A Secret Scan Is a Release Gate, Not a Pipeline Decoration secdoc.tech/a-secret-sca...
How to use TruffleHog to find and verify exposed credentials, block unsafe releases, and keep secret scanning useful in a real DevSecOps pipeline.
#devsecops #secrets-management #trufflehog #application-security
How to use TruffleHog to find and verify exposed credentials, block unsafe releases, and keep secret scanning useful in a real DevSecOps pipeline.
#devsecops #secrets-management #trufflehog #application-security
A Secret Scan Is a Release Gate, Not a Pipeline Decoration
How to use TruffleHog to find and verify exposed credentials, block unsafe releases, and keep secret scanning useful in a real DevSecOps pipeline.
secdoc.tech
September 30, 2026 at 4:27 PM
A Secret Scan Is a Release Gate, Not a Pipeline Decoration secdoc.tech/a-secret-sca...
How to use TruffleHog to find and verify exposed credentials, block unsafe releases, and keep secret scanning useful in a real DevSecOps pipeline.
#devsecops #secrets-management #trufflehog #application-security
How to use TruffleHog to find and verify exposed credentials, block unsafe releases, and keep secret scanning useful in a real DevSecOps pipeline.
#devsecops #secrets-management #trufflehog #application-security
Trufflehog est un outil d'analyse permettant de monitorer et découvrir les secrets et autres credentials qui pourraient fuiter par inadvertance dans vos GutHub, GitLab, S3, ElasticSearch, etc ... ⬇️
github.com/trufflesecur...
github.com/trufflesecur...
GitHub - trufflesecurity/trufflehog: Find, verify, and analyze leaked credentials
Find, verify, and analyze leaked credentials. Contribute to trufflesecurity/trufflehog development by creating an account on GitHub.
github.com
February 19, 2025 at 7:11 AM
Trufflehog est un outil d'analyse permettant de monitorer et découvrir les secrets et autres credentials qui pourraient fuiter par inadvertance dans vos GutHub, GitLab, S3, ElasticSearch, etc ... ⬇️
github.com/trufflesecur...
github.com/trufflesecur...
as an aside, "trufflehog" is a such a cute name for a program that does that
November 24, 2025 at 3:29 PM
as an aside, "trufflehog" is a such a cute name for a program that does that
trufflehog experiencing pure ecstasy as it discovers every single directory on my system has a monero wallet in it
July 19, 2026 at 10:34 PM
trufflehog experiencing pure ecstasy as it discovers every single directory on my system has a monero wallet in it
🔗 Liens utiles TruffleHog :
👉 Le projet : github.com/trufflese...
👉 En savoir plus : trufflesecurity.com/
👉 Le projet : github.com/trufflese...
👉 En savoir plus : trufflesecurity.com/
September 17, 2025 at 7:41 PM
🔗 Liens utiles TruffleHog :
👉 Le projet : github.com/trufflese...
👉 En savoir plus : trufflesecurity.com/
👉 Le projet : github.com/trufflese...
👉 En savoir plus : trufflesecurity.com/
🎒🐻 Les Logiciels Libres de l'été, jour 85
TruffleHog : un outil Open Source de découverte, classification, validation et analyse de secrets.
✅ Clés API,
✅ Mots de passe db
✅ Clés de chiffrement privées, etc.
TruffleHog : un outil Open Source de découverte, classification, validation et analyse de secrets.
✅ Clés API,
✅ Mots de passe db
✅ Clés de chiffrement privées, etc.
September 17, 2025 at 7:41 PM
🎒🐻 Les Logiciels Libres de l'été, jour 85
TruffleHog : un outil Open Source de découverte, classification, validation et analyse de secrets.
✅ Clés API,
✅ Mots de passe db
✅ Clés de chiffrement privées, etc.
TruffleHog : un outil Open Source de découverte, classification, validation et analyse de secrets.
✅ Clés API,
✅ Mots de passe db
✅ Clés de chiffrement privées, etc.
Falar um negócio pra vcs
Ces já viram um token tão feio quanto esses do Ebay?
E pela documentação, são assim msmo 🤣
Chega nem o Trufflehog, nem o Gitleaks reconhecem #bolhasec
Ces já viram um token tão feio quanto esses do Ebay?
E pela documentação, são assim msmo 🤣
Chega nem o Trufflehog, nem o Gitleaks reconhecem #bolhasec
December 22, 2024 at 12:11 AM
Falar um negócio pra vcs
Ces já viram um token tão feio quanto esses do Ebay?
E pela documentação, são assim msmo 🤣
Chega nem o Trufflehog, nem o Gitleaks reconhecem #bolhasec
Ces já viram um token tão feio quanto esses do Ebay?
