https://cybertoolchain.io/tools/trufflehog New releases and features in trufflehog, tracked by The Cyber Toolchain. en Mon, 02 Nov 2026 18:38:05 GMT https://github.com/trufflesecurity/trufflehog/releases/tag/v3.99.8 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.99.8 Mon, 02 Nov 2026 18:38:05 GMT TruffleHog adds a Composio API key detector and now populates SecretParts for custom regex detector results⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Custom regex detectors now populate the `SecretParts` field on each `detectors.Result`, keying every named regex in the config to its first capture group (or full match), making structured secret metadata available downstream.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Composio API key detector, enabled via `feature.ComposioDetectorEnabled`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.99.7 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.99.7 Sat, 24 Oct 2026 06:04:25 GMT TruffleHog v3.99.7 adds xAI key analyzer plus Fireworks AI and Infisical detectors⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds xAI analyzer (`xai` case in analyzer CLI) that inspects a live xAI API key via `GET https://api.x.ai/v1/api-key` and `GET https://api.x.ai/v1/models`, reporting the key's name, ID, team, ACL-derived endpoint and model access bindings, and blocked/disabled status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Fireworks AI API key detector to classify and validate Fireworks AI credentials found in scanned sources. • Adds Infisical service token detector to classify and validate Infisical service tokens found in scanned sources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.99.4 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.99.4 Thu, 22 Oct 2026 15:02:40 GMT TruffleHog v3.99.4 adds per-source debug logging, skipped-verification marking, and a Lambda Cloud API key detector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `debug` field to `LocalSource` in source config files, enabling debug-level logging for a single source without raising the global log level — old configs default to off and are unaffected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Result.VerificationSkipped` field to result output, distinguishing results where no verifier ran (due to `--no-verification`, a per-detector override, or a source verify setting) from genuine unverified verdicts. • Adds a detector for Lambda Cloud API keys. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.99.3 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.99.3 Mon, 19 Oct 2026 18:21:40 GMT TruffleHog v3.99.3 adds a SonarQube Server token detector and per-logger debug level overrides for source logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `SonarQubeDetectorEnabled` feature flag, enabling detection of SonarQube Server tokens via the new SonarQube detector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds per-logger debug level override for source logging, allowing fine-grained debug verbosity control per source. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.98.1 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.98.1 Tue, 06 Oct 2026 11:57:22 GMT TruffleHog v3.98.1 adds a Kong Konnect detector and a configurable API timeout for Gerrit scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `api_timeout_seconds` field to the Gerrit source configuration, accepting values between 0 and 3600 seconds (unset or 0 retains the existing 20 s default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a detector for Kong Konnect Platform (`api.konghq.com`), matching personal and system access tokens with prefixes `kpat_` or `spat_` followed by 49 alphanumeric characters, with live verification against `https://global.api.konghq.com/v3/organizations/me`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.98.0 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.98.0 Mon, 05 Oct 2026 17:39:02 GMT TruffleHog v3.98.0 adds `--no-ignore-tag` flag, S3 scan progress display, and an SSRF egress guard for analyzer clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--no-ignore-tag` CLI flag to force reporting of secrets on lines marked `trufflehog:ignore`, overriding the suppression tag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Shows scan progress within individual S3 buckets during active scans. • Lists only the configured include prefixes during S3 scans, narrowing object enumeration to the specified scope. • Adds `pkg/ssrf` shared egress guard applied to `WithNoLocalIP` and analyzer clients to block server-side request forgery attempts. • Verification now decorates findings rather than gating them — a credential is always reported even when its host DNS lookup fails, with the error attached. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.9 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.9 Thu, 24 Sep 2026 09:11:59 GMT TruffleHog v3.97.9 adds version and comment_number fields to SharePoint source metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Err() method to `JobProgress` and `JobProgressRef`, mirroring `context.Err` so callers can programmatically read why a scan job ended.