPeriod: 12h
      type: SOURCE_TYPE_S3
      verify: true

    Use the EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance profile of the scanner host to assume roles — no credentials in config, suitable for production scanner instances.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.S3
        roles:
          - arn:aws:iam::333333333333:role/TruffleHogScanner
      name: S3
      scanPeriod: 12h
      type: SOURCE_TYPE_S3
      verify: true

    • Adds SOURCE_TYPE_S3 source type with cloudEnvironment, roles, accessKey/secret, sessionToken, buckets, ignoreBuckets, maxObjectSize, scanPeriod, and verify config fields for scanning S3 buckets via local configuration file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports four authentication modes for the S3 integration: IAM credentials (standard credential chain), IAM role assumption (multi-account via roles list of ARNs), IAM role assumption with EC2 instance profile (no sessionToken), and static credentials (accessKey/secret embedded in config).
    • Enables multi-account S3 scanning by specifying multiple role ARNs under roles; omitting buckets scans every bucket the assumed role can list.
    • Supports ignoreBuckets list to skip specific buckets and maxObjectSize integer field (bytes) to skip oversized objects during scanning.

    4 details in Everything

12. docs update Oct 4, 2026 · issue 094

    TruffleHog Enterprise adds Share Secrets — access-controlled, expiring links that let non-platform users view and rotate findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Share button on a finding's detail page to generate a secure, single-secret link recipients can open without a TruffleHog Enterprise login.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports expiration windows of On read, 1 hour, 1 day, 7 days, or 1 month, chosen per link at creation time.
    • Enforces recipient authentication via Google OAuth or SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. against a configurable trusted-domain allowlist under Settings > Shared secrets > Edit trusted domains.
    • Adds a Shared secrets management page with an Active shared secrets tab listing all unexpired links and a Sharing settings tab for trusted domains and default auth method, with per-link revocation.

    4 details in Everything

13. docs update Oct 4, 2026 · issue 094

    TruffleHog adds locally-configured notifiers via config.yaml, supporting Jira, Slack, Stdout, Splunk, and Webhook⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Route all secret findings from sources in the current config to Stdout, including a secret link and unverified results.
    config.yaml copy

    notifiers:
    - name: stdout secrets notifications
      sendUnverified: true
      sourcesToNotify: SOURCES_IN_THIS_CONFIG
      customText: Message to add to notifier
      includeSecretLink: true
      type: NOTIFIER_TYPE_STDOUT
      numWorkers: 16

    • Adds notifiers field to config.yaml for locally-configured secret-found alerts, with sourcesToNotify (accepting ALL, SOURCES_IN_THIS_CONFIG, or a comma-separated source list), optional customText, and optional includeSecretLink fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

14. docs update Oct 4, 2026 · issue 094

    TruffleHog gains trufflehog analyze to evaluate live secrets' metadata, permissions, and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. posture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    After a scan surfaces a leaked key, run analyze to instantly confirm whether it is still active and what it can access — without changing any state.
    copy

    $ trufflehog analyze

    • Adds trufflehog analyze subcommand to evaluate whether a discovered secret is live and what resources/permissions it holds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds self-discovery analyzers that perform non-state-changing API calls to determine a key's resources and permissions (see trufflesecurity.com/analyzers for supported analyzers).
    • Adds enterprise-only Cloud Analyze mode that connects to cloud environments to assess a secret's IAM posture, with GCP analyze currently supported.

    3 details in Everything

15. docs update Oct 4, 2026 · issue 094

    TruffleHog adds on-demand secret reverification for GitHub and Slack integrations via UI and API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Enables triggering individual secret reverification via API (see the API documentation for details).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

16. docs update Oct 4, 2026 · issue 094

    TruffleHog Enterprise adds Scan Details and Activity Log surfaces with 90-day retention and read APIs for scan health monitoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a Scans tab per integration (Scan Details) exposing per-run status, duration, source coverage, and live-secret delta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a top-level Activity Log view covering scan events across every source, with per-source filtering to surface failure frequency and last-success time.
    • Exposes a read API for both Scan Details and the Activity Log, enabling scan-health data in external tooling.
    • Retains scan runs and Activity Log events for 90 days.

    4 details in Everything

17. docs update Sep 25, 2026 · issue 085

    TruffleHog adds Postman integration to scan workspaces, collections, requests, and auth configs for secrets⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan specific Postman workspaces for leaked credentials on a 12-hour schedule, scoped to the workspaces your team owns.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Postman
        token: PMAK-XXXXXXX
        workspaces:
          - <workspace-id-1>
          - <workspace-id-2>
      name: Postman
      scanPeriod: 12h
      type: SOURCE_TYPE_POSTMAN
      verify: true

    Enumerate and scan ALL Postman workspaces the API key can access — useful for a first-run org-wide audit without needing to list workspace IDs.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Postman
        token: PMAK-XXXXXXX
      name: Postman
      scanPeriod: 24h
      type: SOURCE_TYPE_POSTMAN
      verify: true

    • Adds SOURCE_TYPE_POSTMAN source type with token and workspaces config fields to scan Postman workspaces, collections, folders, requests, saved responses, environments, and authorization configurations (Basic Auth, Bearer Tokens, API Keys, AWS, OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs.) for credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Omitting the workspaces field causes the scanner to enumerate and scan every workspace the API key can access, enabling full-account discovery without listing IDs explicitly.

    2 details in Everything

18. docs update Sep 25, 2026 · issue 085

    trufflehog: Adds a Buildkite integration configurable via the TruffleHog Integrations UI, requiring a Buildkite API access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. with GraphQL API access and scopes: Organization Access, Read Artifacts, Read Builds, Read Build Logs, and Read Pipelines.

    └──▷ USE IT
    Continuously scan a Buildkite org every 12 hours for leaked credentials in build logs and artifacts using a local config file.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Buildkite
        token: XXXXXXXXXXXXXXXXXXXXXXXXXX
        name: Buildkite logs and artifacts
        scanPeriod: 12h
        type: SOURCE_TYPE_BUILDKITE
        verify: true

19. docs update Sep 25, 2026 · issue 085

    TruffleHog Enterprise adds Azure Repos (cloud) integration for scanning Azure DevOps repositories for credentials⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan all Azure DevOps repos in an org while skipping a specific project and repo, with binary and archive scanning enabled on a 12-hour schedule.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.AzureRepos
        organizations:
          - trufflesecurity
        ignoreProjects:
          - Project2
        ignoreRepos:
          - https://dev.azure.com/trufflesecurity/IgnoreRepo
        includeForks: false
        skipBinaries: true
        token: <PAT_TOKEN>
      name: Azure Repos
      scanPeriod: 12h
      type: SOURCE_TYPE_AZURE_REPOS
      verify: true

    • Adds SOURCE_TYPE_AZURE_REPOS source type with organizations, projects, includeProjects, ignoreProjects, repositories, includeRepos, ignoreRepos, includeForks, skipBinaries, skipArchives, and endpoint config fields for scoping Azure DevOps cloud repo scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports scanPeriod scheduling (e.g. 12h), auto-resume, pre-commit scanning, include/exclude filters, history scanning, and base64-encoded data detection for Azure Repos sources.

    2 details in Everything

20. docs update Sep 25, 2026 · issue 085

    TruffleHog Enterprise gains Slack Continuous integration for real-time secret detection across channels, DMs, and files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan a specific set of Slack channels every 12 hours using the self-hosted legacy scanner, excluding noisy or low-value channels.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Slack
        endpoint: https://slack.ourbusiness.com
        token: XXXXXXXXXXXXXXXXXXXXXXXXXX
        channels:
          - engineering-general
          - devops-alerts
        ignoreList:
          - random
          - watercooler
        name: Slack
        scanPeriod: 12h
        type: SOURCE_TYPE_SLACK
        verify: true

    • Adds self-hosted legacy Slack scanner config via a local YAML source block with fields endpoint, token, channels, ignoreList, scanPeriod, and verify under sources[].connection (@type: type.googleapis.com/sources.Slack).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Slack Continuous requests discovery:read scope to support upcoming historical secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. of full workspace content including attachments and archives (Slack Enterprise Grid Plan only).
    • Slack Continuous scans canvases, lists, edited messages, files shared in conversations, private channels (bot must be invited), direct messages, and group DMs the bot is part of.
    • Legacy Slack scanner supports channels and ignoreList config fields to explicitly include or exclude channels from scanning, with scanPeriod to control scan frequency.

    4 details in Everything

21. docs update Sep 25, 2026 · issue 085

    TruffleHog Enterprise gains a Jira integration that scans issue descriptions, comments, and attachments for secrets⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan a self-hosted Jira Server instance using a PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., limiting to two specific project keys so only high-value projects are covered.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.JIRA
        endpoint: https://jira.ourbusiness.com
        token: <your-personal-access-token>
        projects:
          - ENG
          - ITSYS
      name: JIRA
      scanPeriod: 12h
      type: SOURCE_TYPE_JIRA
      verify: true

    Scan Jira Cloud across all accessible projects using an Atlassian API token, excluding a noisy project from results.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.JIRA
        endpoint: https://ourbusiness.atlassian.net
        basicAuth:
          username: [email protected]
          password: <jira-cloud-api-token>
        ignoreProjects:
          - SANDBOX
      name: JIRA
      scanPeriod: 6h
      type: SOURCE_TYPE_JIRA
      verify: true

    • Adds SOURCE_TYPE_JIRA source type with basicAuth (Jira Cloud API token or Server username/password) and token (Server/Data Center PAT) authentication modes in local config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds projects list field to restrict scanning to explicit Jira project keys (e.g. ENG, ITSYS); omit to enumerate all accessible projects.
    • Adds ignoreProjects list field to skip specific project keys during enumeration-based scans.
    • Adds insecureSkipVerifyTls boolean field to bypass TLS certificate verification for self-hosted Jira deployments.
    • Adds scanPeriod field (e.g. 12h) to control how frequently the Jira source is rescanned.

    +2 more show less

    • New Jira integration scans issue descriptions, comments, attachments, archive files, base64-encoded data, and binaries for credentials and sensitive data, with auto-resume support.
    • Supports configuring the Jira integration via the TruffleHog Enterprise web UI under Integrations, in addition to local config file.

    7 details in Everything

22. docs update Sep 25, 2026 · issue 085

    TruffleHog adds a Jenkins integration to scan build logs for credentials and sensitive data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan a Jenkins instance for leaked credentials in build logs using a dedicated scanner account with basic auth.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Jenkins
        endpoint: https://jenkins.example.com
        basicAuth:
          username: scanner-account
          password: XXXXXXXXXXXXXXXXXXXXXXXXXX
      name: Jenkins logs
      scanPeriod: 12h
      type: SOURCE_TYPE_JENKINS
      verify: true

    Scan a Jenkins instance that allows anonymous read access, without providing credentials.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Jenkins
        endpoint: https://jenkins.example.com
        unauthenticated: {}
      name: Jenkins logs
      scanPeriod: 12h
      type: SOURCE_TYPE_JENKINS
      verify: true

    • Adds endpoint, insecureSkipVerifyTls, scanPeriod, and verify fields to the Jenkins source connection block.
    • Supports scanning Jenkins build logs for credentials, including base64-encoded data, with auto-resume capability.
    • Adds Jenkins integration configurable via the TruffleHog Integrations UI using a server URL and optional basic auth credentials.

    3 details in Everything

23. docs update Sep 25, 2026 · issue 085

    TruffleHog Enterprise adds a Google Drive integration to scan files and comments for credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Set up a Google Drive integration to continuously scan a Drive account for leaked credentials every 12 hours.
    📍In TruffleHog Enterprise, go to Integrations › Add integration › Source › Google Drive, sign in with the target Google account, grant the https://www.googleapis.com/auth/drive.readonly permission, then name the integration and confirm the default 12-hour scan interval.
    • Grants access via the https://www.googleapis.com/auth/drive.readonly OAuth scope — no file content is stored, only in-memory scanning.
    • Configurable scan interval (12 hours by default) per integration; each integration covers a single Google Drive account.
    • Files larger than 1 GB are not scanned; drafts are excluded from scanning.

    3 details in Everything

24. docs update Sep 25, 2026 · issue 085

    TruffleHog adds Google Cloud Storage integration for scanning GCS buckets with IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., service account, or unauthenticated modes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan specific GCS buckets using workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. or gcloud credentials, restricting to known buckets and skipping large objects.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.GCS
        adc: {}
        projectId: my-project
        includeBuckets:
          - secrets-bucket
          - app-configs
        maxObjectSize: 10485760
      name: GCS
      scanPeriod: 24h
      type: SOURCE_TYPE_GCS
      verify: true

    Scan public GCS buckets without credentials, filtering to specific objects using glob patterns.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.GCS
        unauthenticated: {}
        includeBuckets:
          - public-data-bucket
        includeObjects:
          - configs/*
          - secrets/*
      name: GCS
      scanPeriod: 12h
      type: SOURCE_TYPE_GCS
      verify: true

    • Adds includeBuckets and excludeBuckets config fields to restrict which GCS buckets are scanned; includeBuckets is required in unauthenticated mode.
    • Adds includeObjects and excludeObjects config fields supporting glob patterns (*) to filter which objects within buckets are scanned.
    • Adds maxObjectSize integer field to skip objects exceeding a specified byte size during GCS scans.
    • Adds scanPeriod field (e.g. 12h) to schedule recurring GCS scans.

    4 details in Everything

25. docs update Sep 25, 2026 · issue 085

    TruffleHog adds Docker image scanning with four auth methods via local config (SOURCE_TYPE_DOCKER)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan a private Docker image using credentials already stored by docker login, running every 12 hours.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Docker
        dockerKeychain: true
        images:
        - myregistry.example.com/myapp:latest
      name: Docker
      scanPeriod: 12h
      type: SOURCE_TYPE_DOCKER
      verify: true

    Scan a private registry image using a bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. when no local Docker login is available.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Docker
        bearerToken: <your-bearer-token>
        images:
        - myregistry.example.com/myapp:latest
      name: Docker
      scanPeriod: 12h
      type: SOURCE_TYPE_DOCKER
      verify: true

    • Adds SOURCE_TYPE_DOCKER source type to scan Docker images for credentials and sensitive data, configured via local YAML with the @type: type.googleapis.com/sources.Docker connection type.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports unauthenticated: {} mode for scanning public Docker images without registry credentials.
    • Supports dockerKeychain: true to reuse credentials from a local docker login session when scanning private registries.
    • Supports basicAuth.username / basicAuth.password fields for registries that accept username and password credentials.
    • Supports bearerToken field for registries that accept bearer token authentication.

    +1 more show less

    • Scans archive files, base64-encoded data, and binaries within Docker image layers.

    6 details in Everything

26. docs update Sep 25, 2026 · issue 085

    TruffleHog gains a Confluence integration (Enterprise) to scan pages, attachments, and comments for leaked credentials⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan a Confluence Cloud workspace every 12 hours, including attachments but skipping version history, scoped to global spaces only.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Confluence
        endpoint: https://ourbusiness.atlassian.net/wiki
        basicAuth:
          username: [email protected]
          password: XXXXXXXXXXXXXXXXXXXXXXXXXX
        spaces:
          - Engineering Docs
        ignoreSpaces:
          - Archive
        spacesScope: GLOBAL
        includeAttachments: true
        skipHistory: true
      name: Confluence
      scanPeriod: 12h
      type: SOURCE_TYPE_CONFLUENCE
      verify: true

    Scan an on-premises Confluence Data Center instance using a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.), including all space types and attachments.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Confluence
        endpoint: https://ourbusiness.com/wiki
        token: XXXXXXXXXXXXXXXXXXXXXXXXXX
        spacesScope: ALL
        includeAttachments: true
        skipHistory: false
      name: Confluence
      scanPeriod: 24h
      type: SOURCE_TYPE_CONFLUENCE
      verify: true

    • Adds Confluence integration (Enterprise only) via local config using @type: type.googleapis.com/sources.Confluence and type: SOURCE_TYPE_CONFLUENCE, supporting Confluence Cloud and Data Center / Server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds spaces (list of Space Names to scan) and ignoreSpaces (Space Names to skip) config fields for scoped scanning.
    • Adds spacesScope config field to restrict scanning to ALL, GLOBAL, or PERSONAL space types (defaults to ALL).
    • Adds skipHistory boolean config field to opt out of scanning historical page versions.
    • Adds insecureSkipVerifyTls boolean config field to skip TLS/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. verification for Confluence endpoints.

    +1 more show less

    • Supports auto-resume of interrupted Confluence scans and include/exclude space filters.

    6 details in Everything

27. docs update Sep 25, 2026 · issue 085

    trufflehog: Adds SOURCE_TYPE_CIRCLECI source type with token, name, scanPeriod, and verify fields in the local configuration file to scan CircleCI build logs for credentials and sensitive data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan all CircleCI build logs accessible to a token on a rolling 12-hour window to detect leaked credentials in CI output.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.CircleCI
        token: XXXXXXXXXXXXXXXXXXXXXXXXXX
      name: CircleCI logs
      scanPeriod: 12h
      type: SOURCE_TYPE_CIRCLECI
      verify: true

28. docs update Sep 25, 2026 · issue 085

    trufflehog: Adds SOURCE_TYPE_BITBUCKET source type with token field for Bitbucket Cloud Workspace Access Token auth (Bearer-based), requiring at least read:repository:bitbucket and read:workspace:bitbucket scopes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan a Bitbucket Cloud workspace using a Workspace Access Token, skipping binary files and rechecking every 12 hours.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Bitbucket
        endpoint: https://bitbucket.org/myworkspace
        token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        skipBinaries: true
        ignoreRepos:
          - https://bitbucket.org/myworkspace/ignore.git
        scanPeriod: 12h
      name: Bitbucket Cloud Token Auth
      type: SOURCE_TYPE_BITBUCKET
      verify: true

    Scan a Bitbucket Data Center instance using OAuth when basic auth is not allowed, with auto-refresh of the token stored in AWS Secrets Manager.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.Bitbucket
        endpoint: https://bitbucket.ourbusiness.com
        oauth:
          refreshToken: <refresh token generated by the helper script>
          clientId: <client ID from the Bitbucket application link>
          clientSecret: <client secret from the Bitbucket application link>
          redirectUri: <redirect URI configured in the Bitbucket application link>
        allowSecretsManagerWrite: true
        oauthAuthorizationEndpoint: https://bitbucket.ourbusiness.com/rest/oauth2/latest/authorize
        oauthTokenEndpoint: https://bitbucket.ourbusiness.com/rest/oauth2/latest/token
        oauthScopes:
          - REPO_READ
        installationType: data center
        scanPeriod: 12h
      name: Bitbucket Server OAuth
      type: SOURCE_TYPE_BITBUCKET
      verify: true

    Generate the initial OAuth refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. for a Bitbucket Data Center application link before configuring the OAuth source.
    copy

    $ ./bitbucket-oauth.sh -a

    • Adds apiToken block (with password, email, and optional username fields) for Bitbucket Cloud or Data Center API Token auth using ATAT-prefixed tokens.
    • Adds oauth block (with refreshToken, clientId, clientSecret, redirectUri, oauthAuthorizationEndpoint, oauthTokenEndpoint, and oauthScopes fields) for Bitbucket Server/Data Center OAuth via application link.
    • Adds allowSecretsManagerWrite config field to automatically update the OAuth refreshToken in AWS Secrets Manager (requires secretsmanager:PutSecretValue) when config is secrets-manager-hosted.
    • Adds installationType config field (values: autodetect, cloud, data center) to override Cloud vs. Data Center autodetection when it causes connection errors.
    • Adds ignoreRepos config field to exclude specific repositories from enumeration-based scans.

    +2 more show less

    • Adds skipBinaries and skipArchives boolean config fields to exclude binary and archive files from scanning.
    • Adds repositories config field for an explicit list of repositories to scan instead of enumerating the workspace.

    7 details in Everything

29. docs update Sep 25, 2026 · issue 085

    trufflehog: Adds SOURCE_TYPE_S3 source type with cloudEnvironment config block for scanning S3 buckets using the standard AWS credential chain (environment variables, ~/.aws/credentials, or instance metadata).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Scan all buckets reachable by an assumed IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role in a target account — useful when running TruffleHog from a central security account that assumes roles in each prod account.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.S3
        roles:
          - arn:aws:iam::111122223333:role/TruffleHogScanner
        sessionToken: {}
      name: S3
      scanPeriod: 12h
      type: SOURCE_TYPE_S3
      verify: true

    Limit scanning to two specific buckets and skip objects over 50 MB to keep scan time predictable in large environments.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.S3
        accessKey:
          key: AKIAKEYID
          secret: XXXXXXXXXXXXXXXXXXXXXXXXXX
        buckets:
          - prod-artifacts
          - dev-logs
        maxObjectSize: 52428800
      name: S3
      scanPeriod: 24h
      type: SOURCE_TYPE_S3
      verify: true

    Exclude known-safe buckets (e.g. public asset buckets) from an ambient-credential scan to reduce noise.
    yaml copy

    sources:
    - connection:
        "@type": type.googleapis.com/sources.S3
        cloudEnvironment: {}
        ignoreBuckets:
          - my-public-static-assets
          - cdn-cache-bucket
      name: S3
      scanPeriod: 12h
      type: SOURCE_TYPE_S3
      verify: true

    • Adds roles field to the S3 source config for IAM role assumption mode, enabling multi-account bucket scanning by specifying one or more role ARNs.
    • Adds accessKey / key and secret fields to the S3 source config for static-credential authentication against explicit buckets lists.
    • Adds ignoreBuckets config field to skip specific buckets during a scan.

