trufflehog
Scans git history, filesystems, and URLs for leaked credentials - and actually verifies them live against 800+ APIs, so you get confirmed secrets, not regex noise.
Where trufflehog fits
Scans git history, filesystems, and URLs for leaked credentials - and actually verifies them live against 800+ APIs, so you get confirmed secrets, not regex noise.
Start with the least intrusive template that can distinguish your hypothesis from a normal response. Preserve raw output and a negative control.
Installation references
brew install trufflehog- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Command templates
Populate placeholders only with assets that are explicitly in scope.
trufflehog git {repo} --only-verified- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Populate placeholders only with assets that are explicitly in scope.
trufflehog filesystem {path} --only-verified- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Continue the workflow
Attribution and verification
Version history: normalized permanent page created 2026-08-20. Upstream activity and popularity are separate signals and do not establish tool safety.