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.8 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.8 Wed, 23 Sep 2026 18:11:54 GMT TruffleHog v3.97.8 adds Okta OAuth 2.0 client credential detection and per-detector verification timing metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds detection and verification for Okta OAuth 2.0 client credentials (`client_id` + `client_secret`) in the Okta detector, complementing the existing SSWS API token detection; verifies via the `client_credentials` grant against `https://{domain}/oauth2/default/v1/token`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds per-detector verification wall-time tracking to the verification cache via an optional `DetectorMetricsReporter` interface, enabling metrics backends to record remote verification latency broken down by detector type. • Ensures 45 secret detectors now report findings even when live verification fails for operational reasons (request build errors, transport errors, body read errors) rather than silently discarding them, using `SetVerificationError` to record the failure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.6 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.6 Tue, 22 Sep 2026 15:08:21 GMT TruffleHog v3.97.6 adds fine-grained token metadata to GitHub analyzer and makes gist enumeration non-fatal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `is_fine_grained` metadata field to GitHub analyzer output, surfacing whether a scanned token is a fine-grained personal access token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.5 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.5 Wed, 16 Sep 2026 17:37:07 GMT TruffleHog v3.97.5 adds Humio and Resend detectors, S3 object filtering, a `--no-ignore-tag` flag, and low-memory Git scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--no-ignore-tag` global flag to report secrets even when the source line carries a `trufflehog:ignore` comment, overriding the usual suppression.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds object filtering in S3 scanning, enabling scans to target specific objects within a bucket rather than the entire contents. • Adds HumioAPIToken detector to classify and validate leaked Humio API tokens. • Adds Resend detector to classify and validate leaked Resend API keys. • Makes the GitHub App `installationId` optional when scanning all installations, so org-wide scans no longer require a specific installation to be specified. • Introduces low-memory Git scanning mode to reduce peak memory usage when scanning large repositories. • Introduces a new optional detector interface allowing credentials to be verified even when they are not present in the verification cache. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.4 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.4 Thu, 03 Sep 2026 20:01:40 GMT json-enumerator gains concurrent multi-file scanning and native zstd-compressed NDJSON support • Supports passing multiple files to `trufflehog json-enumerator FILE_1 .. FILE_N` for concurrent processing, replacing the previous sequential behaviour and improving throughput on multicore systems. • Adds native zstd-compressed NDJSON input handling to the `json-enumerator` source, eliminating the need to decompress files externally before scanning. • Enables `json-enumerator` to be used inside a `multi-source` configuration. • Twilio and Twilio API key detectors now treat transport failures (429, 5xx, timeouts, connection resets, dial failures) as indeterminate rather than writing `date_rotated`, reducing false rotation signals on transient errors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.2 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.2 Wed, 02 Sep 2026 16:55:13 GMT TruffleHog v3.97.2 adds AWS Secrets Manager source, Weights & Biases V2 detector, GitHub token-type differentiation, and Jenkins enumeration. • Adds `SOURCE_TYPE_AWS_SECRETS_MANAGER` source type, enabling TruffleHog to scan AWS Secrets Manager for leaked credentials. • Adds `token_type` and `remediation` fields to `ExtraData` in the GitHub V2 detector, differentiating between PAT (`ghp_`, `github_pat_`), OAuth (`gho_`), and GitHub App (`ghu_`, `ghs_`, `ghr_`) token types so incident responders are directed to the correct revocation path. • Adds a V2 detector for Weights & Biases (enabled via `WeightsAndBiasesV2DetectorEnabled` feature flag), expanding credential coverage for the ML platform. • Implements `Enumerate` for the Jenkins source, allowing TruffleHog to discover and iterate Jenkins resources during scans. • Retries `git clone` automatically on secondary rate-limit responses (bare 403/429), reducing scan failures against large GitHub targets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.0 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.97.0 Fri, 14 Aug 2026 18:35:16 GMT TruffleHog v3.97.0 adds SARIF output, five