    3 details in Everything

30. docs update Sep 25, 2026 · issue 085

    TruffleHog adds secret manager URI support for --config, accepting AWS, GCP, and Azure Key Vault sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Store your TruffleHog YAML config as a secret in GCP Secret Manager and reference it at scan time — keeps credentials out of the filesystem entirely.
    copy

    $ trufflehog scan --config="gsm://my-gcp-project/trufflehog-config"

    Pull scan configuration from AWS Secrets Manager in a specific region, useful in AWS-native CI/CD pipelines.
    copy

    $ trufflehog scan --config="asm://us-east-1/trufflehog-config"

    Bootstrap a TruffleHog scanner agent with no config file, using only environment variables — ideal for containerised deployments.
    copy

    $ export TRUFFLEHOG_API_ADDRESS=real-big-chipmunk.api.c1.prod.trufflehog.org:8443
    export TRUFFLEHOG_SCANNER_GROUP="prod-scanners"
    export TRUFFLEHOG_SCANNER_TOKEN=thog-agent-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    trufflehog scan

    • Supports asm://REGION/SECRET_NAME URI scheme in --config to pull scan configuration directly from AWS Secrets Manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports gsm://GCP_PROJECT_NAME/SECRET_NAME URI scheme in --config to pull scan configuration from GCP Secret Manager.
    • Supports akv://AZURE_VAULT_NAME/SECRET_NAME URI scheme in --config to pull scan configuration from Azure Key Vault.
    • Supports --config=/path/to/config.yaml file-based configuration with runtime expansion of $VARIABLE and ${VARIABLE} environment variable references.
    • Supports TRUFFLEHOG_API_ADDRESS, TRUFFLEHOG_SCANNER_GROUP, and TRUFFLEHOG_SCANNER_TOKEN environment variables as a bare-minimum alternative to a config file.

    5 details in Everything

31. docs update Sep 25, 2026 · issue 085

    trufflehog: Adds a Share button on each finding's detail page to generate a scoped, expiring URL that lets recipients view finding details without a TruffleHog Enterprise login.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Before sharing a finding, configure which email domains are permitted to open share links so recipients from outside your org cannot access them.
    📍In TruffleHog Enterprise, go to Settings › Shared secrets › Edit trusted domains and add your organization's domain(s) (e.g. your-org.com) as a comma-separated list, then save.
    • Enforces recipient authentication via Google OAuth or SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. and validates the recipient's email against a configurable Trusted domains comma-separated allowlist under Settings > Shared secrets > Edit trusted domains.

    1 detail in Everything

32. docs update Sep 25, 2026 · issue 085

    trufflehog: Adds a notifiers field to config.yaml to configure secret-detection alerting locally, with sourcesToNotify (accepting ALL, SOURCES_IN_THIS_CONFIG, or a comma-separated list of source names), optional customText, and optional includeSecretLink fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Alert to stdout whenever any source in the current config finds a secret, including a secret link and a custom message — useful for piping results into CI logs without cloud dependencies.
    config.yaml copy

    notifiers:
    - name: stdout secrets notifications
      sendUnverified: true
      sourcesToNotify: SOURCES_IN_THIS_CONFIG
      customText: 'Secret detected — triage immediately'
      includeSecretLink: true
      type: NOTIFIER_TYPE_STDOUT

    • Adds NOTIFIER_TYPE_STDOUT as an open-source-compatible notifier type for piping secret alerts to standard output.

    1 detail in Everything

33. docs update Sep 25, 2026 · issue 085
    └──▷ TRY IT
    After TruffleHog detects a secret, run the analyzer to confirm it is live and see what permissions and resources it carries before deciding on remediation priority.
    copy

    $ trufflehog analyze

34. docs update Sep 25, 2026 · issue 085

    TruffleHog adds on-demand secret reverification via UI Actions dropdown and API, without waiting for a full scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Check whether a specific leaked secret has been rotated without waiting for the next scheduled scan cycle.
    📍In TruffleHog, navigate to the Secret Details page for the secret in question, then open the Actions dropdown and select the reverify option.
    • Exposes secret reverification via API for programmatic use — see the API documentation for details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Secret reverification is currently supported only for secrets detected within GitHub or Slack integrations.

    2 details in Everything

35. v3.97.9 Sep 24, 2026 · issue 084

    TruffleHog v3.97.9 adds version and comment_number fields to SharePoint source metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.97.9 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.97.9

    • Adds Err() method to JobProgress and JobProgressRef, mirroring context.Err so callers can programmatically read why a scan job ended.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

36. v3.97.8 Sep 23, 2026 · issue 084

    TruffleHog v3.97.8 adds Okta OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client credential detection and per-detector verification timing metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.97.8 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.97.8

    • Adds detection and verification for Okta OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 client credentials (client_id + client_secret) in the Okta detector, complementing the existing SSWS API token detection; verifies via the client_credentials grant against https://{domain}/oauth2/default/v1/token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds per-detector verification wall-time tracking to the verification cache via an optional DetectorMetricsReporter interface, enabling metrics backends to record remote verification latency broken down by detector type.
    • Ensures 45 secret detectors now report findings even when live verification fails for operational reasons (request build errors, transport errors, body read errors) rather than silently discarding them, using SetVerificationError to record the failure.
    • Adds detection and verification for Okta OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 client credentials (client_id + client_secret) in the Okta detector, complementing the existing SSWS API token detection; verifies via the client_credentials grant against https://{domain}/oauth2/default/v1/token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

37. docs update Sep 23, 2026 · issue 083

    TruffleHog gains S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage scanning, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output, scan history API, and 9+ new secret detectors⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a --sarif flag that emits a SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. log compatible with GitHub Code Scanning upload, mapping verified findings to errors and unverified findings to warnings, each with a stable fingerprint for tracking across scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a scan run history read API covering the global run list, per-source run lists, and individual run detail, with cursor pagination, documented filters, and stable error codes; accepts administrator or editor API keys.
    • Adds a scans tab to integration detail showing retained scan history — start time, active duration, resources reached, and change in live secrets — with filtering by status and start time.
    • S3 sources now accept a custom endpoint and signing region, enabling scanning of any S3-compatible object storage (non-AWS) as a first-class source.
    • Adds detection for Humio and CrowdStrike Falcon LogScale API tokens in both personal and repository-scoped forms.

    +8 more show less

    • Adds nine new open-source detectors: Figma personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (v3), Microsoft Teams webhooks (v2), SolarWinds Observability keys, Weights & Biases keys (v2), and five New Relic credential types — license key, browser key, user key, insights query key, and mobile app token.
    • Bitbucket sources now accept an Atlassian API token paired with account email as a distinct credential type, separate from the username used for git clones.
    • Secret locations are now included at the end of the CSV export, so an exported finding carries its source location without a secondary lookup.
    • Archiving an integration now writes an event to the activity log with an integration archived event type available in the event type filter.
    • GitHub detector now distinguishes all six token prefixes and reports the actual credential type (OAuth token, app token, refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API., etc.) rather than labeling everything as a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..
    • GitHub App authentication against a ghe.com data residency host now inherits the enterprise base URL correctly, enabling scanning of those instances.
    • Neon Postgres credentials are now verified using a driver that accepts Neon's SCRAM iteration count, producing a definite live or not-live result.
    • Harness personal access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. containing underscores in the account segment are now detected.
    • Adds a --sarif flag that emits a SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. log compatible with GitHub Code Scanning upload, mapping verified findings to errors and unverified findings to warnings, each with a stable fingerprint for tracking across scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a scan run history read API covering the global run list, per-source run lists, and individual run detail, with cursor pagination, documented filters, and stable error codes; accepts administrator or editor API keys.
    • Adds a scans tab to integration detail showing retained scan history — start time, active duration, resources reached, and change in live secrets — with filtering by status and start time.
    • Adds detection for Humio and CrowdStrike Falcon LogScale API tokens in both personal and repository-scoped forms.
    • Adds nine new open-source detectors: Figma personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (v3), Microsoft Teams webhooks (v2), SolarWinds Observability keys, Weights & Biases keys (v2), and five New Relic credential types — license key, browser key, user key, insights query key, and mobile app token.

    8 more in Everything

38. docs update Sep 23, 2026 · issue 083

    TruffleHog can now run as a server-side pre-receive hook on GitHub Enterprise Server, GitLab Self-Managed, and Bitbucket Data Center.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Block pushes containing verified secrets on a self-hosted Git server without requiring developers to install anything locally.
    copy

    $ #!/bin/bash
    trufflehog git --bare --no-update --only-verified --fail file://

    • Adds --no-update and --only-verified and --fail flags for use in pre-receive hook scripts to control update checks, filter to verified secrets, and fail the push on findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

39. docs update Sep 23, 2026 · issue 083

    TruffleHog Enterprise adds webhook notifiers that POST secret-found payloads to any HTTP endpoint with HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. signature verification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Configure TruffleHog Enterprise to POST secret-found notifications to your internal webhook endpoint with HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. signature verification and hourly heartbeats.
    config.yml copy

    notifiers:
      webhook:
        token: secret_token
        url: https://example.trufflesec.com:8081/webhook
        notifyOnRotation: false
        signatureMethod: sha256
        heartbeatInterval: 1
    name: webhook secrets notifications
    sourcesToNotify:
      sources:
        - in this config type: notifier
          type: webhook

    Verify an incoming webhook payload signature matches what TruffleHog sent, using the shared token and X-Hub-Signature header value.
    copy

    $ body='{"sourceType": "source_type_github"}'
    token="mysecrettoken"
    echo -n "${token}${body}" | sha256sum

    • Adds notifiers.webhook configuration block to config.yml supporting url, token, notifyOnRotation, signatureMethod (sha256 or hmac-sha256, default sha256), base64EncodedToken, and heartbeatInterval (0, 1, 2, 6, 12, or 24 hours) options for webhook notifiers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sourcesToNotify config key to filter which scanner sources trigger webhook notifications, or set to all to receive notifications from every source.
    • Sends webhook signatures via the X-Hub-Signature header using a SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash of the payload body prefixed with the token string, allowing receivers to verify payload authenticity.
    • Supports pre-signed URLs for platforms such as Sumo Logic that do not accept X-Hub-Signature headers natively, allowing authentication without a token.
    • Delivers structured JSON webhook payloads for secrets found across filesystem, GitHub, GitLab, Bitbucket, Jira, Confluence, Slack, and Microsoft Teams sources.

    5 details in Everything

40. docs update Sep 23, 2026 · issue 083

    TruffleHog Enterprise adds email notifications via AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure., configurable through the web UI or a local YAML config file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Route TruffleHog Enterprise secret-leak alerts to your security team via AWS SES, and CC the leaker automatically when their email is known.
    config.yaml copy

    notifiers:
      - connection:
          '@type': type.googleapis.com/notifiers.email
        ses:
          creds:
            key: AKIAXXXXXXXXXXXXXXXX
            secret: XXXXXXXXXXXXXXXXXXXXXXXXXX
          region: us-west-1
        recipients:
          - security@ourbusiness.org
        sender: <trufflehog> trufflehog@ourbusiness.org
        name: email secrets notifications
        type:
          notifier_type: email
        options:
          ccleaker: true

    • Adds email notification support via AWS SES, configurable in config.yaml under notifiers with connection '@type': type.googleapis.com/notifiers.email, ses.creds.key, ses.creds.secret, ses.region, recipients, and sender fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds ccleaker option to email notifications to automatically CC the person who leaked the credential when their email address is available.
    • Supports configuring the email notifier through the Integrations tab in the TruffleHog Enterprise web UI as an alternative to local config.yaml configuration.

    3 details in Everything

41. docs update Sep 23, 2026 · issue 083

    TruffleHog Enterprise adds AWS Analyze: enriches detected AWS secrets with IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. identity, permissions, and revocation metadata⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable AWS Analyze on a self-hosted scanner using IAM Roles Anywhere — supply the cert file and assume a dedicated analysis role so long-lived access keys are never needed.
    config.yaml copy

    analyze:
      aws:
        using_default_credentials: false
        aws_auth_cert: /etc/trufflehog/client-bundle.pem
        aws_assume_role_arn: arn:aws:iam::<your-account-id>:role/TrufflehogAnalyze

    Enable AWS Analyze on a self-hosted scanner using static IAM access keys passed as environment variables, with a role assumption for least-privilege separation.
    copy

    $ export AWS_ACCESS_KEY_ID=AKIA...
    export AWS_SECRET_ACCESS_KEY=wJalr...
    # in config.yaml:
    # analyze:
    #   aws:
    #     using_default_credentials: true
    #     aws_assume_role_arn: arn:aws:iam::<your-account-id>:role/TrufflehogAnalyze

    • Adds analyze.aws.using_default_credentials: true config key in the scanner config.yaml to enable AWS Analyze on self-hosted scanners using the instance's default credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds aws_access_key_id and aws_secret_access_key environment variables on the scanner process as the access-key authentication path for self-hosted AWS Analyze.
    • Adds aws_auth_cert config key in the scanner config.yaml to point to a complete cert+key file for IAM Roles Anywhere authentication on self-hosted scanners.
    • Adds optional aws_assume_role_arn config key in the scanner config.yaml to assume a specific role during analysis.
    • Adds AWS Analyze, a Cloud Analyze integration (Enterprise only) that resolves the IAM identity behind a discovered AWS key and surfaces its identity-based permissions, assumable roles, and revocation metadata for triage.

    +4 more show less

    • Supports two authentication methods for the privileged analysis identity: IAM user access keys (with optional role assumption via sts:AssumeRole) and client certificates via IAM Roles Anywhere.
    • Runs a credential self-check on integration save; status shows healthy when required IAM/STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. read-only permissions are in place and surfaces failure details when unhealthy.
    • Surfaces direct roles (assumable by the discovered identity directly) and assumable roles (reachable through one additional role hop) to show the full lateral reach of a compromised key.
    • Policy result rows include effect, action, resource, policy, and limits (conditions) columns, with labels distinguishing managed, inline, group managed, group inline, and trust policies.

    9 details in Everything

42. docs update Sep 23, 2026 · issue 083

    TruffleHog Enterprise gains Topology, an interactive graph tracing how leaked credentials propagate across scanned and unscanned services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Topology, an interactive graph view in TruffleHog Enterprise that maps verified live secrets from the source service where they were found to the target services they grant access to, letting practitioners trace credential blast radius and prioritize high-risk exposures.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Topology categorizes every service node into one of three states — Scanned, Not Monitored, or Non-Scannable — so teams can immediately identify services that should be configured for scanning but aren't yet.
    • Selecting an edge in the Topology graph surfaces the source service, destination service, secret count, secret types, and a direct link to the related findings.
    • Supports filtering the Topology graph by service category and by triage state, with a data refresh triggered each time the triage state filter changes.
    • When a scannable but unmonitored service is selected, the Topology panel links directly to its configuration page to reduce time-to-coverage.

    5 details in Everything

43. docs update Sep 23, 2026 · issue 083

    TruffleHog adds per-detector config options for AWS account ID filtering and JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. result suppression via detectors.config in the config YAML.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Limit AWS credential verification to trusted production accounts while blocking canary token account IDs from generating alerts.
    yaml copy

    detectors:
      config:
        aws:
          allowedAccountIds:
            - "111111111111"
            - "222222222222"
          deniedAccountIds:
            - "666666666666"

    Suppress noisy JDBC false positives matching known test or placeholder connection strings.
    yaml copy

    detectors:
      config:
        jdbc:
          ignorePattern:
            - "someP[aa]ttern[0-9]+"

    • Adds detectors.config.aws.allowedAccountIds and detectors.config.aws.deniedAccountIds list fields to the config YAML to restrict or block AWS credential verification by account ID (denied IDs always take precedence over allowed IDs).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds detectors.config.jdbc.ignorePattern list field to the config YAML to suppress unwanted JDBC detector results via regular expressions.

    2 details in Everything

44. docs update Sep 23, 2026 · issue 083

    TruffleHog adds custom regex detectors with webhook verification, entropy filtering, and configurable HTTP status ranges for secret liveness⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Define a custom regex detector with webhook verification and HTTP status-based liveness classification — useful when you have internal tokens with a known format and a validation endpoint.
    trufflehog-config.yaml copy

    detectors:
      - name: hogtokendetector
        keywords:
          - hog
        regex:
          hogid: '\b(hog[0-9a-z]{17})\b'
          hogtoken: '[^a-zA-Z0-9+\/]{0,1}([a-zA-Z0-9+\/]{40})[^a-zA-Z0-9+\/]{0,1}'
        verify:
          - endpoint: http://localhost:8000/
            unsafe: true
            headers:
              - 'authorization: super secret authorization header'
            successranges:
              - '200'
            rotatedranges:
              - '401'
              - '403'

    • Adds detectors field to the TruffleHog config YAML to define custom regex detectors, each with name, keywords, regex, and optional verify sections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds verify.endpoint, verify.unsafe, and verify.headers config keys to validate detected secrets via a webhook POST request to a user-supplied HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. server.
    • Adds verify.successranges config key accepting a list of HTTP status codes or inclusive ranges (e.g. '200', '200-202') to mark secrets as live/verified.
    • Adds verify.rotatedranges config key accepting a list of HTTP status codes or inclusive ranges (e.g. '401', '403') to definitively mark secrets as rotated/unverified.
    • Adds regex named capture groups support so each named pattern must match for a detection to fire, with capture groups extracting specific secret segments.

    +5 more show less

    • Adds primary regex name parameter to designate which named regex determines the reported line number when multiple regex patterns are defined.
    • Adds exclude regexes capture parameter to strip portions of a matched secret that match a given pattern before reporting.
    • Adds exclude regexes match parameter to suppress entire matches from being reported when they match a given pattern.
    • Adds entropy parameter to score randomness of detected strings and filter low-entropy false positives.
    • Adds exclude words parameter to ignore detected strings that contain any word from a specified list.

    10 details in Everything

45. docs update Sep 23, 2026 · issue 083

    TruffleHog Enterprise gains an Activity Log that records scan lifecycle events with a read API for programmatic access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a read API for the Activity Log with endpoints, filters, and response fields for programmatic access to scan history (see API reference for full details).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the Activity Log feature to TruffleHog Enterprise, recording scan lifecycle events (scan started, scan completed, scan failed, scan scheduled, scan anomaly detected) across every source with 90-day retention.
    • Surfaces a partial scan status when some parts of a scan fail and others succeed, distinguishing incomplete coverage from outright failure.
    • Detects scan anomalies via heuristic — flags completed scans that scanned nothing or finished too quickly — and writes a scan anomaly detected event (may appear up to seven minutes after scan end).
    • Activity Log view supports filtering by date range, event, status, source, and actor, with filters persisted in the page URL for shareable links.

    +1 more show less

    • Requires editor or admin role to view the Activity Log; accessible via Activity Log in the main navigation.

    6 details in Everything

46. docs update Sep 23, 2026 · issue 083

    TruffleHog Enterprise adds Scan Details UI and read API for per-integration scan run visibility, error drill-down, and live secret delta tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Review per-item errors for a failed scan run to identify which repositories or buckets the scanner could not access.
    📍In the Enterprise UI: go to Integrations › select the integration › View Details › Scans tab › click the error count in a run row to open the error drawer and expand each failed item for its individual error message.
    • Adds a Scans tab on each integration in the TruffleHog Enterprise UI to list per-run status, duration, item coverage (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ 95 of 98), error counts, and live-secret delta since the previous run — no additional configuration required.
    • Surfaces a per-run errors count that opens a searchable drawer listing each failed item with its individual error message, updating live while a run is in progress.
    • Tracks live-secrets change as a run-over-run delta (e.g. +5 means five more live secrets than after the last run), with the end-of-run total available on hover; a source's first run reports its full count as new.
    • Supports sortable scan history across all runs for an integration (newest-first, 10 per page), covering GitHub, GitLab, Jira, Confluence, Filesystem, Artifactory, and S3 sources; scan runs are retained for 90 days.

    4 details in Everything

47. docs update Sep 23, 2026 · issue 083

    TruffleHog Enterprise adds source archiving to retire integrations while preserving findings, with a verification-frozen state and activity log tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds source archiving (Enterprise only) to stop scanning an integration while retaining all findings it has already reported — archived sources show a gray archived badge and are hidden from the integrations list by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces a verification frozen badge on findings when every source that surfaced a secret is archived, freezing the last known verification status without re-verifying; frozen findings are excluded from MTTR calculations.
    • Adds a Show archived filter in the integrations filter bar to surface archived sources, which appear dimmed alongside active ones.
    • Supports permanent deletion of an already-archived source, destroying all associated findings data.
    • Records archive actions in the activity log, providing an audit trail of when a source was archived.

    5 details in Everything

48. docs update Sep 23, 2026 · issue 083

    TruffleHog adds customVerifiers config and --verifier CLI flag for self-hosted secret verification against private enterprise endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Verify secrets against a private GitHub Enterprise Server and self-hosted GitLab instance by declaring both in the root-level customVerifiers block of your config YAML.
    config.yaml copy

    customVerifiers:
      - name: github
        endpoints:
          - https://github.example.com/api/v3
      - name: gitlab
        endpoints:
          - https://example.gitlab.com

    Scan the current directory and verify found secrets against two GitHub Enterprise endpoints and one self-hosted GitLab endpoint without editing a config file.
    copy

    $ trufflehog filesystem . --verifier github=example1.github.com,example2.github.com --verifier gitlab=example1.gitlab.com

    • Adds customVerifiers field to the root-level config YAML to point TruffleHog's secret verification at self-hosted or enterprise endpoints for GitHub Enterprise Server, GitLab, Jira Data Center, Confluence Data Center, Bitbucket Data Center, JFrog Artifactory (access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. and reference token variants), and HashiCorp Vault.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --verifier CLI flag to the open-source trufflehog binary, allowing custom verifier endpoints to be passed at scan time (e.g. --verifier github=example1.github.com,example2.github.com) without a config file.

    2 details in Everything

49. docs update Sep 23, 2026 · issue 083

    TruffleHog Enterprise adds Shared Secrets: scoped, expiring, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-gated links to share findings with non-platform users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Share a detected credential finding with a developer who needs to rotate it, without granting them access to TruffleHog Enterprise — set up trusted domains first so the link can be created.
    📍In TruffleHog Enterprise, go to Settings › Shared Secrets › Edit Trusted Domains and add your org's domain (e.g. yourorg.com). Then open a finding's detail page and click Share in the upper right corner, select an expiration window (e.g. 1 day), and copy the generated URL to send to the recipient.
    • Adds Share Secrets feature that turns a detected finding into a secure, access-controlled link — recipients authenticate via Google SSO or SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. against trusted domains and see a read-only view of the finding without needing a TruffleHog Enterprise login.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports four expiration window options per link at creation time: on read, 1 hour, 1 day, 7 days, or 1 month, where on read links expire after the first successful read.
    • Adds a Shared Secrets management page with two tabs — Active Shared Secrets (lists every unexpired link with revocation controls) and Sharing Settings (holds trusted domains and default authentication method).
    • Trusted domains are configured under Settings > Shared Secrets > Edit Trusted Domains as a comma-separated list; no share link can be created until at least one domain is set.
    • The sharing authentication setting accepts Google OAuth or SAML SSO as the default identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for link recipients; SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. SSO is only selectable after at least one SAML login has occurred.

