# TruffleHog

> AGPL-3.0 secret scanner that finds leaked credentials and checks whether they still work

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://trufflesecurity.com/trufflehog  
**GitHub:** https://github.com/trufflesecurity/trufflehog  
**Added:** 2026-10-10

---

## The Hook

TruffleHog scans Git history, filesystems, S3 buckets, Docker images and more for leaked keys, then tests each one against the provider so you know which leaks are still live.

## What's Good

AGPL-3.0 (trufflesecurity/trufflehog), release v3.99.2. `brew install trufflehog`, then `trufflehog git <repo>` or `trufflehog filesystem <path>`. Hundreds of detectors, and `--results=verified` cuts the noise down to credentials that actually work. Ships a GitHub Action and pre-commit hook for CI. ★~28k.

## The Catch

License first: AGPL-3.0 is copyleft, not permissive — check it with your legal team before embedding or modifying it in a product you distribute or offer as a service. Verifying a secret calls the real provider’s API with it, so scans make outbound requests and show up in that provider’s logs. Continuous monitoring of Slack, Jira, Confluence and similar tools is in the paid Enterprise product; the open-source CLI covers one-off and CI scans. Vs gitleaks (MIT, fast regex scanning, no live verification): TruffleHog tells you which leaks still work, at the cost of a copyleft license and network calls.

## Verdict

The scanner to run when you need to know which leaked keys are live — mind the AGPL and the outbound verification calls.