TruffleHog
Find leaked secrets across git history, cloud, and more.
About
TruffleHog (trufflesecurity/trufflehog, AGPL-3.0, ~28.5k stars) finds leaked credentials: 800+ detectors scanning git history, filesystems, S3, Docker, and CI logs — with verification to cut false positives.
Very actively maintained (53 releases/12mo). License note: AGPL-3.0 is copyleft — running it as a hosted service triggers source-sharing obligations. Fine for internal/CI use.
What it can do
- 800+ secret detectors
- Git history scanning
- Verification (low false positives)
- CI integration
- AGPL-3.0 open source
Setup
- Install via brew/docker or download the binary.
trufflehog git https://github.com/org/repo.- Add to CI to catch leaks pre-merge.
- Note AGPL obligations for hosted use.
Prerequisites
None for local/CI use.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (verified tier). ~28.5k stars, very active, the secrets-scanning standard with verification. Docked only for AGPL copyleft (flagged). Verified tier.
★ 28,461 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 8.3/10
- Maintenance · recency, releases, issue load
- 9.2/10
- Openness · license + docs
- 9.4/10
- Manual review · sanity read + red-flag check
- 8.0/10
- · 28,461 GitHub stars (log-scaled vs catalog peers)
- · last push 1d ago; 53 releases/12mo; 567 open issues
- · manual review: secrets scanner; AGPL copyleft flagged; very active; license: AGPL-3.0 (copyleft — running it as a service triggers source-sharing)
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.