    +1 more show less

    • Shared finding pages display secret type and locator, verification status, first-detected and last-seen timestamps, link expiration time, location details (granting account, ARN, resource type, user ID), and rotation guidance for the secret type — without ever exposing the raw plaintext credential.

    6 details in Everything

50. docs update Sep 23, 2026 · issue 083

    TruffleHog adds locally configurable notifiers via notifiers field in config YAML, supporting stdout, email, Jira, Slack, Splunk, and webhook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Alert a Slack channel whenever secrets are detected across all sources in your scan config, including a link to the secret.
    yaml copy

    concurrency: '8'
    loglevel: info
    notifiers:
      - name: slack secrets notifications
        sendunverified: true
        sourcestonotify: sources in this config
        customtext: message to add to notifier
        includesecretlink: true
        type: slack
        numworkers: 16
        trufflehogaddress: https://gnarly-flying-pancake.c1.prod.trufflehog.org
        trufflehogscannergroup: account-1.us-west-2
        trufflehogscannertoken: thog-agent-xxxxxxxxxxxxxxxxxxxxxxxxxx

    Print secret findings to stdout locally (open-source) without sending alerts to an external service.
    yaml copy

    concurrency: '8'
    loglevel: info
    notifiers:
      - name: stdout secrets notifications
        sendunverified: true
        sourcestonotify: sources in this config
        type: stdout
        numworkers: 16

    • Adds notifiers field to TruffleHog's config YAML to configure secret-discovery alerts locally, with options including name, sendunverified, sourcestonotify, customtext, includesecretlink, type, numworkers, trufflehogaddress, trufflehogscannergroup, and trufflehogscannertoken.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports sourcestonotify field accepting all, sources in this config, or a comma-separated list of sources to control which scan sources trigger notifications.
    • Supports stdout notifier type in open-source and on-premise deployments (GA), enabling local terminal alerting when secrets are found.
    • Supports email, jira, slack, and webhook notifier types (GA) for cloud and on-premise deployments.
    • Supports splunk notifier type (alpha) for on-premise deployments.

    5 details in Everything

51. docs update Sep 23, 2026 · issue 083

    TruffleHog gains analyze subcommand to evaluate live secrets' permissions, metadata, and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. posture⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds trufflehog analyze subcommand with self-discovery analyzers that perform non-state-changing API calls to determine a secret's resources and permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds cloud analyze (enterprise-only) to examine cloud secrets against live cloud environments to determine a secret's IAM posture, with GCP analyze currently supported.

    2 details in Everything

52. v3.97.6 Sep 22, 2026 · issue 083

    TruffleHog v3.97.6 adds fine-grained token metadata to GitHub analyzer and makes gist enumeration non-fatal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.97.6 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.97.6

    • Adds is_fine_grained metadata field to GitHub analyzer output, surfacing whether a scanned token is a fine-grained personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

53. docs update Sep 17, 2026 · issue 077

    TruffleHog Enterprise adds Scan Details UI and read API to track per-integration scan runs, coverage, errors, and live-secret deltas.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Review per-item scan errors for a specific integration run directly in the Enterprise UI.
    📍Go to Integrations › select the integration › click View Details › open the Scans tab › click the error count for a run to open the error drawer and inspect individual item failures.
    • Adds a Scans tab on each integration in TruffleHog Enterprise UI showing per-run status, start time, active duration, item coverage (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ 95 of 98), error count, and live-secrets change delta.
    • Exposes a read API for scan runs with endpoints, filters, and response fields documented in the API reference, enabling practitioners to pull scan history into external reporting pipelines.
    • Surfaces per-item error details in a drill-down drawer (searchable by name, expandable per entry) opened by clicking the errors count on any run.
    • Reports a run-over-run live secrets change delta (e.g. +5) so practitioners can see how the live secret count shifted since the previous scan of that source.
    • Retains scan run records for 90 days; supports GitHub, GitLab, Jira, Confluence, Filesystem, Artifactory, and S3 integrations.

    5 details in Everything

54. v3.97.5 Sep 16, 2026 · issue 077

    TruffleHog v3.97.5 adds Humio and Resend detectors, S3 object filtering, a --no-ignore-tag flag, and low-memory Git scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.97.5 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.97.5

    • Adds --no-ignore-tag global flag to report secrets even when the source line carries a trufflehog:ignore comment, overriding the usual suppression.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds object filtering in S3 scanning, enabling scans to target specific objects within a bucket rather than the entire contents.
    • Adds HumioAPIToken detector to classify and validate leaked Humio API tokens.
    • Adds Resend detector to classify and validate leaked Resend API keys.
    • Makes the GitHub App installationId optional when scanning all installations, so org-wide scans no longer require a specific installation to be specified.

    +2 more show less

    • Introduces low-memory Git scanning mode to reduce peak memory usage when scanning large repositories.
    • Introduces a new optional detector interface allowing credentials to be verified even when they are not present in the verification cache.
    • Adds --no-ignore-tag global flag to report secrets even when the source line carries a trufflehog:ignore comment, overriding the usual suppression.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds HumioAPIToken detector to classify and validate leaked Humio API tokens.
    • Adds Resend detector to classify and validate leaked Resend API keys.
    • Introduces a new optional detector interface allowing credentials to be verified even when they are not present in the verification cache.

    3 more in Everything

55. docs update Sep 12, 2026 · issue 072

    TruffleHog adds S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage scanning, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output for GitHub Code Scanning, and scan history APIs alongside new secret detectors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds --sarif flag emitting SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. output, mapping verified findings to errors and unverified findings to warnings with stable fingerprints for GitHub Code Scanning upload tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Atlassian API token as an explicit credential type on Bitbucket sources, paired with account email, separate from the git-clone username.
    • Neon Postgres credentials are now verified using a driver that accepts Neon's SCRAM iteration count, producing definite live/not-live results.
    • Adds --sarif flag emitting SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. output, mapping verified findings to errors and unverified findings to warnings with stable fingerprints for GitHub Code Scanning upload tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

56. docs update Sep 12, 2026 · issue 072

    TruffleHog adds customVerifiers config and --verifier CLI flag for self-hosted/enterprise secret verification endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Point TruffleHog at your GitHub Enterprise Server and self-hosted GitLab so detected secrets are verified against internal instances instead of public APIs.
    yaml copy

    customVerifiers:
      - name: github
        endpoints:
          - https://github.example.com/api/v3
      - name: gitlab
        endpoints:
          - https://example.gitlab.com
      - name: hashicorpvaultauth
        endpoints:
          - https://vault.example.com

    Scan the current directory and verify discovered secrets against two GitHub Enterprise nodes and a self-hosted GitLab without writing a config file.
    copy

    $ trufflehog filesystem . --verifier github=example1.github.com,example2.github.com --verifier gitlab=example1.gitlab.com

    • Adds customVerifiers field to the TruffleHog config YAML, supporting self-hosted endpoints for GitHub Enterprise, GitLab, Jira Data Center, Confluence Data Center, Bitbucket Data Center, JFrog Artifactory (access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. and reference token variants), and HashiCorp Vault AppRole auth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --verifier CLI flag to the open-source trufflehog binary, enabling custom verifier endpoints to be passed at scan time without a config file (e.g. --verifier github=example1.github.com,example2.github.com).

    2 details in Everything

57. docs update Sep 11, 2026 · issue 071

    TruffleHog September 2026: S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage scanning, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output, scan history API, incremental scanning for 5 more sources, and 13+ new detectors⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a --sarif flag that emits a SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. log compatible with GitHub Code Scanning, mapping verified findings to errors and unverified findings to warnings, each with a stable fingerprint for tracking across scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a scan history read API covering the global run list, per-source run lists, and individual run detail, with cursor pagination, documented filters, and stable error codes; accepts administrator or editor API keys.
    • Adds a scans tab to integration detail views showing retained scan history — start time, active duration, resources reached, and change in live secrets — with filtering by status and start time.
    • S3 sources now support a custom endpoint and signing region, enabling scanning of any S3-compatible object storage (non-AWS) as a first-class source.
    • Adds incremental scanning support for GitLab, Jira, Confluence, Artifactory, and S3 sources, revisiting only changed content on each run; S3 and GCS scan units are now labeled as buckets.

    +8 more show less

    • Adds detection for Humio and CrowdStrike Falcon LogScale API tokens (both personal and repository-scoped forms).
    • Adds nine new open-source detectors: Figma personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (v3), Microsoft Teams webhooks (v2), SolarWinds Observability keys, Weights & Biases keys (v2), and five New Relic credential types — license key, browser key, user key, insights query key, and mobile app token.
    • Bitbucket sources now accept an Atlassian API token paired with account email as an explicit credential type, separate from the username used for git clones.
    • GitHub token findings now carry the actual credential type (OAuth token, app token, refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API., etc.) instead of reporting all six token prefixes as personal access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..
    • Secret locations are now included at the end of the CSV export, so an exported finding carries where it was found without a secondary lookup.
    • Archiving an integration now writes an event to the activity log, and integration archived is available as an event type filter.
    • Confluence attachments are now capped at 25 MB for download, matching limits already enforced on SharePoint, S3, and Git.
    • A Slack token missing the files:read scope now reports the missing permission instead of silently dropping file coverage.
    • Adds a --sarif flag that emits a SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. log compatible with GitHub Code Scanning, mapping verified findings to errors and unverified findings to warnings, each with a stable fingerprint for tracking across scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a scan history read API covering the global run list, per-source run lists, and individual run detail, with cursor pagination, documented filters, and stable error codes; accepts administrator or editor API keys.
    • Adds a scans tab to integration detail views showing retained scan history — start time, active duration, resources reached, and change in live secrets — with filtering by status and start time.
    • S3 sources now support a custom endpoint and signing region, enabling scanning of any S3-compatible object storage (non-AWS) as a first-class source.
    • Adds detection for Humio and CrowdStrike Falcon LogScale API tokens (both personal and repository-scoped forms).

    +1 more show less

    • Adds nine new open-source detectors: Figma personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (v3), Microsoft Teams webhooks (v2), SolarWinds Observability keys, Weights & Biases keys (v2), and five New Relic credential types — license key, browser key, user key, insights query key, and mobile app token.

    7 more in Everything

58. docs update Sep 11, 2026 · issue 071

    TruffleHog Enterprise adds a Scan Details UI and read API showing per-integration scan run history, coverage, errors, and live secret deltas.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a read API for scan runs — see the API reference for endpoints, filters, and response fields to pull scan history into your own reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Scan Details view in the TruffleHog Enterprise UI: the Scans tab on any integration lists each scan run with status, start time, active duration, items scanned vs. found, error count, and a live secrets change delta (run-over-run difference).
    • Surfaces per-run error details in a drill-down drawer: clicking an errors count opens a searchable list of the specific items that failed, each with its individual error message.
    • Scan runs are retained for 90 days; the table paginates at 10 runs per page, newest first, and is sortable by any column except status and live secrets change.
    • Live secrets change column reports a signed delta against the source's previous run (e.g. +5 means five more live secrets than after the last run); hovering a row shows the end-of-run total.

    5 details in Everything

59. v3.97.4 Sep 3, 2026 · issue 064

    json-enumerator gains concurrent multi-file scanning and native zstdzstdA fast lossless compression algorithm and library maintained by Meta, offering compression ratios comparable to zlib at much higher speeds, which makes it attractive for tools that compress large data streams or archives at runtime.-compressed NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.97.4 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.97.4

    └──▷ TRY IT
    Scan multiple zstd-compressed NDJSON files concurrently to maximize throughput on a multicore system without pre-decompressing them.
    copy

    $ trufflehog json-enumerator secrets_dump_1.ndjson.zst secrets_dump_2.ndjson.zst secrets_dump_3.ndjson.zst --results=verified

    • Supports passing multiple files to trufflehog json-enumerator FILE_1 .. FILE_N for concurrent processing, replacing the previous sequential behaviour and improving throughput on multicore systems.
    • Adds native zstd-compressed NDJSON input handling to the json-enumerator source, eliminating the need to decompress files externally before scanning.
    • Enables json-enumerator to be used inside a multi-source configuration.
    • Twilio and Twilio API key detectors now treat transport failures (429, 5xx, timeouts, connection resets, dial failures) as indeterminate rather than writing date_rotated, reducing false rotation signals on transient errors.

    4 details in Everything

60. v3.97.2 Sep 2, 2026 · issue 063

    TruffleHog v3.97.2 adds AWS Secrets Manager source, Weights & Biases V2 detector, GitHub token-type differentiation, and Jenkins enumeration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.97.2 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.97.2

    • Adds SOURCE_TYPE_AWS_SECRETS_MANAGER source type, enabling TruffleHog to scan AWS Secrets Manager for leaked credentials.
    • Adds token_type and remediation fields to ExtraData in the GitHub V2 detector, differentiating between PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (ghp_, github_pat_), OAuth (gho_), and GitHub App (ghu_, ghs_, ghr_) token types so incident responders are directed to the correct revocation path.
    • Adds a V2 detector for Weights & Biases (enabled via WeightsAndBiasesV2DetectorEnabled feature flag), expanding credential coverage for the ML platform.
    • Implements Enumerate for the Jenkins source, allowing TruffleHog to discover and iterate Jenkins resources during scans.
    • Retries git clone automatically on secondary rate-limit responses (bare 403/429), reducing scan failures against large GitHub targets.

    5 details in Everything

61. docs update Sep 2, 2026 · issue 062

    TruffleHog Enterprise adds Slack scanning, AWS credential analysis, scan activity API, source archiving, and 16 new detectors

    • Adds Slack workspace scanning as a listed app in the Slack Marketplace — scans messages, threads, and attached files, with verified findings to confirm live credentials (Enterprise).
    • Adds continuous Slack scanning for new messages, thread replies, and edits across public channels, private channels the app is invited to, DMs, and group DMs — edited messages are rescanned and the app joins new public channels automatically (Enterprise).
    • Adds historical Slack scanning covering messages, threads, and attached files including archives, base64-encoded data, binaries, and Microsoft Office documents — include/exclude lists scope channel coverage and interrupted scans resume where they left off (Enterprise).
    • Adds 16 new detectors in Enterprise scanning: Braintrust, Cloudflare API token, Cloudflare global API key, Cloudinary, Duffel, Duo, GitLab OAuth, HashiCorp Vault token, HashiCorp Vault batch token, New Relic Insights insert key, Octopus Deploy, PGAnalyze read key, Pinecone, Red Hat Pyxis, Shippo, and SonarQube Cloud (Enterprise and open source).
    • Cloudflare API token and global API key detectors now recognize the new prefixed credential formats Cloudflare is rolling out in 2026, catching newly issued credentials as customers migrate (Enterprise and open source).

    +19 more show less

    • Adds AWS credential analysis (aws analyze) for customers on the Analyze SKU — resolves effective permissions, discovers IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role chaining paths, and warns on IAM conditions and policy variables (Enterprise).
    • Adds a scan activity read API so scan failures can be routed into external monitoring and alerting tools; API documentation ships alongside it (Enterprise).
    • Adds source archiving — archive a source from the three-dot menu on its row in Integrations to stop scanning while retaining all findings and triage history; Show archived reveals archived sources; requires admin or editor role (Enterprise).
    • Adds an Activity Log top-level view of scan events across every source, filterable by date range, event, status, source, and actor — filters are stored in the page URL for shareable links; events are retained for 90 days (Enterprise).
    • SharePoint scanning now covers historical versions of items in generic lists and search-driven document libraries, surfacing credentials removed from the current version but present in earlier ones (Enterprise).
    • Google Drive domain-wide delegation is now available through the Add Integration wizard for hosted and self-hosted scanners, enabling scanning with the access of all domain users in a single integration (Enterprise).
    • Encrypted (passphrase-protected) private keys are now reported as findings even when the passphrase cannot be recovered (Enterprise and open source).
    • Android package (APK) scanning now detects packages by inspecting file contents rather than relying on an .apk extension, so packages surfaced through byte-stream enumeration are no longer skipped (Enterprise and open source).
    • Adds Jira auto-close configuration — Jira issues can now be configured to close automatically when their underlying secret is remediated, managed directly in integration settings (Enterprise).
    • Adds ability to revoke access to a single shared secret individually rather than revoking the entire share (Enterprise).
    • Verified but expired JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. are now dropped at ingestion rather than surfacing as live findings, reducing noise from tokens that carry no remaining risk (Enterprise).
    • Updates the location type filter UI on the Secrets list page to a single popover view with filter explanations (Enterprise).
    • Users with the editor role can now trigger notifications, removing a dependency on admin-level access for routine workflows (Enterprise).
    • Archived sources are now filtered server-side in the sources list, keeping the integration list responsive for organizations with many retired sources (Enterprise).
    • Adds paginated user audit log under Settings › Users, allowing large user histories to be paged through instead of loaded all at once (Enterprise).
    • Rate-limited findings are now retried instead of discarded, closing a path where a finding could be lost under heavy scan load (Enterprise).
    • Concurrent requests sharing a transport now coordinate their 429 and 503 backoff to recover in an orderly way instead of retry-storming (Enterprise).
    • Scanner metrics payloads exceeding the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. receive limit are now chunked rather than rejected, restoring visibility into very large scans (Enterprise).
    • Git clones retry on transient network errors and Slack API timeouts retry instead of failing the entire channel scan (Enterprise and open source).

    24 details in Everything

62. docs update Aug 23, 2026 · issue 054

    TruffleHog Enterprise gains AWS Analyze: enriches discovered AWS keys with IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. identity, permissions, and revocation metadata.

    └──▷ USE IT
    Enable AWS Analyze on a self-hosted scanner using long-lived IAM access keys and an optional assume-role, so newly detected AWS secrets are automatically enriched with IAM context.
    scanner_config.yaml copy

    analyze_aws_using_default_credentials: true
    aws_assume_role_arn: arn:aws:iam::<your-account-id>:role/TrufflehogAnalyze

    Create the required IAM role and attach the least-privilege analysis policy so TruffleHog can perform read-only IAM permission checks against discovered keys.
    copy

    $ aws iam create-role \
      --role-name TrufflehogAnalyze \
      --assume-role-policy-document file://trust-policy.json
    
    aws iam create-policy \
      --policy-name TrufflehogAnalyzePolicy \
      --policy-document file://analyze-policy.json
    
    aws iam attach-role-policy \
      --role-name TrufflehogAnalyze \
      --policy-arn arn:aws:iam::<your-account-id>:policy/TrufflehogAnalyzePolicy

    Issue a client certificate against your ACM Private CA for use with IAM Roles Anywhere, enabling short-lived credential authentication for the AWS Analyze integration.
    copy

    $ openssl genrsa -out client-key.pem 2048
    openssl req -new -key client-key.pem -out client-csr.pem \
      -subj "/CN=trufflehog-analyze"
    
    aws acm-pca issue-certificate \
      --certificate-authority-arn $CA_ARN \
      --csr fileb://client-csr.pem \
      --signing-algorithm sha256withrsa \
      --template-arn arn:aws:acm-pca:::template/EndEntityCertificate/V1 \
      --validity Value=365,Type=DAYS \
      --region us-east-1

    • New cloud analyze integration for AWS (AWS Analyze) in TruffleHog Enterprise shows the IAM identity behind a discovered AWS key, its identity-based permissions, and related revocation metadata to accelerate triage.
    • Supports two authentication methods for the privileged analysis identity: IAM user access keys (access key ID + secret access key), or short-lived client certificates via IAM Roles Anywhere.
    • Optional role ARN field on the access-key integration lets TruffleHog assume a role for analysis; the IAM user must also have sts:AssumeRole on arn:aws:iam::*:role/* when this is set.
    • Self-hosted scanner configuration supports AWS Analyze via analyze_aws_using_default_credentials: true in scanner_config.yaml, with credentials supplied as AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY environment variables or via aws_auth_cert pointing to a certificate file, plus an optional aws_assume_role_arn.
    • Integration runs an automatic credential self-check on save; healthy confirms required IAM read-only permissions are in place, unhealthy surfaces the specific failure for remediation.

    +1 more show less

    • Analysis results surface identity details (account, principal ARN, identity type, groups, tags, creation date, permissions boundary), direct and assumable roles, and per-row permission details (effect, action, resource, policy, conditions) with policy labels: managed, inline, group managed, group inline, and trust.

    6 details in Everything

63. docs update Aug 15, 2026 · issue 046

    TruffleHog Enterprise adds Slack scanning, AWS credential analysis, scan activity API, source archiving, and 16 new detectors

    • Adds Slack scanning as a listed app in the Slack Marketplace for Enterprise Edition — scans messages, threads, and attached files for credentials, verifying each finding as live or not.
    • Adds continuous Slack message scanning across public channels, private channels (where the app is invited), DMs, and group DMs — edited messages are rescanned and the app joins new public channels automatically.
    • Adds historical Slack scanning covering messages, threads, and attached files including archives, base64-encoded data, binaries, and Microsoft Office documents; include/exclude lists scope channel coverage and interrupted scans resume where they left off.
    • Adds 16 new detectors in Enterprise scanning: Braintrust, Cloudflare API Token, Cloudflare Global API Key, Cloudinary, Duffel, Duo, GitLab OAuth, HashiCorp Vault Token, HashiCorp Vault Batch Token, New Relic Insights Insert Key, Octopus Deploy, pganalyze Read Key, Pinecone, Red Hat Pyxis, Shippo, and SonarQube Cloud — the SonarQube Cloud scoped organization token, Duo API secret key, and Cloudflare detectors are new in both Enterprise and open source.
    • Adds recognition of the new 2026 prefixed Cloudflare credential formats for both the Cloudflare API Token and Global API Key detectors in Enterprise and open source.