new detectors, S3 custom endpoints, and AWS Secrets Manager metadata. • Adds `--sarif` flag for SARIF-format output compatible with GitHub code scanning's `github/codeql-action/upload-sarif` action, tracking findings as new/fixed across scans. • Adds custom endpoint support to the S3 source, enabling scans against S3-compatible storage services. • Adds New Relic License Key detector. • Adds New Relic Browser Key detector. • Adds New Relic User Key detector. • Adds New Relic Insights Query Key detector. • Adds New Relic Mobile App Token detector. • Adds Microsoft Teams Webhook V2 detector. • Adds Figma Personal Access Token v3 detector. • Adds SolarWinds Observability detector. • Adds AWS Secrets Manager metadata type for richer analysis output. • Each clone under `--clone-path` now gets its own subdirectory, preventing collisions when scanning multiple repositories concurrently. • Encrypted private keys with uncrackable passphrases are now surfaced as unverified findings with `encrypted:true` metadata instead of being silently dropped. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.96.0 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.96.0 Fri, 24 Jul 2026 18:23:23 GMT TruffleHog v3.96.0 adds HashiCorp Vault token, Duo API Secret Key, and SonarQube Cloud scoped token detectors plus updated Cloudflare credential format support. • Adds HashiCorp Vault token detector supporting service tokens, periodic tokens, and legacy tokens with live verification against Vault's `auth/token/lookup-self` endpoint. • Adds Duo API Secret Key detector for scanning Duo credentials. • Adds SonarQube Cloud 'Scoped Organization Token' detector. • Updates Cloudflare detectors to recognize 2026+ prefixed credential formats (new `CloudflareApiTokenV2` and `CloudflareGlobalApiKeyV2` detectors). • Adds `TargetNotFoundError` for targeted scans so consumers can distinguish definitively gone targets from transient or auth failures. • Adds internal metrics for chunks and results processed per scan. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.9 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.9 Thu, 09 Jul 2026 23:09:52 GMT TruffleHog v3.95.9 adds 7 new secret detectors and archived-repo exclusion for GitHub org scans. • New OpenRouter detector identifies `sk-or-v1-` API keys and validates them against the OpenRouter API. • New New Relic Insights Insert Key detector matches `NRII-` prefixed keys with live verification via the Events API. • New Duffel Token detector for the Duffel travel API. • New Shippo detector for Shippo shipping API keys. • New IPinfo detector, now included in the default detector set. • New improved Lob detector, now included in the default detector set. • New HashiCorp Vault batch token detector. • Adds `--exclude-archived` flag to skip archived repositories when scanning a GitHub org. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.9 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.9 Thu, 09 Jul 2026 23:09:52 GMT TruffleHog v3.95.9 adds 7 new secret detectors and archived-repo exclusion for GitHub org scans. • New OpenRouter detector identifies `sk-or-v1-` API keys and validates them against the OpenRouter API. • New New Relic Insights Insert Key detector matches `NRII-` prefixed keys with live verification via the Events API. • New Duffel Token detector for the Duffel travel API. • New Shippo detector for Shippo shipping API keys. • New IPinfo detector, now included in the default detector set. • New improved Lob detector, now included in the default detector set. • New HashiCorp Vault batch token detector. • Adds `--exclude-archived` flag to skip archived repositories when scanning a GitHub org. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.8 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.8 Thu, 02 Jul 2026 18:54:37 GMT TruffleHog v3.95.8 adds Octopus Deploy detection, Prometheus engine metrics, and a flag to drop unverified JWT results. • Adds Prometheus metrics exposing engine channel depths/capacities, worker counts, and bytes/chunks/secrets found — enabling real-time observability of scan progress. • New `--drop-unverified-jwt-results` flag suppresses JWT detector results that are unverified with no verification errors, reducing noise in high-volume scans. • Azure SAS token detector now matches tokens regardless of query-parameter order and handles URL-encoded timestamps, catching tokens emitted by tools like Azure Storage Explorer that were previously missed. • Grafana detector updated to treat HTTP 401 responses as unverified (instead of verified), tightening classification of rotated/revoked tokens. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.7 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.7 Mon, 29 Jun 2026 15:50:35 GMT TruffleHog v3.95.7 adds HuggingFace bucket scanning, three new secret detectors, multi-org GitHub App scanning, and SecretParts in JSON output. • Adds `--bucket` flag to the `huggingface` subcommand, enabling secret scanning of HuggingFace buckets alongside datasets, models, and spaces. • New Braintrust detector classifies and validates Braintrust API keys. • New Pganalyze Read Key detector classifies and validates Pganalyze read keys. • New Red Hat Pyxis API key detector classifies and validates Red Hat Pyxis credentials. • Adds `scan_all_installations` option for GitHub App sources, enabling secret scanning across all orgs where the App is installed in a single run. • Exposes `SecretParts` in JSON output, giving practitioners structured access to individual components of a detected secret. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.6 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.6 Thu, 18 Jun 2026 14:38:38 GMT TruffleHog v3.95.6 adds five new secret detectors (Datadog API key, Tly, Wit, Rev, User) and surfaces S3 bucket listing failures. • Adds Datadog API key detector to the default detector set. • Adds Tly detector to the default detector set with updated verification logic. • Adds Wit detector to the default detector set with updated verification logic. • Adds Rev detector to the default detector set, gated behind a feature flag. • Adds User detector to the default detector set with custom endpoint configuration support. • Surfaces S3 bucket listing failures so scan errors are visible rather than silently skipped. • Sets redacted secret display value to the last 4 characters, matching the secret-type admin interface. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.6 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.6 Thu, 18 Jun 2026 14:38:38 GMT TruffleHog v3.95.6 adds six new secret detectors (Datadog API key, Tly, Wit, Rev, User, Enigma) and lifts the 64 KB line-scanning cap to 10 MB. • Adds Datadog API key detector to the default detector set. • Adds Tly detector to the default detector set. • Adds Wit detector to the default detector set. • Adds Rev detector to the default detector set. • Adds User detector (with custom endpoint configuration) to the default detector set. • Adds Enigma detector with hardened GraphQL-based verification to the default detector set. • Raises the per-line scanning limit from 64 KB to 10 MB, enabling detection in files with long lines such as minified JS or base64 blobs. • Updates Klaviyo detector to recognise the new PK token format. • Changes redacted secret display to show only the last 4 characters, matching the TruffleHog secret-type admin interface. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.5 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.5 Tue, 02 Jun 2026 16:10:06 GMT TruffleHog v3.95.5 adds GitLab OAuth, SpectralOps, and AWS AppSync detectors plus ASPX/entity-encoded HTML decoding • New GitLab OAuth detector identifies exposed GitLab OAuth tokens • New SpectralOps Personal API Key detector catches leaked SpectralOps credentials • New AWS AppSync detector surfaces exposed AWS AppSync API keys • HTML decoder now supports ASPX and entity-encoded HTML, expanding secret detection in web application artifacts • Database detectors now include host, db, and username in ExtraData, enriching findings with connection context • Box detector extracts Subject ID for Analyzer integration, enabling richer permission analysis • Improved APK scanning with additional debugging info and better handling of obfuscated APKs • Feature flags added for Pinecone, Cloudinary, and GitLab OAuth detectors • SharePoint source config gains new flags via updated proto definition Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.5 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.5 Tue, 02 Jun 2026 16:10:06 GMT TruffleHog v3.95.5 adds GitLab OAuth, SpectralOps, and AWS AppSync detectors plus ASPX/entity-encoded HTML decoding. • New GitLab OAuth detector identifies and validates leaked GitLab OAuth tokens. • New SpectralOps Personal API Key detector for SpectralOps credentials. • New AWS AppSync detector for leaked AWS AppSync API keys. • HTML decoder now supports ASPX and entity-encoded HTML, broadening secret discovery in web application artifacts. • Database detectors now surface host, database name, and username in ExtraData for richer context on found credentials. • APK scanning gains additional debugging info and improved parsing of obfuscated APKs. • Feature flags added for Pinecone, Cloudinary, and GitLab OAuth detectors, enabling selective enablement. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.4 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.4 Tue, 02 Jun 2026 06:20:51 GMT TruffleHog v3.95.4 adds GitLab OAuth, SpectralOps, and AWS AppSync detectors plus ASPX/entity-encoded HTML decoding. • New GitLab OAuth detector identifies leaked GitLab OAuth tokens. • New SpectralOps Personal API Key detector catches SpectralOps credentials. • New AWS AppSync detector surfaces leaked AWS AppSync API keys. • Database detectors now surface host, database name, and username in ExtraData for richer triage context. • HTML decoder gains support for ASPX files and entity-encoded HTML, expanding coverage of web application secrets. • Adds source config flags to the SharePoint proto, enabling finer-grained SharePoint scanning configuration. • Feature flags added for Pinecone, Cloudinary, and GitLab OAuth detectors for controlled rollout. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.4 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.4 Tue, 02 Jun 2026 06:20:51 GMT TruffleHog v3.95.4 adds GitLab OAuth, AWS AppSync, and SpectralOps detectors plus richer database ExtraData and expanded HTML decoding. • New GitLab OAuth detector identifies and validates GitLab OAuth tokens. • New AWS AppSync detector classifies and validates AWS AppSync API keys. • New SpectralOps Personal API Key detector covers SpectralOps credentials. • Database detectors now expose host, db, and username fields in ExtraData for richer result context. • HTML decoder gains ASPX and entity-encoded HTML support, expanding secret discovery in web application artifacts. • Box detector now extracts Subject ID to enable Analyzer integration. • Pinecone and Cloudinary detectors are enabled by default in OSS builds. • Improved APK scanning adds debugging info and broader support for obfuscated APKs and non-standard resource types. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.3 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.3 Mon, 11 May 2026 18:38:34 GMT TruffleHog v3.95.3 adds Cloudinary and Pinecone detectors, custom detector response-range config, and deduplication of concurrent verifications. • Adds Cloudinary API credential detector. • Adds Pinecone API key detector. • Supports customizable `successRanges` and `rotatedRanges` in custom detectors, giving control over which HTTP response codes indicate a valid or rotated secret. • Deduplicates concurrent credential verification requests via singleflight, reducing redundant outbound calls when the same secret is seen in parallel. • Adds default `Content-Type: application/json` header to custom detector verification requests. Breaking changes: • The `AnalysisInfo` field on `detectors.Result` is renamed to `SecretParts`; any custom detector or tooling that references `AnalysisInfo` directly will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.0 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.95.0 Tue, 21 Apr 2026 17:39:24 GMT TruffleHog v3.95.0 adds Bitbucket, Jira, and Confluence Data Center PAT detectors plus HashiCorp Vault custom endpoint support and man page generation. • Adds Bitbucket Data Center (on-premises) PAT detector for self-hosted Bitbucket environments. • Adds Jira Data Center PAT detector to identify exposed Jira on-prem personal access tokens. • Adds Confluence Data Center PAT detector for self-hosted Confluence instances. • Supports custom endpoint configuration in the HashiCorp Vault Auth detector. • Adds man page generation for TruffleHog, enabling offline reference via standard Unix tooling. • Introduces `AnalysisError` type with wrapped error paths across all analyzer code for more structured error reporting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.94.3 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.94.3 Wed, 08 Apr 2026 17:02:29 GMT TruffleHog v3.94.3 adds HTML decoding for secret detection and AnalysisInfo on verified results. • Adds HTML decoder so secrets embedded in HTML-formatted sources (e.g. HTML email archives, web pages) are now detected. • Adds AnalysisInfo metadata to verified results, surfacing richer context alongside confirmed secrets. • Treats AADSTS50173 as an explicit revocation signal for Azure refresh tokens, improving credential-status accuracy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.94.2 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.94.2 Wed, 01 Apr 2026 13:03:44 GMT TruffleHog v3.94.2 adds a new Shopify OAuth secret detector. • Adds Shopify OAuth detector to identify leaked Shopify OAuth credentials in scanned sources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.94.0 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.94.0 Fri, 20 Mar 2026 14:51:55 GMT TruffleHog v3.94.0 adds a Datadog API key detector and MuleSoft Anypoint OAuth2 detector. • New Datadog API key detector (`datadogapikey`) for detecting Datadog API keys in scanned sources. • Adds MuleSoft Anypoint OAuth2 detector to the default detector set. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.7 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.7 Wed, 04 Mar 2026 15:58:48 GMT TruffleHog v3.93.7 adds a new detector for JFrog Artifactory Reference Tokens. • Adds detector for JFrog Artifactory Reference Tokens. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.5 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.5 Thu, 26 Feb 2026 19:30:42 GMT TruffleHog v3.93.5 adds Google Gemini API key detection, symlink following in filesystem scans, and richer Slack metadata. • Adds Google Gemini API key detector to catch exposed Gemini credentials. • Supports following symlinks when scanning filesystem sources. • Includes `workspace_id` in Slack Continuous scan metadata for better attribution. • Adds Base64 decoding depth assessment to improve nested-encoding detection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.4 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.4 Thu, 19 Feb 2026 14:17:56 GMT TruffleHog v3.93.4 adds an NDJSON/JSONL input source for scanning structured log and data streams. • Adds a new NDJSON/JSONL (newline-delimited JSON) input source for scanning structured data files or streams. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.3 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.3 Wed, 11 Feb 2026 13:50:03 GMT TruffleHog v3.93.3 adds a dedicated detector for OpenAI Admin Keys. • New OpenAI Admin Key detector identifies exposed OpenAI admin credentials in scanned sources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.1 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.1 Fri, 06 Feb 2026 14:09:32 GMT Adds caller info logging capability • Allow logging of caller info Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.0 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.93.0 Wed, 04 Feb 2026 14:03:39 GMT TruffleHog v3.93.0 adds pre-commit auto-config, Tableau analysis info, ignorePattern for Postgres/SQL Server, and GitHub Analyzer rate limiting. • Auto-configures TruffleHog for pre-commit hooks, simplifying hook setup. • Adds analysis info (key metadata) output to the Tableau detector. • Adds `ignorePattern` configuration support to Postgres and SQL Server detectors. • Adds rate limiting to the GitHub Analyzer to avoid API throttling. • Includes key info in `analyze` output for richer credential analysis results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.92.5 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.92.5 Fri, 16 Jan 2026 15:05:41 GMT TruffleHog v3.92.5 adds GitLab Project ID to secret metadata, stronger Custom Detector validation, and Postman API rate-limit metrics. • Stores GitLab Project ID in secret location metadata for richer triage context. • Adds more validations to Custom Detector config to catch misconfigured detectors earlier. • Adds a Postman API monthly request limit metric to track rate-limit exposure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.92.4 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.92.4 Fri, 19 Dec 2025 15:17:06 GMT TruffleHog v3.92.4 adds line numbers for GitHub real-time scanning and role-aware resumption for legacy S3 scans. • Adds line numbers to GitHub real-time scan findings for precise secret location reporting. • Supports role-aware resumption for legacy S3 scans, enabling interrupted scans to resume correctly when assuming IAM roles. • Adds pagination and rate-limit handling for Docker Registry namespace API calls, improving reliability at scale. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.92.3 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.92.3 Thu, 11 Dec 2025 15:34:58 GMT Adds proto definitions for Google Drive Domain-Wide Delegation to enable service account impersonation. • Adds proto definitions for Google Drive Domain-Wide Delegation (DWD) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.92.2 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.92.2 Wed, 10 Dec 2025 15:16:30 GMT TruffleHog v3.92.2 adds an optional timeout for git clone operations. • Adds optional git clone timeout to prevent hung scans on slow or unresponsive repositories. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.92.0 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.92.0 Tue, 09 Dec 2025 14:54:23 GMT TruffleHog v3.92.0 adds GitLab V3 detection, S3 unit support, Postman rate-limit guardrails, and Docker source metrics. • Adds GitLab V3 detector for scanning secrets in GitLab V3 API-authenticated environments. • Supports units in the S3 source, enabling parallel/unit-based scanning of S3 buckets. • Automatically aborts Postman scans when monthly API request usage crosses 80% of the limit, preventing quota exhaustion. • Adds API call metrics and job ID tracking to the Docker source for improved observability. • Adds metrics to RetryableHTTPClient for visibility into HTTP retry behavior. • Applies configured include/ignore lists to GitLab unit scans, bringing unit-level scans in line with full scan filtering. • Adds a way to attach key-value pairs to new sinks for richer output metadata. • Adds more clone logging for improved Git clone observability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.91.2 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.91.2 Tue, 02 Dec 2025 14:27:49 GMT Adds Installation Type field to Jira source and response ID/name to Postman metadata. • `Installation Type` field added to the Jira Source Proto definition Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.91.1 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.91.1 Thu, 20 Nov 2025 15:41:22 GMT TruffleHog v3.91.1 adds generic JWT detection and verification plus AnalysisInfo enrichment on verified results. • Adds generic JWT detection and verification, enabling TruffleHog to find and validate JSON Web Tokens across