TruffleHog

TruffleHog: Open Source Secret Scanner

Discover hidden secrets and passwords in your git repositories with TruffleHog, an open source tool for identifying high entropy strings and credentials.

What is TruffleHog?

TruffleHog is an open source command line tool written in Python that helps developers find secrets and passwords that have accidentally been committed to git repositories. It scans the full commit history of a git repo to find high entropy strings that look like passwords, API keys, tokens, and other secrets.

By scanning git histories, TruffleHog lets developers and security teams identify credentials that have been committed in the past even if they have now been removed from the codebase. This allows revoked credentials to be fully invalidated across an organization to prevent account compromises or unauthorized API access.

Some key features and benefits of TruffleHog include:

• Scans git repos for secrets and keys that match known patterns for credentials
• Identifies high entropy strings likely to be passwords or secrets
• Integration with services like AWS Key Management to validate findings
• Command line usage for easy automation in CI/CD pipelines
• Customizable ignores and whitelists to reduce false positives
• Detailed output with commit info to pinpoint where secrets were committed

TruffleHog brings visibility into accidentally committed secrets, letting developers revoke compromised credentials before they can be used maliciously. Its ease of use and automation make it a valuable tool for securing git repositories.

TruffleHog Features

Official Links