    +16 more show less

    • Adds SharePoint historical version scanning — surfaces credentials removed from the current version but present in earlier versions of items in generic lists and search-driven document libraries.
    • Adds domain-wide delegation support through the add integration wizard for Google Drive, enabling scanning with the access of all domain users in a single integration for hosted and self-hosted scanners.
    • Encrypted (passphrase-protected) private keys are now reported as findings even when the passphrase cannot be recovered.
    • Adds Android package (APK) detection by inspecting file contents rather than relying on an .apk extension, so packages surfaced through byte-stream enumeration are scanned.
    • Adds AWS credential analysis (aws analyze) for customers on the Analyze SKU — resolves effective permissions, discovers IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role chaining paths, and warns on IAM conditions and policy variables.
    • Adds Jira auto-close configuration: Jira issues can be set to close automatically when their underlying secret is remediated, managed in integration settings.
    • Adds the ability to revoke access to a single shared secret rather than the entire share.
    • Verified but expired JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. are now excluded from findings at ingestion, reducing noise from tokens that carry no remaining risk.
    • Adds a location type filter update on the secrets list page: a single popover view with explanations of what is being filtered.
    • Adds a new Activity Log top-level view of scan events across every source — filterable by date range, event, status, source, and actor, with filters stored in the page URL for shareable views; events are append-only and retained for 90 days.
    • Adds a scan activity read API so scan failures can be routed into external monitoring and alerting tools; API documentation ships alongside it.
    • Adds source archiving — archive a source to stop scanning while retaining all findings with triage history intact; accessible from the three-dot menu on a source row in Integrations; show archived reveals archived sources; requires admin or editor role.
    • Adds verification freezing for archived sources — scanning stops immediately on archive (including in-flight scans); verification freezes only when every source behind a finding is archived; frozen findings retain their last verification status and are excluded from MTTR.
    • Editors can now trigger notifications, removing the dependency on admin-level access for routine notification workflows.
    • Archived sources are now filtered server-side in the sources list, keeping the integration list responsive for large deployments.
    • The user audit log under Settings › Users now paginates, allowing navigation through long user histories.

    21 details in Everything

64. docs update Aug 15, 2026 · issue 046

    TruffleHog custom regex detectors gain configurable verification status ranges, entropy filtering, exclude rules, and primary regex designation

    └──▷ USE IT
    Distinguish live secrets from rotated ones during verification so your triage queue only surfaces actionable findings.
    trufflehog-config.yaml copy

    detectors:
      - name: hogtokendetector
        keywords:
          - hog
        regex:
          token: '[^a-zA-Z0-9+\/]{0,1}([a-zA-Z0-9+\/]{40})[^a-zA-Z0-9+\/]{0,1}'
        verify:
          - endpoint: http://localhost:8000/
            unsafe: true
            headers:
              - "authorization: super secret authorization header"
            successranges:
              - "200"
            rotatedranges:
              - "401"
              - "403"

    • Adds successranges config parameter under verify to specify HTTP status codes (single codes or inclusive ranges like '200-202') that mark a detected secret as live/verified.
    • Adds rotatedranges config parameter under verify to specify HTTP status codes (or ranges like '401', '403') that definitively mark a detected secret as rotated/unverified.
    • Adds entropy parameter to custom detector config to filter detected strings by randomness score, reducing false positives for API keys and passwords.
    • Adds exclude regexes capture parameter to custom detector config to strip specific sub-portions of a detected secret from the reported result.
    • Adds exclude regexes match parameter to custom detector config to suppress entire matches from being reported as secrets.

    +4 more show less

    • Adds exclude words parameter to custom detector config to ignore detected strings that contain specified words.
    • Adds primary regex name parameter to designate which named regex pattern determines the reported line number when multiple regex patterns are defined.
    • Custom regex detectors (beta) support multiple named regex patterns under the regex field, with capture groups for extracting specific secret segments; all named regexes must match for a detection to succeed.
    • Locally configured custom detectors are wired in via the detectors field of the TruffleHog config YAML, supporting keywords, name, regex, and verify (with endpoint, headers, unsafe) sub-keys.

    9 details in Everything

65. docs update Aug 15, 2026 · issue 046

    TruffleHog Enterprise gains an Activity Log that records scan lifecycle events across all sources, with a read API and 90-day retention.

    • New Activity Log (Enterprise only) records scan lifecycle events — scan started, scan completed, scan failed, scan scheduled, and scan anomaly detected — across every source, with 90-day retention and no configuration required.
    • Anomaly detection heuristics flag completed scans that scanned no data or finished suspiciously fast, surfaced as warning-status scan anomaly detected events.
    • Scan events carry one of six statuses — success, partial, failure, in progress, scheduled, or warning — each shown as a color chip in the log table.
    • Activity Log is filterable by date range, event, status, source, and actor; filters are held in the page URL so filtered views can be shared as links.
    • Each event row opens a detail drawer with full message text and a direct URL, enabling deep-linking to a specific event.

    +2 more show less

    • Read API available for the Activity Log; see the API reference for endpoints, filters, and response fields (source IDs are exposed through the API only).
    • Archiving a source preserves its Activity Log history; deleting a source removes its events along with its findings.

    7 details in Everything

66. v3.97.0 Aug 14, 2026 · issue 046

    TruffleHog v3.97.0 adds SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output, five new detectors, S3 custom endpoints, and AWS Secrets Manager metadata.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.97.0 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.97.0

    └──▷ TRY IT
    Upload TruffleHog results to GitHub code scanning in a CI workflow — SARIF lets GitHub inline findings on PR diffs and deduplicate across runs.
    copy

    $ trufflehog git https://github.com/your-org/your-repo --results=verified,unknown --sarif > results.sarif

    • Adds --sarif flag for SARIF-format output compatible with GitHub code scanning's github/codeql-action/upload-sarif action, tracking findings as new/fixed across scans.
    • Adds custom endpoint support to the S3 source, enabling scans against S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage services.
    • Adds New Relic License Key detector.
    • Adds New Relic Browser Key detector.
    • Adds New Relic User Key detector.

    +8 more show less

    • Adds New Relic Insights Query Key detector.
    • Adds New Relic Mobile App Token detector.
    • Adds Microsoft Teams Webhook V2 detector.
    • Adds Figma Personal Access Token v3 detector.
    • Adds SolarWinds Observability detector.
    • Adds AWS Secrets Manager metadata type for richer analysis output.
    • Each clone under --clone-path now gets its own subdirectory, preventing collisions when scanning multiple repositories concurrently.
    • Encrypted private keys with uncrackable passphrases are now surfaced as unverified findings with encrypted:true metadata instead of being silently dropped.

    13 details in Everything

67. docs update Aug 9, 2026 · issue 040

    TruffleHog Enterprise adds source archiving to retire integrations while preserving findings, with a verification-frozen state and activity log entries.

    • Adds source archiving (Enterprise only) to stop scanning an integration source permanently while retaining all findings it has already reported — accessible via the three-dot menu on any source row in Integrations.
    • Archived sources display a gray archived badge and are hidden from the Integrations list by default; selecting Show archived in the filter bar reveals them in a dimmed state.
    • Introduces a verification frozen badge on findings whose every contributing source has been archived — frozen findings retain their last known verification status but stop re-verifying, and are excluded from MTTR calculations.
    • Allows permanent deletion of an already-archived source (destroying its findings) via the three-dot menu on the archived source row after enabling Show archived.
    • Archive and delete actions require the Admin or Editor role; Viewer-role users do not see the archive option in the three-dot menu.

    +2 more show less

    • Archive events are recorded in the activity log, providing an audit trail of when a source was retired.
    • Self-hosted scanners running versions that predate archive support must be upgraded to honor archiving; no new scans are dispatched in the meantime.

    7 details in Everything

68. docs update Aug 9, 2026 · issue 040

    TruffleHog adds self-hosted verification support via customVerifiers config and --verifier CLI flags for enterprise instances.

    └──▷ USE IT
    Verify secrets against a self-hosted GitLab and an on-prem Jira Data Center instance by declaring custom verifier endpoints in your config file.
    yaml copy

    customVerifiers:
      - name: gitlab
        endpoints:
          - https://example.gitlab.com
      - name: jiraDataCenterPat
        endpoints:
          - https://jira.example.com

    Scan the current directory and verify found secrets against two self-hosted GitHub instances and one self-hosted GitLab instance without a config file.
    copy

    $ trufflehog filesystem . --verifier github=example1.github.com,example2.github.com --verifier gitlab=example1.gitlab.com

    • Adds customVerifiers field to the TruffleHog config YAML to route secret verification against self-hosted/on-prem endpoints for Artifactory, Bitbucket, Confluence, GitLab, GitHub, HashiCorp Vault, and Jira.
    • Adds --verifier CLI flag to trufflehog to pass custom verifier endpoints at scan time, e.g. --verifier github=example1.github.com,example2.github.com.
    • Supports named verifier types in customVerifiers: artifactoryAccessToken, artifactoryReferenceToken, hashicorpVaultAuth, jiraDataCenterPat, confluenceDataCenter, bitbucketDataCenter, and gitlab/github, each accepting one or more endpoints.
    • Supports TruffleHogAddress, TruffleHogScannerGroup, and TruffleHogScannerToken config keys for targeting enterprise scanner infrastructure.

    4 details in Everything

69. docs update Aug 9, 2026 · issue 040

    TruffleHog Enterprise adds Shared Secrets — scoped, expiring links that let non-users review and rotate findings via SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.

    • New Share Secrets feature converts a detected finding into a secure, access-controlled URL generated from the secret's detail page via the Share button in the upper-right corner.
    • Share links require recipients to authenticate through a configured identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. (Google SSO or SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties.) and are validated against a trusted domains allowlist configured under Settings > Shared Secrets > Edit Trusted Domains.
    • Supports four expiration window options per link at creation time: on read, 1 hour, 1 day, 7 days, or 1 month; on read links expire after the first successful read.
    • Shared secrets management page provides two tabs: Active Shared Secrets (all unexpired links with revocation controls) and Sharing Settings (trusted domains and default authentication method).
    • Recipients see a read-only finding view including secret type and locator, verification status, first-detected and last-seen timestamps, location details (granting account, ARN, resource type, user ID), and rotation guidance — never the raw plaintext credential.

    +1 more show less

    • Share link creation and revocation restricted to Admin or Editor roles; Viewer role users cannot create, revoke, or configure sharing settings.

    6 details in Everything

70. v3.96.0 Jul 24, 2026 · issue 025

    TruffleHog v3.96.0 adds HashiCorp Vault token, Duo API Secret Key, and SonarQube Cloud scoped token detectors plus updated Cloudflare credential format support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.96.0 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.96.0

    • Adds HashiCorp Vault token detector supporting service tokens, periodic tokens, and legacy tokens with live verification against Vault's auth/token/lookup-self endpoint.
    • Adds Duo API Secret Key detector for scanning Duo credentials.
    • Adds SonarQube Cloud Scoped Organization Token detector.
    • Updates Cloudflare detectors to recognize 2026+ prefixed credential formats (new CloudflareApiTokenV2 and CloudflareGlobalApiKeyV2 detectors).
    • Adds TargetNotFoundError for targeted scans so consumers can distinguish definitively gone targets from transient or auth failures.

    +1 more show less

    • Adds internal metrics for chunks and results processed per scan.

    6 details in Everything

71. v3.95.9 Jul 9, 2026 · issue 011

    TruffleHog v3.95.9 adds 7 new secret detectors and archived-repo exclusion for GitHub org scans.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.9 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.9

    └──▷ TRY IT
    Scan a GitHub org while skipping archived repos to reduce noise and scan time in large orgs.
    copy

    $ trufflehog github --org=<your-org> --results=verified --exclude-archived

    • New OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code. detector identifies sk-or-v1- API keys and validates them against the OpenRouter API.
    • New New Relic Insights Insert Key detector matches NRII- prefixed keys with live verification via the Events API.
    • New Duffel Token detector for the Duffel travel API.
    • New Shippo detector for Shippo shipping API keys.
    • New IPinfo detector, now included in the default detector set.

    +3 more show less

    • New improved Lob detector, now included in the default detector set.
    • New HashiCorp Vault batch token detector.
    • Adds --exclude-archived flag to skip archived repositories when scanning a GitHub org.

    8 details in Everything

72. v3.95.9 Jul 9, 2026 · issue 001

    TruffleHog v3.95.9 adds 7 new secret detectors and archived-repo exclusion for GitHub org scans.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.9 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.9

    └──▷ TRY IT
    Scan a GitHub org while skipping archived repos to reduce noise and scan time in large orgs.
    copy

    $ trufflehog github --org=<your-org> --results=verified --exclude-archived

    • New OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code. detector identifies sk-or-v1- API keys and validates them against the OpenRouter API.
    • New New Relic Insights Insert Key detector matches NRII- prefixed keys with live verification via the Events API.
    • New Duffel Token detector for the Duffel travel API.
    • New Shippo detector for Shippo shipping API keys.
    • New IPinfo detector, now included in the default detector set.

    +3 more show less

    • New improved Lob detector, now included in the default detector set.
    • New HashiCorp Vault batch token detector.
    • Adds --exclude-archived flag to skip archived repositories when scanning a GitHub org.

    8 details in Everything

73. v3.95.8 Jul 2, 2026 · issue 002

    TruffleHog v3.95.8 adds Octopus Deploy detection, Prometheus engine metrics, and a flag to drop unverified JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. results.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.8 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.8

    └──▷ TRY IT
    Suppress noisy unverified JWT hits when scanning a repo where JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. are common but you only care about confirmed leaks.
    copy

    $ trufflehog git https://github.com/example/myrepo --results=verified,unknown --drop-unverified-jwt-results

    • Adds Prometheus metrics exposing engine channel depths/capacities, worker counts, and bytes/chunks/secrets found — enabling real-time observability of scan progress.
    • New --drop-unverified-jwt-results flag suppresses JWT detector results that are unverified with no verification errors, reducing noise in high-volume scans.
    • Azure SAS token detector now matches tokens regardless of query-parameter order and handles URL-encoded timestamps, catching tokens emitted by tools like Azure Storage Explorer that were previously missed.
    • Grafana detector updated to treat HTTP 401 responses as unverified (instead of verified), tightening classification of rotated/revoked tokens.

    4 details in Everything

74. v3.95.7 Jun 29, 2026 · issue 001

    TruffleHog v3.95.7 adds HuggingFace bucket scanning, three new secret detectors, multi-org GitHub App scanning, and SecretParts in JSON output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.7 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.7

    └──▷ TRY IT
    Scan a specific HuggingFace bucket for leaked credentials — useful when a model org also hosts file storage buckets.
    copy

    $ trufflehog huggingface --bucket=myorg/mybucket --results=verified

    Scan secrets across all GitHub orgs where your App is installed, without enumerating installations manually.
    copy

    $ trufflehog github --app-id=<app-id> --app-private-key=<path/to/key.pem> --scan_all_installations --results=verified

    Capture structured SecretParts fields from JSON output to feed into a downstream pipeline or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
    copy

    $ trufflehog git https://github.com/org/repo --results=verified --json | jq '.SecretParts'

    • Adds --bucket flag to the huggingface subcommand, enabling secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. of HuggingFace buckets alongside datasets, models, and spaces.
    • New Braintrust detector classifies and validates Braintrust API keys.
    • New Pganalyze Read Key detector classifies and validates Pganalyze read keys.
    • New Red Hat Pyxis API key detector classifies and validates Red Hat Pyxis credentials.
    • Adds scan_all_installations option for GitHub App sources, enabling secret scanning across all orgs where the App is installed in a single run.

    +1 more show less

    • Exposes SecretParts in JSON output, giving practitioners structured access to individual components of a detected secret.

    6 details in Everything

75. v3.95.6 Jun 18, 2026 · release notes

    TruffleHog v3.95.6 adds five new secret detectors (Datadog API key, Tly, Wit, Rev, User) and surfaces S3 bucket listing failures.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.6 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.6

    • Adds Datadog API key detector to the default detector set.
    • Adds Tly detector to the default detector set with updated verification logic.
    • Adds Wit detector to the default detector set with updated verification logic.
    • Adds Rev detector to the default detector set, gated behind a feature flag.
    • Adds User detector to the default detector set with custom endpoint configuration support.

    +2 more show less

    • Surfaces S3 bucket listing failures so scan errors are visible rather than silently skipped.
    • Sets redacted secret display value to the last 4 characters, matching the secret-type admin interface.

    7 details in Everything

76. v3.95.6 Jun 18, 2026 · issue 001

    TruffleHog v3.95.6 adds six new secret detectors (Datadog API key, Tly, Wit, Rev, User, Enigma) and lifts the 64 KB line-scanning cap to 10 MB.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.6 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.6

    └──▷ TRY IT
    Scan a repo and catch leaked Datadog API keys, which are now detected by default without any extra flags.
    copy

    $ trufflehog git https://github.com/<org>/<repo> --results=verified

    • Adds Datadog API key detector to the default detector set.
    • Adds Tly detector to the default detector set.
    • Adds Wit detector to the default detector set.
    • Adds Rev detector to the default detector set.
    • Adds User detector (with custom endpoint configuration) to the default detector set.

    +4 more show less

    • Adds Enigma detector with hardened GraphQL-based verification to the default detector set.
    • Raises the per-line scanning limit from 64 KB to 10 MB, enabling detection in files with long lines such as minified JS or base64 blobs.
    • Updates Klaviyo detector to recognise the new PK token format.
    • Changes redacted secret display to show only the last 4 characters, matching the TruffleHog secret-type admin interface.

    9 details in Everything

77. v3.95.5 Jun 2, 2026 · release notes

    TruffleHog v3.95.5 adds GitLab OAuth, SpectralOps, and AWS AppSync detectors plus ASPX/entity-encoded HTML decoding

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.5 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.5

    • New GitLab OAuth detector identifies exposed GitLab OAuth tokens
    • New SpectralOps Personal API Key detector catches leaked SpectralOps credentials
    • New AWS AppSync detector surfaces exposed AWS AppSync API keys
    • HTML decoder now supports ASPX and entity-encoded HTML, expanding secret detection in web application artifacts
    • Database detectors now include host, db, and username in ExtraData, enriching findings with connection context

    +4 more show less

    • Box detector extracts Subject ID for Analyzer integration, enabling richer permission analysis
    • Improved APK scanning with additional debugging info and better handling of obfuscated APKs
    • Feature flags added for Pinecone, Cloudinary, and GitLab OAuth detectors
    • SharePoint source config gains new flags via updated proto definition

    9 details in Everything

78. v3.95.5 Jun 2, 2026 · issue 001

    TruffleHog v3.95.5 adds GitLab OAuth, SpectralOps, and AWS AppSync detectors plus ASPX/entity-encoded HTML decoding.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.5 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.5

    └──▷ TRY IT
    Scan a repository and surface database credentials with enriched host/username context in JSON output for triage.
    copy

    $ trufflehog git https://github.com/<org>/<repo> --results=verified --json

    • New GitLab OAuth detector identifies and validates leaked GitLab OAuth tokens.
    • New SpectralOps Personal API Key detector for SpectralOps credentials.
    • New AWS AppSync detector for leaked AWS AppSync API keys.
    • HTML decoder now supports ASPX and entity-encoded HTML, broadening secret discovery in web application artifacts.
    • Database detectors now surface host, database name, and username in ExtraData for richer context on found credentials.

    +2 more show less

    • APK scanning gains additional debugging info and improved parsing of obfuscated APKs.
    • Feature flags added for Pinecone, Cloudinary, and GitLab OAuth detectors, enabling selective enablement.

    7 details in Everything

79. v3.95.4 Jun 2, 2026 · release notes

    TruffleHog v3.95.4 adds GitLab OAuth, SpectralOps, and AWS AppSync detectors plus ASPX/entity-encoded HTML decoding.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.4 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.4

    • New GitLab OAuth detector identifies leaked GitLab OAuth tokens.
    • New SpectralOps Personal API Key detector catches SpectralOps credentials.
    • New AWS AppSync detector surfaces leaked AWS AppSync API keys.
    • Database detectors now surface host, database name, and username in ExtraData for richer triage context.
    • HTML decoder gains support for ASPX files and entity-encoded HTML, expanding coverage of web application secrets.

    +2 more show less

    • Adds source config flags to the SharePoint proto, enabling finer-grained SharePoint scanning configuration.
    • Feature flags added for Pinecone, Cloudinary, and GitLab OAuth detectors for controlled rollout.

    7 details in Everything

80. v3.95.4 Jun 2, 2026 · issue 001

    TruffleHog v3.95.4 adds GitLab OAuth, AWS AppSync, and SpectralOps detectors plus richer database ExtraData and expanded HTML decoding.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.4 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.4

    └──▷ TRY IT
    Scan a GitLab repo for verified secrets including the new GitLab OAuth detector — useful when auditing OAuth app credentials committed to source.
    copy

    $ trufflehog git https://gitlab.com/myorg/myrepo --results=verified --json

    Scan a filesystem path for secrets in ASPX or entity-encoded HTML files, now decoded by the expanded HTML decoder.
    copy

    $ trufflehog filesystem path/to/webapp --results=verified,unknown --json

    • New GitLab OAuth detector identifies and validates GitLab OAuth tokens.
    • New AWS AppSync detector classifies and validates AWS AppSync API keys.
    • New SpectralOps Personal API Key detector covers SpectralOps credentials.
    • Database detectors now expose host, db, and username fields in ExtraData for richer result context.
    • HTML decoder gains ASPX and entity-encoded HTML support, expanding secret discovery in web application artifacts.

    +3 more show less

    • Box detector now extracts Subject ID to enable Analyzer integration.
    • Pinecone and Cloudinary detectors are enabled by default in OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. builds.
    • Improved APK scanning adds debugging info and broader support for obfuscated APKs and non-standard resource types.