scanned sources. • Adds AnalysisInfo metadata to verified results in detectors, surfacing richer context for new analyzers. • Redacts Twilio API Key secrets in output to reduce accidental secret exposure in scan results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.91.0 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.91.0 Wed, 12 Nov 2025 20:49:43 GMT TruffleHog v3.91.0 adds namespace-wide Docker registry scanning and improved file-type handling for .msg and .doc • Scans all images under a namespace when targeting Docker remote registries, expanding coverage beyond single images. • Adds .msg and .doc to skipped archiver MIME types, preventing false archive-extraction attempts on Outlook and Word files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.13 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.13 Wed, 05 Nov 2025 14:28:53 GMT TruffleHog v3.90.13 adds GraphQL-powered GitHub PR/issue scanning and Google Drive on-prem support. • Implements GraphQL requests for scanning GitHub PRs, issues, and comments — enabling more efficient and complete coverage of GitHub source data. • Updates Google Drive integration to support on-premises scanning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.12 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.12 Mon, 27 Oct 2025 23:34:04 GMT TruffleHog v3.90.12 adds private repo support for github-experimental and bypass filtering for explicitly listed repositories. • Adds ability to run `github-experimental` source against private repositories. • Explicitly listed repositories now bypass wantRepo() filtering entirely, ensuring they are always scanned regardless of filter configuration. Breaking changes: • The `include_repos` option has been removed from the GitHub source configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.9 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.9 Wed, 15 Oct 2025 16:39:46 GMT TruffleHog v3.90.9 adds Confluence comment scanning, Postmark Account API Token verification, and non-zero exit codes on scan errors. • Supports scanning Confluence comments for secrets. • Adds Account API Token verification support in the Postmark detector. • Returns a non-zero exit code when an error occurs during a scan, enabling reliable CI/CD failure detection. • Detects Organization ID and passes it into AnalysisInfo for the Atlassian detector. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.7 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.7 Thu, 18 Sep 2025 13:52:27 GMT Adds FlightLabs API detector coverage and metrics to SaneHTTPClient • Adds new FlightLabs API detector to identify secrets in that service Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.6 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.6 Thu, 04 Sep 2025 14:12:58 GMT TruffleHog v3.90.6 adds Rippling, Fly.io, and Photoroom detectors plus AWS account allow/deny lists and new scan controls. • New detector for Rippling phrase API tokens. • New detector for Fly.io credentials. • New detector for Photoroom API keys. • Updates the Dotmailer detector to Dotdigital (rebranded service coverage). • Adds AWS account allow and deny lists to scope or exclude specific AWS accounts during scanning. • Enables cloning a repository to a specified location with a retention option. • Adds a dedicated flag to skip GitHub Gists during scans. • Adds a GraphQL client to the GitHub connector for richer repository data access. • Supports scanning GitHub private repositories with a token. • Adds additional validation rules support in custom detectors. • Adds a feature flag to configure the number of projects per page in GitLab enumeration. • Adds an explicit secrets-manager write flag to the Bitbucket source configuration. • Adds indeterminate verification support for letter-Q detectors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.5 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.5 Thu, 14 Aug 2025 21:03:08 GMT TruffleHog v3.90.5 adds UTF-16 BOM support, expanded Unicode escape detection, and custom Bitbucket OAuth proto definitions. • Supports UTF-16 BOM-encoded files, enabling secret scanning across a wider range of text encodings. • Adds additional Unicode escape sequence support, improving detection of obfuscated secrets in source files. • Updates proto definitions to support custom Bitbucket OAuth configurations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.4 https://github.com/trufflesecurity/trufflehog/releases/tag/v3.90.4 Wed, 13 Aug 2025 15:36:11 GMT TruffleHog v3.90.4 adds HashiCorp Vault AppRole detector, API-based Bitfinex validation, binary-skip option, and GCP private key ID metadata. • New HashiCorp Vault AppRole authentication detector for scanning Vault credentials. • Adds `--skip-binaries` option to skip binary files during filesystem source scanning. • Upgrades Bitfinex detector to use API-based secret validation for live verification. • Adds private key ID to GCP credential metadata for richer secret context. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trufflehog