featured · github
Trufflehog: Catch Leaked Credentials Before They Become Your Problem
Secret scanning that actually verifies what it finds—so you know which leaks are real threats, not false alarms.
trufflesecurity/trufflehog ↗Trufflehog scans your codebase for accidentally committed secrets—API keys, database passwords, tokens—the kind of thing that turns into a 3am incident when it hits a public repo. What separates it from built-in GitHub scanning: it doesn't just flag patterns. It pings the actual service (AWS, Stripe, GitHub) to verify the credential works. A fake-looking string gets ignored; a live key gets caught and reported immediately. Drop it into your CI pipeline and it runs on every commit. For solopreneurs, that's compliance-box-checked without the audit grief. For teams, it's hours saved on breach triage—you know instantly if real damage is possible.
Share kit
Trufflehog: Verify leaked secrets, not just find them
Secret scanning that works in CI and actually confirms whether a leaked credential is live. Skip the false alarms, catch the real threats. <a href='https://github.com/trufflesecurity/trufflehog'>GitHub repo</a>
Most secret scanners flag patterns. Trufflehog verifies them—pings the API to confirm the credential actually works. Run it in CI, get alerted on real leaks, sleep better. No hype, just fewer 3am incidents.
The difference between a secret scanner and a useful one: verification. Trufflehog doesn't just pattern-match—it confirms whether a leaked credential is live. Built for CI pipelines, saves your team hours on breach triage. Open source, builder-ready.
Just integrated Trufflehog into our CI pipeline. Found three live AWS keys sitting in a commit from last month—keys that would've cost us hours of incident response if they'd hit production. Here's the thing: GitHub's native secret scanning flags patterns. Trufflehog *verifies* them. It actually hits the API to confirm the credential works, so you're not chasing false positives at 2am. I run it as: `trufflehog filesystem . --json` Takes seconds. Catches what pattern-matchers miss. If you're shipping code at any scale, this is table stakes. https://github.com/trufflesecurity/trufflehog
found a live AWS key in our git history yesterday using trufflehog. that credential was valid. would've been a compliance nightmare + breach response bill. it's not just pattern matching—it actually verifies the secrets work. cuts through the noise other scanners create. one command. production-safe. https://github.com/trufflesecurity/trufflehog