    8 details in Everything

81. v3.95.3 May 11, 2026 · release notes

    TruffleHog v3.95.3 adds Cloudinary and Pinecone detectors, custom detector response-range config, and deduplication of concurrent verifications.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.3 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.3

    └──▷ USE IT
    Define a custom detector that treats 200 as valid and 403 as rotated, instead of relying on defaults.
    yaml copy

    # In your custom detector YAML config:
    name: MyCustomDetector
    regex:
      secret: 'mytoken_[a-z0-9]{32}'
    verify:
      - endpoint: 'https://api.example.com/verify'
        successRanges:
          - '200-200'
        rotatedRanges:
          - '403-403'

    • Adds Cloudinary API credential detector.
    • Adds Pinecone API key detector.
    • Supports customizable successRanges and rotatedRanges in custom detectors, giving control over which HTTP response codes indicate a valid or rotated secret.
    • Deduplicates concurrent credential verification requests via singleflight, reducing redundant outbound calls when the same secret is seen in parallel.
    • Adds default Content-Type: application/json header to custom detector verification requests.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The AnalysisInfo field on detectors.Result is renamed to SecretParts; any custom detector or tooling that references AnalysisInfo directly will break.
82. v3.95.0 Apr 21, 2026 · release notes

    TruffleHog v3.95.0 adds Bitbucket, Jira, and Confluence Data Center PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. detectors plus HashiCorp Vault custom endpoint support and man page generation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.95.0 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.95.0

    • Adds Bitbucket Data Center (on-premises) PAT detector for self-hosted Bitbucket environments.
    • Adds Jira Data Center PAT detector to identify exposed Jira on-prem personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..
    • Adds Confluence Data Center PAT detector for self-hosted Confluence instances.
    • Supports custom endpoint configuration in the HashiCorp Vault Auth detector.
    • Adds man page generation for TruffleHog, enabling offline reference via standard Unix tooling.

    +1 more show less

    • Introduces AnalysisError type with wrapped error paths across all analyzer code for more structured error reporting.

    6 details in Everything

83. v3.94.3 Apr 8, 2026 · release notes

    TruffleHog v3.94.3 adds HTML decoding for secret detection and AnalysisInfo on verified results.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.94.3 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.94.3

    • Adds HTML decoder so secrets embedded in HTML-formatted sources (e.g. HTML email archives, web pages) are now detected.
    • Adds AnalysisInfo metadata to verified results, surfacing richer context alongside confirmed secrets.
    • Treats AADSTS50173 as an explicit revocation signal for Azure refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API., improving credential-status accuracy.

    3 details in Everything

84. v3.94.2 Apr 1, 2026 · release notes

    TruffleHog v3.94.2 adds a new Shopify OAuth secret detector.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.94.2 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.94.2

85. v3.94.0 Mar 20, 2026 · release notes

    TruffleHog v3.94.0 adds a Datadog API key detector and MuleSoft Anypoint OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. detector.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.94.0 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.94.0

    • New Datadog API key detector (datadogapikey) for detecting Datadog API keys in scanned sources.
    • Adds MuleSoft Anypoint OAuth2 detector to the default detector set.

    2 details in Everything

86. v3.93.7 Mar 4, 2026 · release notes

    TruffleHog v3.93.7 adds a new detector for JFrog Artifactory Reference Tokens.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.93.7 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.93.7

87. v3.93.5 Feb 26, 2026 · release notes

    TruffleHog v3.93.5 adds Google Gemini API key detection, symlink following in filesystem scans, and richer Slack metadata.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.93.5 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.93.5

    • Adds Google Gemini API key detector to catch exposed Gemini credentials.
    • Supports following symlinks when scanning filesystem sources.
    • Includes workspace_id in Slack Continuous scan metadata for better attribution.
    • Adds Base64 decoding depth assessment to improve nested-encoding detection.

    4 details in Everything

88. v3.93.4 Feb 19, 2026 · release notes

    TruffleHog v3.93.4 adds an NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory./JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. input source for scanning structured log and data streams.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.93.4 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.93.4

89. v3.93.3 Feb 11, 2026 · release notes

    TruffleHog v3.93.3 adds a dedicated detector for OpenAI Admin Keys.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.93.3 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.93.3

    • New OpenAI Admin Key detector identifies exposed OpenAI admin credentials in scanned sources.

    1 detail in Everything

90. v3.93.1 Feb 6, 2026 · release notes

    Adds caller info logging capability

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.93.1 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.93.1

91. v3.93.0 Feb 4, 2026 · release notes

    TruffleHog v3.93.0 adds pre-commit auto-config, Tableau analysis info, ignorePattern for Postgres/SQL Server, and GitHub Analyzer rate limiting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.93.0 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.93.0

    • Auto-configures TruffleHog for pre-commit hooks, simplifying hook setup.
    • Adds analysis info (key metadata) output to the Tableau detector.
    • Adds ignorePattern configuration support to Postgres and SQL Server detectors.
    • Adds rate limiting to the GitHub Analyzer to avoid API throttling.
    • Includes key info in analyze output for richer credential analysis results.

    5 details in Everything

92. v3.92.5 Jan 16, 2026 · release notes

    TruffleHog v3.92.5 adds GitLab Project ID to secret metadata, stronger Custom Detector validation, and Postman API rate-limit metrics.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.92.5 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.92.5

    • Stores GitLab Project ID in secret location metadata for richer triage context.
    • Adds more validations to Custom Detector config to catch misconfigured detectors earlier.
    • Adds a Postman API monthly request limit metric to track rate-limit exposure.

    3 details in Everything

93. v3.92.4 Dec 19, 2025 · release notes

    TruffleHog v3.92.4 adds line numbers for GitHub real-time scanning and role-aware resumption for legacy S3 scans.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.92.4 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.92.4

    • Adds line numbers to GitHub real-time scan findings for precise secret location reporting.
    • Supports role-aware resumption for legacy S3 scans, enabling interrupted scans to resume correctly when assuming IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles.
    • Adds pagination and rate-limit handling for Docker Registry namespace API calls, improving reliability at scale.

    3 details in Everything

94. v3.92.3 Dec 11, 2025 · release notes

    Adds proto definitions for Google Drive Domain-Wide Delegation to enable service account impersonation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.92.3 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.92.3

95. v3.92.2 Dec 10, 2025 · release notes

    TruffleHog v3.92.2 adds an optional timeout for git clone operations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.92.2 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.92.2

96. v3.92.0 Dec 9, 2025 · release notes

    TruffleHog v3.92.0 adds GitLab V3 detection, S3 unit support, Postman rate-limit guardrails, and Docker source metrics.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.92.0 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.92.0

    • Adds GitLab V3 detector for scanning secrets in GitLab V3 API-authenticated environments.
    • Supports units in the S3 source, enabling parallel/unit-based scanning of S3 buckets.
    • Automatically aborts Postman scans when monthly API request usage crosses 80% of the limit, preventing quota exhaustion.
    • Adds API call metrics and job ID tracking to the Docker source for improved observability.
    • Adds metrics to RetryableHTTPClient for visibility into HTTP retry behavior.

    +3 more show less

    • Applies configured include/ignore lists to GitLab unit scans, bringing unit-level scans in line with full scan filtering.
    • Adds a way to attach key-value pairs to new sinks for richer output metadata.
    • Adds more clone logging for improved Git clone observability.

    8 details in Everything

97. v3.91.2 Dec 2, 2025 · release notes

    Adds Installation Type field to Jira source and response ID/name to Postman metadata.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.91.2 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.91.2

98. v3.91.1 Nov 20, 2025 · release notes

    TruffleHog v3.91.1 adds generic JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. detection and verification plus AnalysisInfo enrichment on verified results.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.91.1 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.91.1

    • Adds generic JWT detection and verification, enabling TruffleHog to find and validate JSON Web Tokens across scanned sources.
    • Adds AnalysisInfo metadata to verified results in detectors, surfacing richer context for new analyzers.
    • Redacts Twilio API Key secrets in output to reduce accidental secret exposure in scan results.

    3 details in Everything

99. v3.91.0 Nov 12, 2025 · release notes

    TruffleHog v3.91.0 adds namespace-wide Docker registry scanning and improved file-type handling for .msg and .doc

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.91.0 https://github.com/trufflesecurity/trufflehog.git
    # already have the repo? check out this version:
    $ git checkout v3.91.0

    • Scans all images under a namespace when targeting Docker remote registries, expanding coverage beyond single images.
    • Adds .msg and .doc to skipped archiver MIME types, preventing false archive-extraction attempts on Outlook and Word files.

    2 details in Everything

100. v3.90.13 Nov 5, 2025 · release notes

     TruffleHog v3.90.13 adds GraphQL-powered GitHub PR/issue scanning and Google Drive on-prem support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.90.13 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.90.13

     • Implements GraphQL requests for scanning GitHub PRs, issues, and comments — enabling more efficient and complete coverage of GitHub source data.
     • Updates Google Drive integration to support on-premises scanning.

     2 details in Everything

101. v3.90.12 Oct 27, 2025 · release notes

     TruffleHog v3.90.12 adds private repo support for github-experimental and bypass filtering for explicitly listed repositories.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.90.12 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.90.12

     • Adds ability to run github-experimental source against private repositories.
     • Explicitly listed repositories now bypass wantRepo() filtering entirely, ensuring they are always scanned regardless of filter configuration.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The include_repos option has been removed from the GitHub source configuration.
102. v3.90.9 Oct 15, 2025 · release notes

     TruffleHog v3.90.9 adds Confluence comment scanning, Postmark Account API Token verification, and non-zero exit codes on scan errors.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.90.9 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.90.9

     • Supports scanning Confluence comments for secrets.
     • Adds Account API Token verification support in the Postmark detector.
     • Returns a non-zero exit code when an error occurs during a scan, enabling reliable CI/CD failure detection.
     • Detects Organization ID and passes it into AnalysisInfo for the Atlassian detector.

     4 details in Everything

103. v3.90.7 Sep 18, 2025 · release notes

     Adds FlightLabs API detector coverage and metrics to SaneHTTPClient

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.90.7 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.90.7

     • Adds new FlightLabs API detector to identify secrets in that service

     1 detail in Everything

104. v3.90.6 Sep 4, 2025 · release notes

     TruffleHog v3.90.6 adds Rippling, Fly.io, and Photoroom detectors plus AWS account allow/deny lists and new scan controls.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.90.6 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.90.6

     └──▷ TRY IT
     Scan a GitHub org but skip Gists to reduce noise and scan time.
     copy

     $ trufflehog github --org=<org> --token=<token> --ignore-gists

     • New detector for Rippling phrase API tokens.
     • New detector for Fly.io credentials.
     • New detector for Photoroom API keys.
     • Updates the Dotmailer detector to Dotdigital (rebranded service coverage).
     • Adds AWS account allow and deny lists to scope or exclude specific AWS accounts during scanning.

     +8 more show less

     • Enables cloning a repository to a specified location with a retention option.
     • Adds a dedicated flag to skip GitHub Gists during scans.
     • Adds a GraphQL client to the GitHub connector for richer repository data access.
     • Supports scanning GitHub private repositories with a token.
     • Adds additional validation rules support in custom detectors.
     • Adds a feature flag to configure the number of projects per page in GitLab enumeration.
     • Adds an explicit secrets-manager write flag to the Bitbucket source configuration.
     • Adds indeterminate verification support for letter-Q detectors.

     13 details in Everything

105. v3.90.5 Aug 14, 2025 · release notes

     TruffleHog v3.90.5 adds UTF-16 BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. support, expanded Unicode escape detection, and custom Bitbucket OAuth proto definitions.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.90.5 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.90.5

     • Supports UTF-16 BOM-encoded files, enabling secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. across a wider range of text encodings.
     • Adds additional Unicode escape sequence support, improving detection of obfuscated secrets in source files.
     • Updates proto definitions to support custom Bitbucket OAuth configurations.

     3 details in Everything

106. v3.90.4 Aug 13, 2025 · release notes

     TruffleHog v3.90.4 adds HashiCorp Vault AppRole detector, API-based Bitfinex validation, binary-skip option, and GCP private key ID metadata.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.90.4 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.90.4

     └──▷ TRY IT
     Scan a local directory while skipping binary files to reduce noise and speed up filesystem scans.
     copy

     $ trufflehog filesystem /path/to/repo --skip-binaries

     • New HashiCorp Vault AppRole authentication detector for scanning Vault credentials.
     • Adds --skip-binaries option to skip binary files during filesystem source scanning.
     • Upgrades Bitfinex detector to use API-based secret validation for live verification.
     • Adds private key ID to GCP credential metadata for richer secret context.

     4 details in Everything

107. v3.90.3 Aug 4, 2025 · release notes

     TruffleHog v3.90.3 adds Webex Bot, Tableau PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., and Rootly detectors plus GitLab Group scanning and filesystem scan resumption

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.90.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.90.3

     • New Webex Bot secret detector.
     • New Tableau Personal Access Token detector.
     • New Rootly API token detector.
     • Supports scanning GitLab Groups (in addition to individual projects).
     • Supports sub-unit resumption in filesystem scans, enabling interrupted scans to resume mid-directory.

     5 details in Everything

108. v3.90.2 Jul 24, 2025 · release notes

     TruffleHog v3.90.2 adds Anypoint API OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. detection, Slack continuous scan improvements, and expanded Vector config options.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.90.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.90.2

     • New Anypoint API OAuth2 detector identifies leaked MuleSoft Anypoint Platform OAuth2 credentials.
     • Adds Slack continuous protobuf messages support for real-time Slack scanning.
     • Adds additional Vector sink configuration options for richer log/event pipeline tuning.

     3 details in Everything

109. v3.90.1 Jul 18, 2025 · release notes

     TruffleHog v3.90.1 adds Salesforce Refresh Token detection and KeySet pagination for large GitLab project scans.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.90.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.90.1

     • New Salesforce Refresh Token detector identifies exposed Salesforce refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. during scans.
     • KeySet pagination for GitLab Projects V2 enumeration enables reliable scanning of large GitLab instances without missing projects.

     2 details in Everything

110. v3.90.0 Jul 15, 2025 · release notes

     TruffleHog v3.90.0 adds Docker daemon scanning, 4 new secret detectors, and I/O performance optimizations.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.90.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.90.0

     • Adds Docker daemon as a scan source, enabling secret detection directly from locally running containers.
     • New LangSmith API Key detector for catching exposed LangChain/LangSmith credentials.
     • New Hasura detector for identifying leaked Hasura admin secrets.
     • New Salesforce OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. detector for detecting Salesforce OAuth credentials.
     • New Bitbucket App detector for identifying Bitbucket app credentials.

     +9 more show less

     • Adds v2 CircleCI detector with updated token pattern coverage.
     • Updates Asana detector to recognize the new personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. format.
     • Adds Bannerbear Detector V2 with improved detection coverage.
     • Adds Shannon Entropy check to the GitLab v1 detector to reduce false positives.
     • Enables and enhances the Artifactory detector.
     • Optimizes chunk size handling for improved I/O and memory efficiency during scans.
     • Simplified GitLab enumeration for faster repository scanning.
     • Surfaces errors when the GitHub source cannot fetch a repo or gist, improving scan visibility.
     • Writes --help output to stdout instead of stderr.

     14 details in Everything

111. v3.89.2 Jun 16, 2025 · release notes

     TruffleHog v3.89.2 adds a Datadog analyzer and new git cloning/scanning metrics.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.89.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.89.2

     • New Datadog analyzer for validating and analyzing Datadog API credentials.
     • Adds git metrics for cloning and scanning operations, enabling performance visibility.

     2 details in Everything

112. v3.89.1 Jun 10, 2025 · release notes

     TruffleHog v3.89.1 adds exclude-paths support for Docker image scanning.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.89.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.89.1

     └──▷ TRY IT
     Scan a Docker image while skipping vendor and test directories to reduce noise in CI pipelines.
     copy

     $ trufflehog docker --image myrepo/myapp:latest --exclude-paths exclude.txt

     • Supports --exclude-paths filtering when scanning Docker images, letting you skip specified paths inside containers.

     1 detail in Everything

113. v3.89.0 Jun 6, 2025 · release notes

     TruffleHog v3.89.0 adds Stripe Payment Intent detection, config-file source definitions, GitHub commit metadata scanning, and new analyzers.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.89.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.89.0

     └──▷ TRY IT
     Define multiple scan sources in a config file so you can run a complex, repeatable scan without long CLI flags.
     copy

     $ trufflehog --config sources.yaml

     • New Stripe Payment Intent detector identifies exposed Stripe payment-intent secrets.
     • Adds support for defining scan sources via a config file, enabling repeatable multi-source scan configurations.
     • Supports scanning GitHub commit metadata in targeted scans.
     • New Heroku detector version expands Heroku credential coverage.
     • New Jira token analyzer for post-detection credential analysis.

     +1 more show less

     • Updated OpenAI analyzer with expanded analysis capabilities.

     6 details in Everything

114. v3.88.35 May 29, 2025 · release notes

     TruffleHog v3.88.35 adds DeepSeek detection, improves JIRA/LaunchDarkly detectors, and supports GitHub/GitLab auth via http.extraHeader

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.35 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.35

     • Adds DeepSeek secret detector and analyzer support.
     • Supports GitHub and GitLab authentication via http.extraHeader when cloning repositories.
     • Improves JIRA detector with updated detection logic.
     • Updates LaunchDarkly analyzer and detector.

     4 details in Everything

115. v3.88.34 May 23, 2025 · release notes

     TruffleHog v3.88.34 adds pipe/stdin input support and enhances the Smartsheets detector.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.34 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.34

     • Supports reading input directly from a pipe, enabling integration into shell pipelines and CI workflows.
     • Enhanced Smartsheets detector with improved secret detection coverage.

     2 details in Everything

116. v3.88.33 May 22, 2025 · release notes

     TruffleHog v3.88.33 adds indeterminate verification support for letter Z detectors.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.33 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.33

     • Supports indeterminate verification state for letter Z detectors, enabling more nuanced credential validation results.

     1 detail in Everything

117. v3.88.31 May 20, 2025 · release notes

     TruffleHog v3.88.31 adds Dropbox OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. and Databricks token analyzers plus per-chunk detection logging

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.31 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.31

     • Adds Dropbox API OAuth2 Token Analyzer to validate leaked Dropbox OAuth2 tokens
     • Adds Databricks Analyzer to validate leaked Databricks credentials
     • Adds per-chunk detection logging for improved visibility into the scanning pipeline

     3 details in Everything

118. v3.88.30 May 16, 2025 · release notes

     TruffleHog v3.88.30 adds Azure Config, AccuWeather, Ngrok, Mux, and PostHog detectors/analyzers

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.30 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.30

     • New detector for Azure Configuration Connection String keys enables secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. of Azure App Configuration credentials.
     • New Ngrok API Key Analyzer validates and analyzes detected Ngrok API keys for scope and permissions.
     • New AccuWeather detector version expands coverage of AccuWeather API key patterns.
     • New Mux API Analyzer validates and analyzes detected Mux API credentials.
     • New PostHog Analyzer validates and analyzes detected PostHog API keys.

     +1 more show less

     • Improved JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. Detector regex broadens detection coverage for JDBC connection string secrets.

     6 details in Everything

119. v3.88.29 May 8, 2025 · release notes

     TruffleHog v3.88.29 adds Azure API Management detector plus Fastly and Monday.com analyzers

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.29 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.29

     • New detector for Azure API Management Direct Management Keys.
     • New Fastly analyzer for deeper credential analysis.
     • New Monday App analyzer for deeper credential analysis.
     • S3 source migrated to AWS SDK v2, unlocking compatibility with newer AWS features and regions.

     4 details in Everything

120. v3.88.28 May 5, 2025 · release notes

     TruffleHog v3.88.28 adds xAI and Ngrok Tunnel Authtoken detectors plus a Netlify analyzer.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.28 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.28

     • New xAI detector to identify exposed xAI API keys in scanned sources.
     • Adds Ngrok Tunnel Authtoken verification to the Ngrok detector.
     • New Netlify analyzer for deeper validation of detected Netlify credentials.

     3 details in Everything

121. v3.88.27 May 2, 2025 · release notes

     TruffleHog v3.88.27 adds Bing Subscription Key detection.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.27 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.27

122. v3.88.26 Apr 29, 2025 · release notes

     TruffleHog v3.88.26 adds five new secret detectors (DockerHub OATs, Azure CosmosDB, Netlify v2, Harness, Langfuse) and a --no-color flag.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.26 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.26

     └──▷ TRY IT
     Pipe TruffleHog output to a log file or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. without ANSI escape codes polluting the data.
     copy

     $ trufflehog git https://github.com/org/repo --no-color 2>&1 | tee scan.log

     • Adds detection support for DockerHub Organization Access Tokens (OATs).
     • Adds Azure CosmosDB secret detector.
     • Adds Netlify Detector Version 2 implementation.
     • Adds Harness secret detector.
     • Adds Langfuse secret detector.

     +1 more show less

     • New --no-color flag forces colorized output off, useful for CI pipelines and log aggregators.

     6 details in Everything

123. v3.88.25 Apr 21, 2025 · release notes

     TruffleHog v3.88.25 adds a new Docker registry auth credential detector.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.25 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.25

     • New Docker registry auth detector identifies exposed container registry credentials in scanned sources.

     1 detail in Everything

124. v3.88.24 Apr 16, 2025 · release notes

     TruffleHog v3.88.24 adds Plaid API analyzer, Azure Subscription Key detector, and faster filesystem exclusion pruning.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.24 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.24

     • New Plaid API analyzer enables deeper inspection of discovered Plaid credentials.
     • New Azure Subscription Keys detector identifies leaked Azure API subscription keys.
     • Adds indeterminate verification support to the Bitly detector for ambiguous credential states.
     • Adds indeterminate verification support to the Okta detector for ambiguous credential states.
     • Filesystem source now eagerly prunes excluded paths during tree enumeration, reducing scan time on large repos with exclusion rules.

     5 details in Everything

125. v3.88.21 Apr 3, 2025 · release notes

     TruffleHog v3.88.21 adds Figma PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. analyzer, Azure API Management detector, and Postman rate limiting.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.21 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.21

     • New Figma Personal Access Token (PAT) analyzer for validating leaked Figma credentials.
     • New detector for Azure API Management Repository keys.
     • Adds rate limiting when enumerating Postman workspaces to avoid API throttling.

     3 details in Everything

126. v3.88.19 Mar 27, 2025 · release notes

     TruffleHog v3.88.19 adds Azure SAS Token and Sentry org token detectors, plus a Bitbucket autodetection bypass option.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.19 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.19

     • New detector for Azure SAS Tokens enables scanning for leaked Azure Shared Access Signatures.
     • New Sentry org token detector expands coverage of Sentry credential types beyond standard API keys.
     • Adds tenant_id to the MS Teams source configuration, enabling tenant-scoped scanning.
     • Adds option to bypass Bitbucket installation type autodetection for environments where detection is unreliable.

