TruffleHog
AGPL-3.0 secret scanner that finds leaked credentials and checks whether they still work
Security / Secret Scanning · AGPL-3.0 · 28.6k
Reviewed 2026-10-10 · last push 2026-10-19 · repo checked 2026-10-19
What's Good
AGPL-3.0 (trufflesecurity/trufflehog), release v3.99.2. `brew install trufflehog`, then `trufflehog git <repo>` or `trufflehog filesystem <path>`. Hundreds of detectors, and `--results=verified` cuts the noise down to credentials that actually work. Ships a GitHub Action and pre-commit hook for CI. ★~28k.
The Catch
License first: AGPL-3.0 is copyleft, not permissive — check it with your legal team before embedding or modifying it in a product you distribute or offer as a service. Verifying a secret calls the real provider’s API with it, so scans make outbound requests and show up in that provider’s logs. Continuous monitoring of Slack, Jira, Confluence and similar tools is in the paid Enterprise product; the open-source CLI covers one-off and CI scans. Vs gitleaks (MIT, fast regex scanning, no live verification): TruffleHog tells you which leaks still work, at the cost of a copyleft license and network calls.
Verdict
The scanner to run when you need to know which leaked keys are live — mind the AGPL and the outbound verification calls.
Embed
Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.
Markdown
[](https://stackgems.com/gems/trufflehog)
HTML
<a href="https://stackgems.com/gems/trufflehog"><img src="https://stackgems.com/badge/trufflehog.svg" alt="TruffleHog reviewed on Stack Gems" height="20"></a>