TruffleHog
by Truffle Security
Find and verify leaked credentials in code, history, and cloud storage
TruffleHog scans Git repositories, filesystems, Docker images, S3 buckets, and other sources for secrets such as API keys and tokens. It classifies findings with 800+ detectors and can check whether a found credential is still live, which cuts down on false positives. It runs as a CLI, in CI, or as a pre-commit hook.
Key features
- 800+ secret detectors
- Live credential verification
- Scans Git history, filesystems, images, and cloud storage
- GitHub Action and pre-commit hook
Similar tools
Trivy
Find vulnerabilities, misconfigurations, and secrets in containers and code
Semgrep
Lightweight static analysis for finding bugs and enforcing code standards
OSV-Scanner
Scan dependencies for known vulnerabilities using the OSV.dev database
CodeQL
GitHub's semantic code analysis engine for finding vulnerabilities
ZAP
Open-source web application security scanner and intercepting proxy