     4 details in Everything

127. v3.88.17 Mar 13, 2025 · release notes

     TruffleHog v3.88.17 adds detection and analysis of Anthropic admin keys.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.17 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.17

     • Detects Anthropic admin keys in addition to previously supported Anthropic key types.
     • Analyzes Anthropic admin keys via the Anthropic analyzer for deeper secret inspection.

     2 details in Everything

128. v3.88.16 Mar 10, 2025 · release notes

     TruffleHog v3.88.16 adds Groq and LaunchDarkly analyzers, terminal analyze output, and Postman rate limiting.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.16 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.16

     • Adds terminal output for the analyze command when the detector supports it, surfacing results directly in the CLI.
     • New Groq analyzer enables credential analysis for Groq API keys.
     • New LaunchDarkly Token analyzer enables credential analysis for LaunchDarkly tokens.
     • Adds rate limiting across all Postman client GET requests to prevent enumeration throttling issues.
     • TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. now handles relative paths.

     5 details in Everything

129. v3.88.15 Mar 5, 2025 · release notes

     TruffleHog v3.88.15 adds PlanetScale and Airtable analyzers for deeper credential exposure analysis.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.15 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.15

     • New PlanetScale Analyzer to assess exposure of discovered PlanetScale credentials.
     • New Airtable Analyzer for Personal Access Tokens to assess exposure of discovered Airtable credentials.
     • Enumeration jobs no longer consume concurrency slots, improving scan throughput under load.
     • Re-activates the Plaid key detector for detecting Plaid API credentials.

     4 details in Everything

130. v3.88.14 Feb 27, 2025 · release notes

     TruffleHog v3.88.14 adds GitHub Realtime authentication and an Airtable Personal Access Token detector.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.14 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.14

     • Enables GitHub Realtime authentication for live credential validation against GitHub.
     • New Airtable Personal Access Token detector identifies leaked Airtable PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. in scanned sources.

     2 details in Everything

131. v3.88.13 Feb 25, 2025 · release notes

     TruffleHog v3.88.13 adds an ElevenLabs analyzer for validating leaked ElevenLabs API keys.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.13 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.13

     • Adds ElevenLabs analyzer to validate detected ElevenLabs API credentials.

     1 detail in Everything

132. v3.88.12 Feb 20, 2025 · release notes

     TruffleHog v3.88.12 adds an Airtable OAuth Token analyzer and updates the Sendgrid analyzer.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.12 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.12

     • New Airtable analyzer validates leaked Airtable OAuth tokens.
     • Updated Sendgrid analyzer with expanded analysis capabilities.

     2 details in Everything

133. v3.88.9 Feb 14, 2025 · release notes

     TruffleHog v3.88.9 adds Postman collection authorization scanning and GitHub Realtime protocol support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.9 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.9

     • Adds scanning of Postman collection authorization fields for exposed secrets.
     • Adds protocol buffer definitions for GitHub Realtime, laying groundwork for real-time GitHub secret detection.

     2 details in Everything

134. v3.88.8 Feb 13, 2025 · release notes

     TruffleHog v3.88.8 reinstates Postman body scanning and adds an Anthropic API key analyzer.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.8 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.8

     • Reinstates Postman body scanning, restoring secret detection within Postman request/response bodies.
     • Adds an Anthropic API key analyzer for active verification of detected Anthropic credentials.
     • Adds happy-path logging for the Jenkins source to improve scan visibility.

     3 details in Everything

135. v3.88.7 Feb 12, 2025 · release notes

     TruffleHog v3.88.7 adds DockerHub and Notion analyzers with improved Mailgun and OpenAI analysis output.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.7 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.7

     • New DockerHub analyzer for inspecting DockerHub credentials.
     • New Notion analyzer for validating and analyzing Notion API keys.
     • Optimized Mailgun analyzer with updated analysis logic.
     • Updated OpenAI analyzer output for richer credential analysis results.

     4 details in Everything

136. v3.88.6 Feb 10, 2025 · release notes

     TruffleHog v3.88.6 adds Airtable OAuth detection and merges the analyze TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. into the main TruffleHog TUI.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.6 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.6

     • New Airtable OAuth detector identifies leaked Airtable OAuth tokens during scanning.
     • Merges the analyze TUI into the main TruffleHog TUI, unifying the interactive interface.

     2 details in Everything

137. v3.88.5 Feb 5, 2025 · release notes

     TruffleHog v3.88.5 adds Auth0 and Azure refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. detectors plus a new Private Key Analyzer.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.5 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.5

     • New Auth0 detector enables verification of Auth0 credentials found in scans.
     • New Azure refresh token detector identifies exposed Azure OAuth refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API..
     • New Private Key Analyzer inspects detected private keys for additional context and risk signals.
     • Release binary is now compressed with UPX, reducing download size.

     4 details in Everything

138. v3.88.4 Jan 30, 2025 · release notes

     Custom detectors now support exclude regexes, excludewords, and entropy filters for fine-grained secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. control.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.4 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.4

     └──▷ USE IT
     Suppress noisy custom detector matches by excluding test/placeholder values and low-entropy strings directly in your detector config.
     yaml copy

     # In your custom detector YAML config:
     detectors:
       - name: MyAPIKey
         keywords:
           - myservice
         regex:
           id: '[A-Za-z0-9]{32}'
         excludewords:
           - example
           - placeholder
         exclude:
           - 'test[_-]?key'
         entropy:
           min: 3.5

     • Supports exclude regexes, excludewords, and entropy filters in custom detector configurations to reduce false positives.

     1 detail in Everything

139. v3.88.3 Jan 29, 2025 · release notes

     TruffleHog v3.88.3 adds a new Sanity detector and custom endpoint support for the GitLab analyzer.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.3

     • Adds new Sanity detector for scanning Sanity API credentials.
     • Supports custom endpoints in the GitLab analyzer for self-hosted GitLab instances.
     • Custom detector regexes now use the first capture group when available, giving more precise control over what is extracted.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removes global variable scanning implementation for Postman — secrets stored in Postman global variables will no longer be scanned.
140. v3.88.2 Jan 9, 2025 · release notes

     TruffleHog v3.88.2 adds revoked token detection to the Slack detector and updates ScrapingBee detection.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.2

     • Slack detector now identifies revoked tokens in addition to active ones.
     • Updated ScrapingBee detector with improved detection coverage.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The resumption option has been removed.
141. v3.88.0 Dec 20, 2024 · release notes

     TruffleHog v3.88.0 adds a Twilio API Key detector and a verification cache to speed up secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.88.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.88.0

142. v3.87.0 Dec 17, 2024 · release notes

     TruffleHog v3.87.0 makes detection timeout configurable and updates several credential detectors.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.87.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.87.0

     • Makes the detection timeout (detectionTimeout) configurable, allowing tuning of per-detector scan time limits.

     1 detail in Everything

143. v3.86.0 Dec 10, 2024 · release notes

     TruffleHog v3.86.0 adds Twitch OAuth token detection and replaces --only-verified with the new --results flag

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.86.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.86.0

     └──▷ TRY IT
     Scan a git repo and surface only verified secrets, using the new --results flag instead of the removed --only-verified.
     copy

     $ trufflehog git https://github.com/<org>/<repo> --results=verified

     • New detector for Twitch OAuth Access Tokens.
     • New --results flag replaces --only-verified for filtering scan output.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The --only-verified flag is replaced by --results; scripts or CI pipelines using --only-verified will break on upgrade.
144. v3.85.0 Dec 5, 2024 · release notes

     TruffleHog v3.85.0 adds Flexport and Typeform v2 detectors, GCP credential analysis, and a new --log-level flag replacing --debug/--trace

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.85.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.85.0

     └──▷ TRY IT
     Control verbosity precisely during a scan without toggling the old boolean --debug flag.
     copy

     $ trufflehog git https://github.com/example/repo --log-level=debug

     • Adds Flexport secret detector for scanning Flexport API credentials.
     • Adds Typeform v2 detector supporting new Typeform key formats.
     • Adds GCP credential analysis info, surfacing richer context when GCP secrets are found.
     • Adds fine-grained --log-level flag replacing the former --debug and --trace flags.
     • Expands canary token detection with an additional canary ID.

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The --debug and --trace flags are replaced by --log-level; any scripts or configs using --debug or --trace will break.
145. v3.84.2 Dec 2, 2024 · release notes

     TruffleHog v3.84.2 adds S3 scanning metrics and a new SourceManager single-unit scan method.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.84.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.84.2

     • Adds S3 metrics to surface scanning telemetry for S3 source scans.
     • Adds a Scan method to SourceManager enabling programmatic scanning of a single SourceUnit.

     2 details in Everything

146. v3.84.1 Nov 22, 2024 · release notes

     TruffleHog v3.84.1 adds GCP encoded-JSON detection, GoDaddy detector, updated Buildkite detectors, and S3 scan resumption.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.84.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.84.1

     • Detects GCP credentials embedded in encoded JSON payloads.
     • New GoDaddy API key detector added.
     • Updated Buildkite detectors for improved coverage.
     • Supports S3 source scan resumption, allowing interrupted scans to pick up where they left off.

     4 details in Everything

147. v3.84.0 Nov 21, 2024 · release notes

     TruffleHog v3.84.0 adds ZohoCRM and Azure OpenAI detectors, S3 scan progress tracking, and a GitLab shared exclusion flag.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.84.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.84.0

     • New ZohoCRM detector to identify exposed Zoho CRM credentials.
     • New Azure OpenAI detector to catch leaked Azure OpenAI API keys.
     • Adds S3 progress tracker for visibility into large S3 scan jobs.
     • Improves Azure Storage, Azure application credentials, Azure Container Registry, and Databricks (Azure workspaces) detectors with expanded detection coverage.
     • Upgrades Algolia and HubSpot detectors with improved detection logic.

     +2 more show less

     • Updates AWS detector logic for broader credential coverage.
     • Introduces fatal vs. non-fatal file handling error classification, with non-fatal errors logged during scans rather than halting them.

     7 details in Everything

148. v3.83.7 Nov 15, 2024 · release notes

     TruffleHog v3.83.7 adds APK scanning, detector descriptions in JSON output, and git commit validation warnings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.83.7 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.83.7

     • Adds support for scanning APK files, enabling secret detection inside Android application packages.
     • Adds detector description field to JSON output, giving richer context on each finding.
     • Adds validation check for git commits with a warning message when an invalid commit is supplied.
     • Updates AirTable detector with improved detection patterns.
     • Updates Opsgenie detector with improved detection patterns.

     5 details in Everything

149. v3.83.5 Nov 8, 2024 · release notes

     TruffleHog v3.83.5 adds S3 scan resumption config and restores name field in custom detector extra data.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.83.5 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.83.5

     • Adds config option to enable S3 source resumption, allowing interrupted S3 scans to pick up where they left off.

     1 detail in Everything

150. v3.83.3 Nov 5, 2024 · release notes

     TruffleHog v3.83.3 adds a Weights and Biases detector and enriches GitHub token findings with owner info.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.83.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.83.3

     • New Weights and Biases detector identifies leaked W&B API keys.
     • GitHub token findings now include the token owner for faster triage.

     2 details in Everything

151. v3.83.0 Oct 30, 2024 · release notes

     TruffleHog v3.83.0 adds GitLab inclusion globbing, GitLab key analysis, global log redaction, and expanded detector coverage.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.83.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.83.0

     • Adds GitLab inclusion globbing, letting users scope scans to specific repository paths within a GitLab source.
     • Adds an Analyzer interface for GitLab, enabling permission and access analysis of GitLab tokens.
     • Adds global log redaction capability to prevent credentials from leaking into TruffleHog's own log output.
     • Extends algoliaadminkey detector with additional validation checks for more accurate results.
     • Adds v3 API version support to the captaindatago detector.

     +3 more show less

     • Includes custom detector responses in extra data output for richer findings.
     • Updates gcpapplicationdefaultcredentials detector results with RawV2 for improved credential capture.
     • Improves AWS finding descriptions for clearer result reporting.

     8 details in Everything

152. v3.82.9 Oct 15, 2024 · release notes

     TruffleHog v3.82.9 adds SaladCloud and Box detectors, GitHub comment time-filtering, and CLI feature flags

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.82.9 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.82.9

     • New SaladCloud API Key detector identifies leaked SaladCloud credentials in scanned sources.
     • New Box detector identifies leaked Box API credentials in scanned sources.
     • Adds GitHub comments timeframe filtering to scope secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. to a specific time window.
     • Exposes feature flags as CLI arguments for runtime capability control.

     4 details in Everything

153. v3.82.7 Oct 7, 2024 · release notes

     TruffleHog v3.82.7 adds a Cisco Meraki API Key detector and a size-bounded LRU cache for improved scanning efficiency.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.82.7 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.82.7

     • Adds a Cisco Meraki API Key detector to identify exposed Meraki credentials.
     • Introduces a SizedLRU cache to bound memory usage during large scans.
     • Adds a Generic Hasher Interface with a Blake2b implementation for flexible hashing support.
     • Improves the Eraser detector to handle additional HTTP status codes.
     • Improves the Agora detector with enhanced detection logic.

     5 details in Everything

154. v3.82.5 Sep 25, 2024 · release notes

     TruffleHog v3.82.5 adds a new RailwayApp secret detector.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.82.5 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.82.5

155. v3.82.4 Sep 24, 2024 · release notes

     Endpoint customizer refresh and new glTF/JPEG XL file ignore rules

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.82.4 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.82.4

     • Refreshes the endpoint customizer logic to allow more flexible credential extraction from dynamic API endpoints
     • Adds glTF and JPEG XL file types to the list of extensions ignored during scanning

     2 details in Everything

156. v3.82.3 Sep 24, 2024 · release notes

     Trufflehog v3.82.3 adds unsafe HTTP detection in the [analyze] command

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.82.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.82.3

     • [analyze] Add client filter to detect successful unsafe HTTP requests

     1 detail in Everything

157. v3.82.2 Sep 13, 2024 · release notes

     TruffleHog v3.82.2 adds credential analyzers for MySQL, Mailgun, and Shopify.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.82.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.82.2

     • Adds analyze support for MySQL — validates and inspects discovered MySQL credentials.
     • Adds analyze support for Mailgun — validates and inspects discovered Mailgun API keys.
     • Adds analyze interface for Shopify — validates and inspects discovered Shopify credentials.
     • Adds a user agent suffix feature flag for customizing HTTP requests made by TruffleHog.

     4 details in Everything

158. v3.82.1 Sep 12, 2024 · release notes

     TruffleHog v3.82.1 adds PyPI v1 API support for secret verification.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.82.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.82.1

     • Supports PyPI v1 API for validating leaked PyPI credentials against the package index.

     1 detail in Everything

159. v3.82.0 Sep 12, 2024 · release notes

     TruffleHog v3.82.0 adds 9 new analyzers, 3 new secret detectors (Robinhood Crypto, Nvidia NGC, PyPI), and central feature flags.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.82.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.82.0

     • New detector for Robinhood Crypto API keys.
     • New detector for Nvidia NGC Personal Keys.
     • New detector for PyPI API tokens.
     • New analyze interface for Postman — enumerate permissions on discovered Postman API keys.
     • New analyze interface for Opsgenie — enumerate permissions on discovered Opsgenie keys.

     +10 more show less

     • New analyze interface for Sendgrid — enumerate permissions on discovered Sendgrid keys.
     • New analyze interface for Bitbucket — enumerate permissions on discovered Bitbucket credentials.
     • New analyze interface for Mailchimp — enumerate permissions on discovered Mailchimp keys.
     • New analyze interface for Slack — enumerate permissions on discovered Slack tokens.
     • New analyze interface for Asana — enumerate permissions on discovered Asana tokens.
     • New analyze interface for SourceGraph — enumerate permissions on discovered SourceGraph tokens.
     • New analyze interface for Postgres — enumerate permissions on discovered Postgres credentials.
     • Adds central feature flags support for controlling experimental capabilities.
     • Adds credential rotation guidance links to findings.
     • Worker multipliers are now configurable, enabling tuning of scan concurrency.

     15 details in Everything

160. v3.81.10 Aug 29, 2024 · release notes

     Trufflehog v3.81.10 adds result cleaning customization and targeted scan filtration skipping.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.81.10 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.81.10

     • Adds the ability to customize results cleaning via a smuggled interface in pull #3235
     • Introduces the ability to skip filtration for targeted scans in pull #3243

     2 details in Everything

161. v3.81.9 Aug 15, 2024 · release notes

     TruffleHog v3.81.9 adds GitHub permission hierarchy capture in analyze mode and new command invocation metrics.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.81.9 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.81.9

     • Captures the full hierarchy of GitHub permissions in analyze mode for richer token capability reporting.
     • Adds metrics for command invocation to improve observability of TruffleHog runs.
     • Captures decoding time as a new internal metric.
     • Improves domain/URL handling in detectors for better detection accuracy.

     4 details in Everything

162. v3.81.7 Aug 7, 2024 · release notes

     TruffleHog v3.81.7 promotes the analyze subcommand into the main TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. and unhides it for general use.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.81.7 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.81.7

     └──▷ TRY IT
     Run the interactive TUI to analyze a found credential's permissions and scope directly from the main menu.
     copy

     $ trufflehog analyze

     • Adds analyze option to the main TUI menu, making credential analysis discoverable without knowing the hidden subcommand.
     • Unhides the analyze subcommand so it appears in help output and is officially supported.

     2 details in Everything

163. v3.81.6 Aug 6, 2024 · release notes

     TruffleHog v3.81.6 adds a TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. for credential analysis and improves fine-grained GitHub token support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.81.6 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.81.6

     • Adds a terminal UI (TUI) for the analyze command, giving interactive visibility into credential analysis results.
     • Improves fine-grained GitHub personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. support in analysis.
     • Separates SID from token input in the Twilio analyzer for more precise credential analysis.

     3 details in Everything

164. v3.81.1 Aug 2, 2024 · release notes

     TruffleHog v3.81.1 adds credential analyzers for Square and HuggingFace APIs.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.81.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.81.1

     • Adds Analyzers interface for Square — enables automatic analysis of detected Square credentials to determine their validity and permissions.
     • Adds Analyzers interface for HuggingFace — enables automatic analysis of detected HuggingFace tokens to determine their validity and permissions.

     2 details in Everything

165. v3.81.0 Aug 2, 2024 · release notes

     TruffleHog v3.81.0 adds a progress bar to Chunk File Output Reader (CFOR) scans.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.81.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.81.0

166. v3.80.6 Aug 2, 2024 · release notes

     TruffleHog v3.80.6 adds Stripe and Twilio analyze support, a CFOR commit scanner, and parallel gzip decompression.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.80.6 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.80.6

     • Adds analyze interface for Stripe credentials, enabling permission and access-level inspection of discovered Stripe keys.
     • Adds Twilio analyze relationships, surfacing permission context for discovered Twilio secrets.
     • Combines access level into permission value in analyze output for a unified view of credential scope.
     • New CFOR Commit Scanner detects secrets in CFOR commit sources.
     • Leverages pgzip for parallel decompression, improving throughput when scanning compressed archives.

     5 details in Everything

167. 3.80.4 Jul 31, 2024 · release notes

     TruffleHog 3.80.4 introduces analyzer partial implementations for Shopify, Square, Twilio, Slack, and Stripe.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch 3.80.4 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout 3.80.4

     • Adds analyzer partial implementations for Shopify, Square, Twilio, Slack, and Stripe to enable granular credential detection logic
     • Updates the embedded canary ID for internal verification purposes

     2 details in Everything

168. v3.80.3 Jul 29, 2024 · release notes

     TruffleHog v3.80.3 adds GitHub analyzer support, OpenAI project/fine-grained token detection, and always-on default detectors with custom configs.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.80.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.80.3

     • Implements the Analyzer interface for GitHub, enabling credential analysis against GitHub.
     • Supports detection and validation of OpenAI project tokens and fine-grained tokens.
     • Enriches OpenAI analyzer metadata with description and user fields.
     • Includes default detectors automatically when a custom config file specifies additional detectors.

     4 details in Everything

169. v3.80.2 Jul 26, 2024 · release notes

     TruffleHog v3.80.2 adds Twitter v2 and NetSuite detectors plus an Analyze interface for OpenAI keys

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.80.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.80.2

     • Adds Twitter v2 detector to identify leaked Twitter API v2 credentials
     • Adds NetSuite detector to identify leaked NetSuite credentials
     • Implements Analyzer interface for OpenAI detector, enabling deeper key analysis

     3 details in Everything

170. v3.80.0 Jul 17, 2024 · release notes

     TruffleHog v3.80.0 adds HuggingFace scanning and four new secret detectors: Endor Labs, ElevenLabs, Atlassian Token, and an updated LaunchDarkly.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.80.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.80.0

     • New source: scans HuggingFace for exposed secrets.
     • New detector: Endor Labs API key detection.
     • New detector: ElevenLabs API key detection.
     • New detector: Atlassian Token detection.
     • Updates LaunchDarkly detector to use the caller-identity API for more reliable validation.

     +2 more show less

     • Streamlined file handling via BufferedReaderSeeker for improved scanning throughput.
     • Optimizes MIME type detection to reduce memory allocations, enabling faster scans on large corpora.

