trufflesecurity/trufflehog on Hacker News

…# to scan from an image saved as a tarball trufflehog docker --image file://path_to_image.tar [0]: https://github.com/trufflesecurity/trufflehog#11-scan-a-dock...

comment by captn3m0 · 2026-03-26 · in Show HN: Layerleak – Like Trufflehog, but for Docker Hub

…will attempt to verify any credentials it finds by making some sort of authenticated request. [1] https://github.com/trufflesecurity/trufflehog#validation-

comment by ctippett · 2025-11-28 · in GitLab scan finds 17,000 secrets in public repos, leading to $9000+ in bounties

…monitor your progress Also be interesting to see what trufflehog finds (should be false positive) https://github.com/trufflesecurity/trufflehog Where are you storing the creds to get the secret from the vault ? This is the secret zero…

comment by firesteelrain · 2025-04-28 · in Ask HN: What are you working on? (April 2025)

▲ 1

TruffleHog: Find, verify, and analyze leaked credentials

story by Brysonbw · 2025-04-02 · 0 comments

https://github.com/trufflesecurity/trufflehog is a similar tool but checks for far more secrets, so I think it'd be a better choice.

comment by Tiberium · 2024-08-24 · in Accident Forgiveness

…with one too few. All of these are valid right now, and the first one is the one they show: https://github.com/trufflesecurity/trufflehog/commit/7bc0b2 https://github.com/trufflesecurity/trufflehog/commit/7bc0b4…

comment by Dylan16807 · 2024-07-25 · in Anyone can access deleted and private repository data on GitHub

I cannot access the commit https://github.com/trufflesecurity/trufflehog/commit/7bc0b shown in one of the pictures in the article (right before "Where do you get these hash values") despite this repo is even public. What gives?

comment by thrdbndndn · 2024-07-25 · in Anyone can access deleted and private repository data on GitHub

See also: - trufflehog: https://github.com/trufflesecurity/trufflehog - detect-secrets: https://github.com/Yelp/detect-secrets - semgrep secrets: https://semgrep.dev/products/semgrep-secrets -- (Paid, but may be included in existing…

comment by BeefWellington · 2024-06-04 · in Entropy, a CLI that scans files to find high entropy lines (might be secrets)

…tools have false positives [1] https://aquasecurity.github.io/trivy/v0.27.1/docs/secret/sca... [2] https://github.com/trufflesecurity/trufflehog

comment by 8organicbits · 2023-12-30 · in Show HN: I built ContainerCVE – a web tool to scan public Docker images

…prevent leaking secrets by blocking commits to git (e.g., https://github.com/Infisical/infisical or https://github.com/trufflesecurity/trufflehog )

comment by maidul · 2023-05-27 · in How to mitigate risk from secrets leaks

…pushing. Some tools can help with that: https://martinfowler.com/articles/session-secret.html https://github.com/trufflesecurity/trufflehog https://about.sourcegraph.com/blog/no-more-secrets https://github.com/Yelp/detect-secrets…

comment by pabs3 · 2022-11-21 · in GitHub access token exposure

There are software such as Trufflehog ( https://github.com/trufflesecurity/trufflehog ), that find secrets. We are using it at an organizational level, but there's always some delay from finding something and getting it reported. I've been…

comment by GolDDranks · 2022-10-14 · in Toyota suffered a data breach by accidentally exposing a secret key on GitHub

There are a ton of them, here are a few: https://martinfowler.com/articles/session-secret.html https://github.com/trufflesecurity/trufflehog https://github.com/awslabs/git-secrets https://github.com/sirwart/ripsecrets…

comment by pabs3 · 2022-05-29 · in Quickly find sensitive files in your GitHub repo

then they must have rewritten the 2.0.97 tag from 2016 because it's AGPL also: https://github.com/trufflesecurity/trufflehog/blob/2.0.97/LI...

comment by mdaniel · 2022-04-04 · in TruffleHog v3 – Detect and automatically verify over 600 credential types

▲ 84

TruffleHog v3 – Detect and automatically verify over 600 credential types

story by riverdroid · 2022-04-04 · 8 comments

List of key types supported: https://github.com/trufflesecurity/trufflehog/tree/main/pkg/...

comment by malchow · 2022-04-04 · in TruffleHog V3: Automatically Validate over 600 API Keys

- https://github.com/auth0/repo-supervisor - https://github.com/awslabs/git-secrets - https://github.com/trufflesecurity/truffleHog - https://www.gitguardian.com/ - https://github.com/eth0izzle/shhgit All these tools can be configured to…

comment by mzfr · 2021-08-09 · in Ask HN: What are the best automated tools for keeping credentials out of GitHub?

…in repositories. (I don't think shhgit will look back in the git history for you though). [1]: https://github.com/dxa4481/truffleHog [2]: https://github.com/eth0izzle/shhgit

comment by psanford · 2021-03-24 · in The Python Package Index is now a GitHub secret scanning integrator

…[11] https://github.com/thoughtworks/talisman [12] https://github.com/zricethezav/gitleaks [13] https://github.com/dxa4481/truffleHog [14] https://docs.github.com/en/free-pro-team@latest/github/authe...

comment by 0xad · 2020-11-07 · in What will happen when you commit secrets to a public Git repo?

Here's one for credential scanning: https://github.com/dxa4481/truffleHog

comment by __jal · 2020-03-10 · in Launch HN: Datree (YC W20) – Best practices and security policies on each commit

▲ 1

TruffleHog – Searches through Git repositories for secrets

story by weinzierl · 2019-08-12 · 0 comments

…Slack channel. It then calls the GitHub API to make the repo private to limit the exposure. [0] - https://github.com/dxa4481/truffleHog

comment by 7ewis · 2019-04-08 · in Characterizing secret leakage in public GitHub repositories

Looks nifty, but I'd ask: why use this over Trufflehog? https://github.com/dxa4481/truffleHog

comment by packetized · 2018-08-06 · in CLI tool that finds secrets accidentally committed to a Git repo (2017)

…scan your repository for high-entropy strings before they are forever enshrined in your history ( https://github.com/dxa4481/truffleHog ).

comment by smoyer · 2018-02-19 · in A Hacker Has Wiped a Spyware Company’s Servers

…git repositories for high entropy strings and secrets, digging deep into commit history." [0] https://github.com/dxa4481/truffleHog

comment by chatmasta · 2018-01-10 · in Show HN: Sniffgit – A Python lib to find sensitive files and information in a repo

…history. I have used, and like, Gitrob and Trufflehog. * https://github.com/michenriksen/gitrob * https://github.com/dxa4481/truffleHog * * not currently OSS unfortunately

comment by t3h2mas · 2017-12-05 · in Ask HN: How are you monitoring source code for secrets?

How about this one? https://github.com/dxa4481/truffleHog Posted here a few months ago.

comment by sevagh · 2017-04-20 · in Show HN: GitMonKey – monitor your repos and commits for exposed private keys

Open source alternatives for Git repos (ideally run in the pipeline): https://github.com/dxa4481/truffleHog - "Searches through git repositories for high entropy strings, digging deep into commit history" https://github.com/ezekg/git-hound…

comment by sublimino · 2017-02-17 · in GitLeaks – Search engine for exposed secrets on GitHub

▲ 51

TruffleHog – Searches through Git repositories for high entropy strings

story by ergot · 2017-01-02 · 9 comments