     7 details in Everything

171. v3.79.0 Jun 26, 2024 · release notes

     Adds Larksuite detector support and targeted scan error reporting in TruffleHog v3.79.0

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.79.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.79.0

     • scanOptions.Bare now controls the GIT_DIR environment variable for git scanning
     • New LarkSuite credential detectors added to the default detection engine

     2 details in Everything

172. v3.78.2 Jun 21, 2024 · release notes

     Trufflehog v3.78.2 adds Twitter Consumer Key and Eraser AI detectors, metrics to the Engine, and false positive retention.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.78.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.78.2

     • Adds twitter_consumer_key detector for identifying Twitter API credentials in scanned secrets
     • Adds eraser_ai detector for identifying Eraser AI-specific secrets
     • Exposes metrics via the scanning Engine for operational observability of secret detection performance

     3 details in Everything

173. v3.78.1 Jun 11, 2024 · release notes

     Trufflehog v3.78.1 adds elasticsearch and Jenkins to the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., a flag to detect TUI runtime, and optimized detector performance.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.78.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.78.1

     └──▷ HOW TO FIND IT
     Select Elasticsearch as a source in the Trufflehog terminal interface.
     📍In the TUI, press s to select sources, then choose Elasticsearch.
     • --tui flag allows scripts to detect if Trufflehog is running inside the terminal UI
     • Elasticsearch support added to the TUI source selection

     2 details in Everything

174. v3.78.0 Jun 4, 2024 · release notes

     TruffleHog v3.78.0 adds Postman and Jenkins sources to TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., updates DefaultFalsePositives

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.78.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.78.0

     • postman source is now supported in the TUI (Terminal User Interface)

     1 detail in Everything

175. v3.77.0 May 28, 2024 · release notes

     New Groq detector, Docker image history scanning support, and user repository scanning.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.77.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.77.0

     • Adds Groq detector for API keys
     • Enables scanning of GitHub user repositories in addition to organizations

     2 details in Everything

176. v3.76.3 May 16, 2024 · release notes

     Adds Postman subcommand to the CLI for scanning API keys and secrets.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.76.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.76.3

     • Adds postman as a recognized sub-command in the Trufflehog CLI

     1 detail in Everything

177. v3.76.1 May 15, 2024 · release notes

     Adds user email and location fields to GitHub detector metadata

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.76.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.76.1

178. v3.76.0 May 14, 2024 · release notes

     Trufflehog v3.76.0 adds Intra42 detector and bearer auth for Docker scans

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.76.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.76.0

     • Adds Intra42 detector to the built-in detection engine
     • Supports bearer authentication for docker scans

     2 details in Everything

179. v3.75.0 May 2, 2024 · release notes

     Trufflehog v3.75.0 adds commit metadata scanning and exposes detector-specific false positive logic via a new API.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.75.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.75.0

180. v3.74.0 Apr 23, 2024 · release notes

     Trufflehog v3.74.0 adds detection for Pagarme API keys, Onfleet API keys, and Slack workflows webhooks.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.74.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.74.0

     • Detects Slack workflows webhook
     • Added onfleet api key detector

     2 details in Everything

181. v3.73.0 Apr 10, 2024 · release notes

     Adds Wiz detector to Trufflehog v3.73.0

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.73.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.73.0

     • Adds Wiz detector for credential scanning

     1 detail in Everything

182. v3.72.0 Apr 3, 2024 · release notes

     Trufflehog v3.72.0 adds JupiterOne and GCP ADC detectors

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.72.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.72.0

     • Adds JupiterOne detector to scan for secrets in JupiterOne integrations.
     • Adds GCP Application Default Credentials detector to identify exposed credentials.

     2 details in Everything

183. v3.71.0 Mar 22, 2024 · release notes

     Adds Postman source support and DockerHub v2 detector to Trufflehog v3.71.0

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.71.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.71.0

     • Trufflehog gains a new postman source for scanning credentials from Postman workspaces.
     • Adds the DockerHub v2 detector, expanding coverage for container registry secrets.

     2 details in Everything

184. v3.70.0 Mar 15, 2024 · release notes

     Adds --results flag to control output directory for scan findings.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.70.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.70.0

     • Update dependency github.com/golang-jwt/jwt/v4 to v5.
     • Update dependency github.com/google/go-github/v57 to v60.
     • Update dependency github.com/aws/aws-sdk-go to v1.50.38.
     • Update dependency github.com/launchdarkly/go-server-sdk/v6 to v7.

     4 details in Everything

185. v3.69.0 Mar 8, 2024 · release notes

     Adds versioned detectors directory structure and canary verification capability to trufflehog v3.69.0

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.69.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.69.0

     • add version to extra data + moving existing versioned detectors into subdirectory format

     1 detail in Everything

186. v3.68.5 Mar 7, 2024 · release notes

     Trufflehog v3.68.5 adds --ignore-aws-s3-buckets flag and redacts secrets in CLI output.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.68.5 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.68.5

     └──▷ TRY IT
     Scan an S3 bucket but exclude sensitive internal buckets from the results.
     copy

     $ trufflehog s3 --ignore-aws-s3-buckets 'internal-prod-bucket,logs-bucket' --json

     • Adds --ignore-aws-s3-buckets flag to the CLI for excluding specific S3 buckets from scans
     • Redacts detected secret values in standard command-line output

     2 details in Everything

187. v3.68.0 Feb 21, 2024 · release notes

     TruffleHog v3.68.0 adds canary token identification without detonation and exposes SourceUnit.Display method.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.68.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.68.0

     • Identify canary tokens without triggering detonation, reducing noise in scans
     • Exposes Display method on SourceUnit and Kind members within the CommonSourceUnit interface

     2 details in Everything

188. v3.67.6 Feb 13, 2024 · release notes

     TruffleHog v3.67.6 adds a new CLI flag to write job reports to disk and implements SourceUnitEnumChunker for GitLab.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.67.6 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.67.6

     • Adds --results-path flag to write job reports to disk
     • Implements SourceUnitEnumChunker for GitLab source unit processing

     2 details in Everything

189. v3.67.5 Feb 8, 2024 · release notes

     Trufflehog v3.67.5 adds GHA CLI version pinning via environment variable, multiple domains for Forager, and buffered file writer metrics.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.67.5 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.67.5

     └──▷ USE IT
     Pin Trufflehog to v3.67.5 in your GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflow to ensure consistent scanning results regardless of upstream updates.
     text copy

     env: TRUFFLEHOG_GITHUB_ACTION_VERSION=v3.67.5

     • Allows pinning the Trufflehog CLI version in GitHub Actions by setting TRUFFLEHOG_GITHUB_ACTION_VERSION instead of relying on the default latest release
     • Supports specifying multiple domains for the Forager source to scan across different organizational boundaries in a single run
     • Exposes buffered file writer metrics (e.g., writes, flushes) to help monitor scanning performance and I/O behavior

     3 details in Everything

190. v3.67.3 Feb 6, 2024 · release notes

     Trufflehog v3.67.3 adds case-insensitive SkipFile, disables wiki scanning by default, and tightens OpsGenie verification.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.67.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.67.3

     └──▷ USE IT
     Ignore files regardless of case in .gitignore-style skip lists.
     shell copy

     trufflehog git https://github.com/example/repo --skip-file "*.LOG"

     • --skip-file now matches paths case-insensitively for filtering scanned files
     • Disables GitHub wiki scanning by default to reduce noise and improve performance
     • OpsGenie detector verification logic tightened to reduce false positives

     3 details in Everything

191. v3.67.1 Feb 4, 2024 · release notes

     Trufflehog v3.67.1 adds concurrent filesystem scanning for faster local scans

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.67.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.67.1

     └──▷ USE IT
     Speed up local secret scans by processing multiple files concurrently instead of sequentially.
     shell copy

     trufflehog filesystem /path/to/project --concurrent=4

     • Enables --concurrent flag on the filesystem source to scan directories in parallel

     1 detail in Everything

192. v3.66.3 Jan 31, 2024 · release notes

     Adds --git-wiki flag to scan GitHub wikis and updates Fly.io protocol buffers

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.66.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.66.3

     • Updates Fly.io proto definitions for improved credential detection in Fly.io infrastructure

     1 detail in Everything

193. v3.66.2 Jan 30, 2024 · release notes

     Adds temporary file diff scanning and updates the template detector

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.66.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.66.2

     • Updates the template detector to include tristate verification logic.

     1 detail in Everything

194. v3.66.0 Jan 29, 2024 · release notes

     Adds Azure Function Key and Search Admin/Query Key detectors to Trufflehog.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.66.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.66.0

     • azurefunctionkey detector detects Azure Function keys
     • azuresearchadminkey detector detects Azure Search admin keys
     • azuresearchquerykey detector detects Azure Search query keys

     3 details in Everything

195. v3.65.0 Jan 26, 2024 · release notes

     New detectors for Azure DevOps PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., Google OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. token, and Yelp; filesystem walk enumeration

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.65.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.65.0

     • Adds azuredevopspersonalaccesstoken detector to scan for Azure DevOps Personal Access Tokens
     • Adds googleoauth2token detector to scan for Google OAuth2 tokens
     • Enables filesystem source enumeration to walk directories during scanning

     3 details in Everything

196. v3.64.0 Jan 23, 2024 · release notes

     Adds Prometheus hook execution time metrics to TruffleHog v3.64.0

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.64.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.64.0

197. v3.63.9 Jan 14, 2024 · release notes

     Adds --verify to restrict verification to custom verifiers and supports path files for filesystem include/exclude patterns

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.63.9 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.63.9

     └──▷ USE IT
     Scan only using custom verifiers defined in your pipeline, ignoring Truffle Security's default checks.
     shell copy

     trufflehog filesystem /data --custom-verifier-only

     Define which paths to include or exclude for large codebases using dedicated files.
     shell copy

     trufflehog filesystem /repo --include-paths ./paths/include.txt --exclude-paths ./paths/exclude.txt

     • Provides --custom-verifier-only flag to skip default credential verification and only use user-provided custom verifiers
     • Adds support for file-based include and exclude paths in filesystem scans via new config keys

     2 details in Everything

198. v3.63.7 Dec 23, 2023 · release notes

     TruffleHog v3.63.7 adds --skip-archives flag to skip archive scanning and skips all binaries by default.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.63.7 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.63.7

     • Binaries are now skipped by default (previously they were scanned)

     1 detail in Everything

199. v3.63.5 Dec 19, 2023 · release notes

     Adds configurable binary skipping and secretID to chunks for more control over scanned data

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.63.5 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.63.5

     • Chunks now include a new secretID field in their output payload

     1 detail in Everything

200. v3.63.3 Dec 14, 2023 · release notes

     Adds GitLab metrics and removes go-git dependency for Trufflehog v3.63.3

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.63.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.63.3

     • [feat] - add metrics for gitlab

     1 detail in Everything

201. v3.63.2 Dec 5, 2023 · release notes

     Trufflehog v3.63.2 adds automatic redaction for verification errors and auto-scanning of GitHub issue/PR titles.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.63.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.63.2

     • --auto-redact flag added to automatically redact sensitive data in output when a verification error occurs, preventing accidental exposure of secrets that could not be validated.
     • Trufflehog now scans GitHub Issue and Pull Request titles for secrets by default, expanding coverage beyond commit messages and file contents.

     2 details in Everything

202. v3.63.0 Nov 17, 2023 · release notes

     Adds new detectors for Replicate, Ngrok, Overloop, and Grafana; supports user:pass@host in PostgreSQL JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. scanning.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.63.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.63.0

     • Supports multiple detectors per match (7a156330) to reduce duplicate findings when a credential matches against several configured sources.

     1 detail in Everything

203. v3.62.1 Oct 31, 2023 · release notes

     Adds support for multiple custom detectors in TruffleHog

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.62.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.62.1

     • Enables configuring and loading multiple custom detector definitions simultaneously

     1 detail in Everything

204. v3.62.0 Oct 30, 2023 · release notes

     Trufflehog v3.62.0 adds TravisCI source and new detectors for LemonSqueezy, Budibase, Deno Deploy, Stripo, and Reply.io.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.62.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.62.0

     • Adds travis-ci as a supported source
     • Adds LemonSqueezy API token detector
     • Adds Budibase API token detector
     • Adds DenoDeploy detector
     • Adds Stripo API token detector

     +1 more show less

     • Adds Reply.io API token detector

     6 details in Everything

205. v3.61.0 Oct 27, 2023 · release notes

     New detectors for BetterStack, ZeroTier, AppOptics, Metabase, and Coinbase Wallet-as-a-Service

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.61.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.61.0

     • Adds betterstack detector to scan for BetterStack API tokens
     • Adds zerotier detector to scan for ZeroTier API tokens
     • Adds appoptics detector to scan for AppOptics API tokens
     • Adds metabase_session_secret detector to scan for Metabase Session Secrets
     • Adds coinbase_wallet_as_a_service detector to scan for Coinbase Wallet-as-a-Service credentials

     5 details in Everything

206. v3.60.4 Oct 26, 2023 · release notes

     Trufflehog v3.60.4 adds detectors for Loggly, OpenVPN API, Portainer, and Vagrant Cloud Access Token.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.60.4 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.60.4

     • Adds Loggly detector to identify Loggly credentials in scanned sources
     • Adds OpenVPN API detector to identify OpenVPN-related secrets
     • Adds Portainer detector to identify Portainer credentials
     • Adds Vagrant Cloud Access Token detector to identify Vagrant tokens

     4 details in Everything

207. v3.60.3 Oct 25, 2023 · release notes

     TruffleHog v3.60.3 adds a new PortainerToken detector to cover additional secrets coverage

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.60.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.60.3

     • Adds PortainerToken detector for scanning Portainer API tokens

     1 detail in Everything

208. v3.60.2 Oct 24, 2023 · release notes

     Adds generic glob filters and UnitHook implementations for TruffleHog.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.60.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.60.2

     • Add generic glob filter to allow filtering secrets by file path patterns
     • Export ChunkError fields and add ErrorsFor convenience method for programmatic error handling in the ChunkError struct
     • Filter unique detectors by keywords in chunk as a new deduplication strategy
     • Adds UnitHook and NoopHook implementations for hooking logic
     • Adds support for Voiceflow, Privacy.com, ipinfo.io, IP2Location, InstaMojo, and SuperNotes secret detectors

     5 details in Everything

209. v3.60.1 Oct 18, 2023 · release notes

     Adds -h flag for help documentation in TruffleHog v3.60.1

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.60.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.60.1

     └──▷ TRY IT
     Display the help message with available commands and options.
     copy

     $ trufflehog -h

210. v3.60.0 Oct 16, 2023 · release notes

     TruffleHog v3.60.0 adds new detectors and entropy-based result filtering

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.60.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.60.0

     • Adds support for ramp.com client id & secret detection
     • Adds anthropic api key detector
     • Adds Klaviyo API Secret detector
     • Adds Cody gateway token detection code
     • Adds option to filter unverified results using Shannon entropy

     +3 more show less

     • Adds tristate verification for Postman
     • Supports insecure TLS connections for Jira and Jenkins sources
     • Adds include and ignore list configuration for Artifactory sources

     8 details in Everything

211. v3.59.0 Oct 2, 2023 · release notes

     Adds detectors for Azure Storage and PlanetScale credentials; updates PagerDuty API key verification.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.59.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.59.0

     └──▷ USE IT
     Scan a repo for new Azure Storage and PlanetScale credential types using the JSON format.
     shell copy

     trufflehog git https://github.com/example/repo --json | jq -r 'select(.DetectorType == "azure_storage" or .DetectorType == "planetscale_password")'

     • --json output now includes new azure_storage detector detection results
     • --json output now includes new planetscale_password and planetscale_api_key detector detection results
     • pagerdutyapikey detector supports tri-state verification (known good, known bad, unknown)

     3 details in Everything

212. v3.58.0 Oct 2, 2023 · release notes

     TruffleHog v3.58 adds Web3Web3A loosely defined model for a decentralized internet built on public blockchains, where applications run via smart contracts rather than centralized servers, giving cyber tools trustless, permissionless data and transaction layers. Storage detector, PR/issue body scanning, and GitHub partial scans.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.58.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.58.0

     • Adds Web3 Storage detector to identify secrets in Web3.Storage credentials
     • Enables scanning of GitHub Pull Request and Issue bodies via new flags
     • Adds support for GitHub repository partial (shallow) scanning

     3 details in Everything

213. v3.57.0 Sep 23, 2023 · release notes

     TruffleHog v3.57.0 adds dynamic concurrency scaling for sources and a SetProgressOngoing API

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.57.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.57.0

     • Add ability to dynamically scale concurrently running sources allows adjusting source concurrency at runtime without restarting.
     • Adds SetProgressOngoing function in the public API for library users.

     2 details in Everything

214. v3.56.0 Sep 14, 2023 · release notes

     Adds BuildPulse source support and validates GitLab sources

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.56.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.56.0

     • Adds buildpulse as a supported source type for scanning configuration secrets
     • Implements validation for GitLab source connections to fail fast on misconfiguration

     2 details in Everything

215. v3.55.1 Sep 11, 2023 · release notes

     Adds log verbosity control

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.55.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.55.1

     └──▷ USE IT
     Increase log detail to debug why a specific secret source is failing or producing unexpected results.
     shell copy

     trufflehog git --log-verbosity=debug

     • Enables finer-grained control of Trufflehog's logging output via the new --log-verbosity flag

     1 detail in Everything

216. v3.55.0 Sep 11, 2023 · release notes

     Trufflehog v3.55.0 adds tri-state verification for Slack and improves private key detector

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.55.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.55.0

     • Adds tri-state verification (e.g., unknown/true/false) to the Slack detector for non-webhook credentials.
     • Improves private key detection accuracy and coverage.

     2 details in Everything

217. v3.54.4 Sep 8, 2023 · release notes

     Adds Tailscale detector and tri-state verification for Sendbird, Jira, and Sendgrid sources

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.54.4 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.54.4

     • Adds Tailscale detector to identify Tailscale credentials
     • Updates Sendbird, JiraToken, JiraTokenV2, and Sendgrid detectors to use tri-state verification

     2 details in Everything

218. v3.54.2 Sep 1, 2023 · release notes

     Adds Sourcegraph token detection and tri-state verification for Twilio and Slack detectors

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.54.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.54.2

     • add tri-state verification for twilio detector
     • update slack webhook with tri-state verification

     2 details in Everything

219. v3.54.1 Aug 30, 2023 · release notes

     TruffleHog v3.54.1 adds SourceManager.AvailableCapacity() method and includes jobID in chunk objects

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.54.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.54.1

     └──▷ USE IT
     Check source manager capacity programmatically in Go code before scanning.
     go copy

     capacity := sourceManager.AvailableCapacity()
     if capacity > 0 {
         // Proceed with scan
     }

     • Exposes AvailableCapacity method on SourceManager to check resource availability

     1 detail in Everything

220. v3.54.0 Aug 28, 2023 · release notes

     TruffleHog v3.54.0 adds Snowflake detector, azure git support and job cancellation.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.54.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.54.0

     • Adds snowflake detector to identify secrets in Snowflake environments
     • Supports Azure Git URLs as a source for scanning
     • Allows cancelling a scan run via methods on the JobProgressRef object

     3 details in Everything

221. v3.53.0 Aug 23, 2023 · release notes

     Adds GitHub config validation, S3 role assumption, tri-state SQLServer detection, and GitHub metrics to trufflehog v3.53.0.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.53.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.53.0

     • thog CLI support for validating GitHub configuration files via config validate
     • Role assumption support for the S3 source detector
     • Tri-state verification logic for the SQLServer detector
     • Rate limit and consumption metrics collection for GitHub sources

     4 details in Everything

222. v3.51.0 Aug 17, 2023 · release notes

     Adds ScanChunk API to inject Chunks into SourceManager's channel

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.51.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.51.0

223. v3.50.0 Aug 16, 2023 · release notes

     Trufflehog v3.50.0 adds Salesforce detector and optimized archive handling.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.50.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.50.0

     • Adds salesforce detector to uncover secrets in Salesforce environments

     1 detail in Everything

224. v3.49.0 Aug 15, 2023 · release notes

     TruffleHog v3.49.0 adds Docker scanning by digest and Hugging Face detector

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.49.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.49.0

     • Docker scanning by digest enables TruffleHog to scan container images identified by their SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. digest rather than just tags.
     • Adds a huggingface detector to scan for secrets in Hugging Face model repositories and configuration files.

     2 details in Everything

225. v3.47.0 Aug 9, 2023 · release notes

     TruffleHog v3.47.0 adds bare repo support, a new terminal UI, and improved detection capabilities.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.47.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.47.0

     • New detection logic for API keys that lack app keys (e.g., Stripe no-app-key format)
     • Improved log output now includes scan duration and number of commits scanned

     2 details in Everything

226. v3.46.2 Aug 1, 2023 · release notes

     Adds --debug.disable-overseer hidden flag and tri-state verification for MongoDB detector

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.46.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.46.2

     • Implements tri-state verification logic in the existing MongoDB detector.

     1 detail in Everything

227. v3.45.3 Jul 28, 2023 · release notes

     TruffleHog v3.45.3 adds Google Drive file path metadata and initial JobReport implementation

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.45.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.45.3

     • Adds path field to the Google Drive proto for source location metadata
     • Introduces initial implementation of JobReport with SourceManager usage

     2 details in Everything

228. v3.45.2 Jul 27, 2023 · release notes

     Trufflehog v3.45.2 adds Azure Repos support and CosmosDB key detection.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.45.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.45.2

     • Adds Azure Repos source support via new protobuf definitions
     • Detects CosmosDB access keys in MongoDB sources

     2 details in Everything

229. v3.45.0 Jul 25, 2023 · release notes

     Adds built-in detectors for Envoy API keys, Couchbase, Docker Hub, and Web Keys

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.45.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.45.0

     • envoy detector added to the default scan list.
     • couchbase detector enabled by default in TruffleHog.
     • dockerhub scanner available out-of-the-box.
     • thog enterprise web keys detector integrated into the codebase.

     4 details in Everything

230. v3.44.0 Jul 12, 2023 · release notes

     TruffleHog v3.44.0 adds GitHub PR/issue comment scanning and SourceUnit interface for extensibility.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.44.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.44.0

     • Defines a new SourceUnit enumeration interface to enable custom source implementations

     1 detail in Everything

231. v3.43.0 Jul 5, 2023 · release notes

     Adds trufflehog:ignore tag feature for controlling which secrets are scanned

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.43.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.43.0

     • Introduces the trufflehog:ignore tag feature to allow users to mark specific secrets or credentials that should be excluded from scan results

     1 detail in Everything

232. v3.42.0 Jun 28, 2023 · release notes

     Adds Couchbase and Opsgenie detectors; improves chunk error handling

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.42.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.42.0

     • Adds couchbase detector for new credential types
     • Adds opsgenie detector for new credential types
     • Improves chunk source error propagation with non-zero exit code

     3 details in Everything

233. v3.41.0 Jun 22, 2023 · release notes

     Adds --docker CLI flag to scan local Docker images for secrets

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.41.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.41.0

     • Enables scanning of local Docker container images for embedded secrets using the new --docker flag
     • Allows custom names for built-in detectors via the Name field in the detector configuration struct

     2 details in Everything

234. v3.40.0 Jun 14, 2023 · release notes

     Adds native DocuSign detector and improves SQL Server URI redaction

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.40.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.40.0

     • Adds DocuSign detector to the default scan set
     • Improves SQL Server result quality with updated deduplication and comprehensive URI redaction

     2 details in Everything

235. v3.37.0 Jun 1, 2023 · release notes

     Trufflehog v3.37.0 exposes a data field in ResultsMetadata and improves source initialization errors.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.37.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.37.0

     └──▷ USE IT
     Access the raw metadata payload attached to a finding when using Trufflehog as a library.
     go copy

     // Assuming 'res' is a trufflehog.Result from Scan
     metadata := res.Results[0].SourceMetadata.Data
     // Access specific fields based on your detector's schema

     • Adds the Data member to the ResultsMetadata struct for programmatic access to metadata payloads
     • Surfaces missing git as an explicit error during source initialization instead of failing silently or ambiguously

     2 details in Everything

236. v3.35.0 May 18, 2023 · release notes

     Trufflehog v3.35.0 adds Pulumi cloud Access tokenAccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. detector, Buildkitev2 detector, GitHub basic auth support, and extra data to plain output.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.35.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.35.0

     • Adds Buildkitev2 detector for newer tokens
     • Enables scanning with GitHub basic authentication
     • Includes extra and structured data in the plain text output format

     3 details in Everything

237. v3.34.0 May 9, 2023 · release notes

     Trufflehog v3.34.0 adds --max-s3-object-size, TinesWebhook detector, EndpointCustomizer, and line numbers for filesystem sources.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.34.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.34.0

     • Adds --max-objects flag to limit the size of objects scanned in S3 bucket scans
     • Adds support for scanning Tines Webhooks via a new tineswebhook detector
     • Introduces EndpointCustomizer interface allowing custom endpoint configuration for sources
     • Supports line numbers in the filesystem source output

     4 details in Everything

238. v3.33.0 Apr 26, 2023 · release notes

     Trufflehog v3.33.0 adds Percy.io detector and updates sqlserver detection

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.33.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.33.0

     • Adds a new detector for percy.io credentials
     • Improves SQL Server credential detection accuracy

     2 details in Everything

239. v3.32.1 Apr 21, 2023 · release notes

     TruffleHog v3.32.1 adds RawV2 results to JSON output

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.32.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.32.1

     └──▷ USE IT
     Extract raw secret data in the newer RawV2 structure from TruffleHog scan results for downstream processing.
     shell copy

     trufflehog filesystem ./repo --json | jq '.results[]?.RawV2'

240. v3.32.0 Apr 20, 2023 · release notes

     Adds configurable detectors via CLI, --detectors include/exclude lists and a UTF-16 decoder for scanning.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.32.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.32.0

     • Adds --detectors flag to allow users to specify which detectors to include or exclude from a scan via comma-separated list
     • Adds a new utf16 decoder for decoding UTF-16 encoded credentials during scanning

     2 details in Everything

241. v3.31.3 Apr 3, 2023 · release notes

     Trufflehog v3.31.3 adds --actions-config CLI flag and custom verifier support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.31.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.31.3

     • Add --actions-config CLI switch to configure Trufflehog Actions integration directly from the command line
     • Allow passing a custom verifier implementation via the new verifier.New() interface for credential validation
     • Include DetectorName in the Result struct output to identify which detector found a secret
     • Add oauth2 as an authentication type for Teams integrations in Trufflehog Enterprise
     • Switch Google Cloud Storage (GCS) source to use OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. HTTP client for authentication

     5 details in Everything

242. v3.31.0 Mar 28, 2023 · release notes

     Adds exclude globs for git log filtering and GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. CI annotation output.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.31.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.31.0

     • Supports exclude globs at the git log level to control which commits are scanned
     • Adds GitHub Actions output for CI integration

     2 details in Everything

243. v3.30.0 Mar 27, 2023 · release notes

     Adds new OpenAI API Tokens detector and enhanced GCS authentication

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.30.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.30.0

     • Adds openai-api-tokens detector to identify OpenAI API keys in scanned content
     • Adds unauthenticated Google Cloud Storage (GCS) source type support for scanning public buckets without credentials
     • Adds OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. credential support for GCS sources allowing standard service account or user account authentication

     3 details in Everything

244. v3.29.0 Mar 8, 2023 · release notes

     Adds GCS scanning integration to allow secrets detection in Google Cloud Storage buckets.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.29.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.29.0

     • Add gcs scanning integration

     1 detail in Everything

245. v3.28.4 Feb 28, 2023 · release notes

     Adds custom regex parallel verification and a pre-commit configuration file

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.28.4 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.28.4

     └──▷ TRY IT
     Scan a repository using custom regexes with parallel verification for better performance.
     copy

     $ trufflehog filesystem ./my-project --custom-regex-parallel=true

     Configure a pre-commit hook to run trufflehog before each commit.
     copy

     $ # Add to .pre-commit-config.yaml:
     repos:
       - repo: https://github.com/trufflesecurity/trufflehog
         rev: v3.28.4
         hooks:
           - id: trufflehog

     • Enables parallel verification of custom regexes via the new --custom-regex-parallel flag to speed up scans.
     • Includes a trufflehog.yml example for use with pre-commit hooks in .pre-commit-config.yaml.

     2 details in Everything

246. v3.28.3 Feb 28, 2023 · release notes

     Adds filesystem source file scanning and --include-detectors / --exclude-detectors flags

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.28.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.28.3

     • Supports scanning individual files directly in the filesystem source, enabling targeted detection without repository-wide scans
     • Adds --include-detectors flag to restrict the scan to specific detector types
     • Adds --exclude-detectors flag to explicitly skip specific detector types

     3 details in Everything

247. v3.28.0 Feb 22, 2023 · release notes

     Trufflehog v3.28.0 adds GitHub include/exclude filters, Confluence options, and Google Drive scanner protos

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.28.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.28.0

     • Introduces initial protobuf definitions for the experimental Google Drive scanner subsystem

     1 detail in Everything

248. v3.27.0 Feb 11, 2023 · release notes

     TruffleHog v3.27.0 adds max_commit_size and configurable archive handling via new config keys

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.27.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.27.0

     • Adds max_commit_size configuration option to limit the size of git commits processed during scanning.
     • Introduces archive_handler config key to allow configuring how archive files are handled during scans.

     2 details in Everything

249. v3.26.0 Jan 27, 2023 · release notes

     Adds --exclude-files and --include-files CLI flags to filter scanned paths via glob patterns

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.26.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.26.0

     • --exclude-files and --include-files CLI flags allow glob-based exclusion and inclusion of filesystem paths during scanning

     1 detail in Everything

250. v3.25.3 Jan 25, 2023 · release notes

     Adds concurrency to CircleCI source and location metadata for Teams source

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.25.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.25.3

     • Adds concurrency support for the CircleCI source to improve scanning performance

     1 detail in Everything

251. v3.23.0 Jan 6, 2023 · release notes

     TruffleHog v3.23.0 adds a new CircleCI source to enable secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. within Circle CI pipelines

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.23.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.23.0

     • --source-type=circleci or equivalent configuration option enables the tool to connect to and scan Circle CI for leaked secrets.

     1 detail in Everything

252. v3.21.0 Dec 21, 2022 · release notes

     TruffleHog v3.21.0 adds custom regex detectors and configuration parsing via the engine API.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.21.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.21.0

     • Adds configuration parsing capabilities to the engine, allowing external YAML/JSON configs to define new detectors.
     • Releases documentation for writing custom regex-based detectors.

     2 details in Everything

253. v3.20.0 Dec 16, 2022 · release notes

     Trufflehog v3.20.0 introduces CustomRegex detector, glob patterns for includes, Todoist REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. v2 support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.20.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.20.0

     └──▷ USE IT
     Scan only specific file types using glob patterns to reduce noise and speed up scanning.
     shell copy

     trufflehog filesystem --include 'src/**/*.{js,ts}' .

     • Implements CustomRegex detector allowing users to define and scan for custom regex patterns.
     • Allow using a glob pattern for the --include list (e.g., src/**/*.go).
     • Uses Todoist's REST API v2 for detecting secrets in Todoist integrations.

     3 details in Everything

254. v3.19.0 Dec 9, 2022 · release notes

     TruffleHog v3.19.0 adds --org flag scoping, globbing for ignored repos, and CustomRegex validation

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.19.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.19.0

     └──▷ USE IT
     Scan only a specific GitHub org to avoid scanning personal or unrelated private repos.
     shell copy

     trufflehog git https://github.com/my-org --org my-org

     Exclude directories matching specific glob patterns from scanning to speed up large repos.
     shell copy

     trufflehog filesystem ./src --ignore-repos "*node_modules*,*vendor/*"

     • --org flag now restricts scans to the specified organization and its related repositories only, rather than scanning all accessible repos.
     • --ignore-repos now supports glob patterns (e.g., *private*) for exclusion filtering.
     • CustomRegex inputs are now validated at load time, preventing invalid regex from crashing the scan later.

     3 details in Everything

255. v3.18.0 Nov 22, 2022 · release notes

     Trufflehog v3.18.0 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. and RabbitMQ detectors, --exclude-paths for GitLab, and custom detector config parsing.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.18.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.18.0

     └──▷ USE IT
     Scan a GitLab repo while ignoring specific directory paths that contain false positives or unnecessary data.
     shell copy

     trufflehog gitlab --exclude-paths='node_modules,dist'

     Configure Trufflehog to skip detection of specific public key IDs that are known to be false positives.
     json copy

     {
       "detectors": [
         {
           "type": "ldap",
           "skip_keys": ["<key_id>"]
         }
       ]
     }

     Enable detection of secrets within RabbitMQ messaging queues.
     shell copy

     trufflehog rabbitmq

     • Adds support for the --exclude-paths flag to skip specific paths during GitLab scanning
     • Adds a new LDAP detector for discovering secrets in LDAP sources
     • Adds a new RabbitMQ detector for discovering secrets in RabbitMQ sources
     • Enables skipping of particular key IDs via configuration
     • Adds custom detectors configuration parsing capability

     5 details in Everything

256. v3.16.4 Nov 9, 2022 · release notes

     Adds Shopify detector and skip TLS verification option for Confluence integration

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.16.4 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.16.4

     • New shopify detector added to scan for credentials

     1 detail in Everything

257. v3.16.2 Nov 1, 2022 · release notes

     New --results=all flag to return all unverified findings in CLI output

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.16.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.16.2

258. v3.16.1 Oct 28, 2022 · release notes

     Adds SSH repo format support and a bytes counter to scans.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.16.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.16.1

     • Supports scanning repositories stored in the common SSH repository format (.git wrapped for SSH access).

     1 detail in Everything

259. v3.16.0 Oct 26, 2022 · release notes

     Adds SqlServer connection string detector, fine-grained GitHub token support, and new extra data fields for Razorpay and Fastly.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.16.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.16.0

     • proposal: SqlServer connection string detector to detect Microsoft SQL Server credentials in codebases.
     • support github fine grained tokens to detect newer GitHub authentication formats along with extra data extraction.

     2 details in Everything

260. v3.15.0 Oct 24, 2022 · release notes

     Adds GitHub ignore repo list support and new npm detector

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.15.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.15.0

     • Add ability to skip scanning Github repos via the ignore_repo_list field in the GitHub protocol config
     • Added npm detector for credential scanning

     2 details in Everything

261. v3.14.0 Oct 5, 2022 · release notes

     Trufflehog v3.14.0 adds JIRA token auth, DigitalOceanV2 detector, and Git SSH config option

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.14.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.14.0

     • Adds --jira-token CLI flag to authenticate with JIRA using a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. instead of basic auth.
     • Introduces a new digitaloceanv2 detector that scans for DigitalOcean API tokens using v2 signature logic.
     • Adds the --git-ssh-config-file option to specify a custom SSH config file when scanning Git repositories.

     3 details in Everything

262. v3.13.0 Sep 26, 2022 · release notes

     Trufflehog v3.13.0 adds a new Gemini detector and better GitHub Gist error handling.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.13.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.13.0

     • Adds the Gemini detector to enable scanning for Google Gemini secrets

     1 detail in Everything

263. v3.12.0 Sep 21, 2022 · release notes

     Adds Nvidia NGC detector and JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. verification for select drivers

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.12.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.12.0

264. v3.10.4 Sep 19, 2022 · release notes

     Trufflehog v3.10.4 adds a MongoDB detector and enriches Slack metadata with visibility and location fields.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.10.4 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.10.4

     • Adds MongoDB detector to identify secrets in MongoDB connection strings
     • Adds visibility field to the Slack metadata proto message
     • Adds location field to Slack and Confluence metadata

     3 details in Everything

265. v3.10.0 Aug 30, 2022 · release notes

     TruffleHog v3.10.0 adds env var secret inputs, independent log level controls, and 27 new detectors.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.10.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.10.0

     └──▷ USE IT
     Set the main application log verbosity separately from detector debug logs to reduce noise.
     shell copy

     trufflehog filesystem . --log-level info --json-log-level debug

     • Adds support for passing secrets via environment variables to allow dynamic credential injection during scans
     • Implements independent log level controls (--log-level, --json-log-level) to decouple application logs from detector debug output
     • Adds 27 new detectors for common secret sources

     3 details in Everything

266. v3.9.0 Aug 25, 2022 · release notes

     Trufflehog v3.9.0 adds 26 new credential detectors for services like Honeycomb, Scalr, and TransferWise.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.9.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.9.0

     • Adds honeycomb detector to scan for Honeycomb API credentials
     • Adds scalr detector to scan for Scalr workspace tokens
     • Adds websitepulse detector to scan for WebsitePulse keys
     • Adds tokeet detector to scan for Tokeet authentication data
     • Adds salesmate detector to scan for Salesmate API credentials

     +21 more show less

     • Adds kanbantool detector to scan for KanbanTool tokens
     • Adds demio detector to scan for Demio meeting platform keys
     • Adds heatmapapi detector to scan for HeatmapAPI credentials
     • Adds getresponse detector to scan for GetResponse API keys
     • Adds codeclimate detector to scan for CodeClimate integration tokens
     • Adds flightlabs detector to scan for FlightLabs credentials
     • Adds prodpad detector to scan for Prodpad workspace secrets
     • Adds lemlist detector to scan for Lemlist API keys
     • Adds formsite detector to scan for FormSite form submission tokens
     • Adds docparser detector to scan for DocParser account credentials
     • Adds parseur detector to scan for Parseur extraction rules secrets
     • Adds ecostruxureit detector to scan for EcoStruxure IT credentials
     • Adds transferwise detector to scan for TransferWise API keys
     • Adds holistic detector to scan for Holistic AI platform credentials
     • Adds twist detector to scan for Twist team communication tokens
     • Adds monkeylearn detector to scan for MonkeyLearn API credentials
     • Adds gtmetrix detector to scan for GTmetrix performance monitoring keys
     • Adds duply detector to scan for Duply sync application secrets
     • Adds braintreepayments detector to scan for Braintree payment gateway credentials
     • Adds apilayer detector to scan for APILayer currency or other API keys
     • Adds appointed detector to scan for Appointed scheduling platform tokens

     26 details in Everything

267. v3.8.0 Aug 24, 2022 · release notes

     Trufflehog v3.8.0 adds support for scanning binary files and SSH URIs in git sources.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.8.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.8.0

     • Support scanning binary files in git sources allows the scanner to inspect binary content within git repositories, whereas previous versions skipped them.
     • Added support for SSH URIs enables the tool to pull secrets directly from git repositories accessed via ssh:// protocol without local checkout.

     2 details in Everything

268. v3.6.9 Jul 20, 2022 · release notes

     Trufflehog v3.6.9 adds HTTP protocol support for GitLab and a SlackTokens credential option.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.6.9 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.6.9

     • http protocol is now supported for GitLab repositories
     • SlackTokens option added for Slack credentials

     2 details in Everything

269. v3.6.1 May 25, 2022 · release notes

     Trufflehog v3.6.1 adds Codemagic detector support and shallow clone optimization.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.6.1 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.6.1

     • Adds codemagic to the list of supported detectors for credential scanning
     • Implements shallow cloning when the --since-commit flag is provided to improve scan performance

     2 details in Everything

270. v3.6.0 May 24, 2022 · release notes

     TruffleHog v3.6.0 adds over 20 new secret detectors including Alibaba, Postbacks, and Zipcodebase.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.6.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.6.0

     • Adds support for the Alibaba detector, now utilizing the Go standard library.
     • Adds a new postbacks secret detector.
     • Adds a new zipcodebase secret detector.
     • Adds a new zenrows secret detector.
     • Adds a new tefter secret detector.

     +13 more show less

     • Adds a new diggernaut secret detector.
     • Adds a new convertapi secret detector.
     • Adds a new collect2 secret detector.
     • Adds a new cloudconvert secret detector.
     • Adds a new instabot secret detector.
     • Adds a new uclassify secret detector.
     • Adds a new speechtextai secret detector.
     • Adds a new vbout secret detector.
     • Adds a new pollsapi secret detector.
     • Adds a new databox secret detector.
     • Adds a new simfin secret detector.
     • Adds a new besnappy secret detector.
     • Enhances the existing amplitude detector coverage.

     18 details in Everything

271. v3.5.0 May 18, 2022 · release notes

     TruffleHog v3.5.0 adds new secret detectors for Twitch, InterSeller, TicketTailor, Rentman, OneSignal, BulkSMS, and Stormboard.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.5.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.5.0

     • Added a Twitch detector to detect Twitch API credentials in codebases
     • Added an InterSeller detector to identify InterSeller secrets
     • Added a TicketTailor detector to scan for TicketTailor tokens
     • Added a Rentman detector to find Rentman API keys
     • Added a OneSignal detector to detect OneSignal application IDs and master keys

     +2 more show less

     • Added a BulkSMS detector to identify BulkSMS credentials
     • Added a Stormboard scanner to detect Stormboard secrets

     7 details in Everything

272. v3.4.2 May 3, 2022 · release notes

     Adds new scan sources (ZulipChat, Mux, Sportradar, UptimeRobot, Wit, FormCraft, Reachmail, IEX APIs, ChartMogul, Paperform, StatusCake, Detectify, Gumroad, Disqus)

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.4.2 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.4.2

     • Adds zulipchat scanner for ZulipChat API credentials
     • Adds mux scanner for Mux API keys
     • Adds sportradar scanner for Sportradar API credentials
     • Adds uptimerobot scanner for UptimeRobot API keys
     • Adds wit scanner for Wit.ai API keys

     +9 more show less

     • Adds formcraft scanner for FormCraft API credentials
     • Adds reachmail scanner for ReachMail API keys
     • Adds iexapis scanner for IEX Cloud API tokens
     • Adds chartmogul scanner for ChartMogul API keys
     • Adds paperform scanner for Paperform API credentials
     • Adds statuscake scanner for StatusCake API keys
     • Adds detectify scanner for Detectify API credentials
     • Adds gumroad scanner for Gumroad API tokens
     • Adds disqus scanner for Disqus API keys

     14 details in Everything

273. v3.4.0 Apr 22, 2022 · release notes

     Trufflehog v3.4.0 adds Fibery, Typetalk, and 12 other new detectors plus unverified secret reporting

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.4.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.4.0

     • Adds fibery detector to scan for Fibery API credentials.
     • Adds typetalk detector to scan for Typetalk API credentials.
     • Adds voodoosms detector to scan for VoodooSMS API credentials.
     • Adds flowdock detector to scan for Flowdock API credentials.
     • Adds flowdash detector to scan for Flowdash API credentials.

     +22 more show less

     • Adds cloudsmith detector to scan for Cloudsmith API credentials.
     • Adds packagecloud detector to scan for PackageCloud API credentials.
     • Adds parsehub detector to scan for ParseHub API credentials.
     • Adds aha detector to scan for Aha.io API credentials.
     • Adds podio detector to scan for Podio API credentials.
     • Adds atera detector to scan for Atera API credentials.
     • Adds yelp detector to scan for Yelp API credentials.
     • Adds lunchmoney detector to scan for LunchMoney API credentials.
     • Adds rocketset detector to scan for RocketSet API credentials.
     • Adds recharge_payments detector to scan for Recharge Payments API credentials.
     • Adds pinata detector to scan for Pinata (IPFSIPFSA peer-to-peer, content-addressed distributed file system where files are identified by their cryptographic hash rather than location, letting cyber tools store or retrieve data without relying on a central server.) API credentials.
     • Adds testingbot detector to scan for TestingBot API credentials.
     • Adds parsers detector to scan for Parsers API credentials.
     • Adds exportsdk detector to scan for ExportSDK API credentials.
     • Adds dareboost detector to scan for Dareboost API credentials.
     • Adds crossbrowsertesting detector to scan for CrossBrowserTesting API credentials.
     • Adds browserstack detector to scan for BrowserStack API credentials.
     • Adds conversiontools detector to scan for ConversionTools API credentials.
     • Adds image4 detector to scan for Image4 API credentials.
     • Adds sonarcloud detector to scan for SonarCloud API credentials.
     • Adds scrutinizerci detector to scan for Scrutinizerci API credentials.
     • Reports unverified secrets in output when the underlying verification fails.

     27 details in Everything

274. v3.3.0 Apr 15, 2022 · release notes

     Adds base64 detector support and new endpoint for IBM Cloud integration.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.3.0 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.3.0

     • Adds base64 detector to scan for secrets encoded in Base64 format
     • Updates the IBM Cloud integration to use a new endpoint

     2 details in Everything

275. v3.2.3 Apr 12, 2022 · release notes

     Trufflehog v3.2.3 adds support for Artifactory credentials using AccessToken

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.2.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.2.3

276. v3.0.3 Apr 6, 2022 · release notes

     TruffleHog v3.0.3 adds JFrog Artifactory and Microsoft Teams sources

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v3.0.3 https://github.com/trufflesecurity/trufflehog.git
     # already have the repo? check out this version:
     $ git checkout v3.0.3

     • Adds support for the jfrog source type to scan JFrog Artifactory repositories.
     • Adds support for the teams source type to scan Microsoft Teams channels and groups.

     2 details in Everything