E pela documentação, são assim msmo 🤣
Chega nem o Trufflehog, nem o Gitleaks reconhecem #bolhasec
Acidentalmente 🌚
Acabei de passar o Trufflehog num repo de uma empresa citada pela Forbes e Gartner
Nunca vi tanto secret publicamente comitado 😂⚰️ #bolhasec
Tem
- MongoDB
- AWS
- Notion
Acabei de passar o Trufflehog num repo de uma empresa citada pela Forbes e Gartner
Nunca vi tanto secret publicamente comitado 😂⚰️ #bolhasec
Tem
- MongoDB
- AWS
- Notion
October 15, 2024 at 10:09 PM
Acidentalmente 🌚
Acabei de passar o Trufflehog num repo de uma empresa citada pela Forbes e Gartner
Nunca vi tanto secret publicamente comitado 😂⚰️ #bolhasec
Tem
- MongoDB
- AWS
- Notion
Acabei de passar o Trufflehog num repo de uma empresa citada pela Forbes e Gartner
Nunca vi tanto secret publicamente comitado 😂⚰️ #bolhasec
Tem
- MongoDB
- AWS
- Notion
18/ Supply-chain and cloud tooling got Trivy, Syft, Grype, Gitleaks, TruffleHog, Semgrep, Cosign, Skopeo, Buildah, Podman, Dive, kubectl, Helm and k9s.
Modern security is often just “which layer of this container contains the cursed thing?”
Modern security is often just “which layer of this container contains the cursed thing?”
October 1, 2026 at 4:37 PM
18/ Supply-chain and cloud tooling got Trivy, Syft, Grype, Gitleaks, TruffleHog, Semgrep, Cosign, Skopeo, Buildah, Podman, Dive, kubectl, Helm and k9s.
Modern security is often just “which layer of this container contains the cursed thing?”
Modern security is often just “which layer of this container contains the cursed thing?”
Use TruffleHog for secrets, then triage manually to avoid false positives, ensuring only critical issues make it to release.
September 30, 2026 at 5:10 PM
Use TruffleHog for secrets, then triage manually to avoid false positives, ensuring only critical issues make it to release.
TruffleHog scans source code. It misses secrets baked into production client bundles. Verify your deployed JS for credential-shaped values. I work on KeyDrift, which scans shipped bundles to separate public keys from real leaks.
September 28, 2026 at 7:07 PM
TruffleHog scans source code. It misses secrets baked into production client bundles. Verify your deployed JS for credential-shaped values. I work on KeyDrift, which scans shipped bundles to separate public keys from real leaks.
trufflehog v3.97.2 — Find, verify, and analyze leaked credentials https://kitploit.com/en/tools/github/trufflesecurity/trufflehog?utm_source=bluesky&utm_medium=social&utm_campaign=kitploit&utm_content=356644
September 6, 2026 at 7:44 AM
trufflehog v3.97.2 — Find, verify, and analyze leaked credentials https://kitploit.com/en/tools/github/trufflesecurity/trufflehog?utm_source=bluesky&utm_medium=social&utm_campaign=kitploit&utm_content=356644
BACKDOORS & BREACHES - CARD OF THE DAY
Have you experienced this?
Deck: Cloud Deck
Attack/Procedure Type: IC
Attack/Procedure: Credentials Posted Publicly in a Code Repository
Tools:
Gitleaks - github.com/gitleaks/git...
TruffleHog - github.com/trufflesecur...
Gitrob - github.com/michenriksen...
Have you experienced this?
Deck: Cloud Deck
Attack/Procedure Type: IC
Attack/Procedure: Credentials Posted Publicly in a Code Repository
Tools:
Gitleaks - github.com/gitleaks/git...
TruffleHog - github.com/trufflesecur...
Gitrob - github.com/michenriksen...
August 29, 2025 at 7:39 PM
BACKDOORS & BREACHES - CARD OF THE DAY
Have you experienced this?
Deck: Cloud Deck
Attack/Procedure Type: IC
Attack/Procedure: Credentials Posted Publicly in a Code Repository
Tools:
Gitleaks - github.com/gitleaks/git...
TruffleHog - github.com/trufflesecur...
Gitrob - github.com/michenriksen...
Have you experienced this?
Deck: Cloud Deck
Attack/Procedure Type: IC
Attack/Procedure: Credentials Posted Publicly in a Code Repository
Tools:
Gitleaks - github.com/gitleaks/git...
TruffleHog - github.com/trufflesecur...
Gitrob - github.com/michenriksen...
This is certainly one of the more ominous spam emails I have received. What does the TruffleHog Program know that I do not?
September 29, 2026 at 9:22 AM
This is certainly one of the more ominous spam emails I have received. What does the TruffleHog Program know that I do not?
Shai‑Halud : Supply Chain Attack qui cible des paquets npm sous les comptes CrowdStrike.
Il télécharge et exécute des outils comme TruffleHog puis cherche des tokens, crée des workflows GitHub Actions non autorisés et exfiltre des données.
👉 socket.dev/blog/ongo...
Il télécharge et exécute des outils comme TruffleHog puis cherche des tokens, crée des workflows GitHub Actions non autorisés et exfiltre des données.
👉 socket.dev/blog/ongo...
September 17, 2025 at 11:30 AM
Shai‑Halud : Supply Chain Attack qui cible des paquets npm sous les comptes CrowdStrike.
Il télécharge et exécute des outils comme TruffleHog puis cherche des tokens, crée des workflows GitHub Actions non autorisés et exfiltre des données.
👉 socket.dev/blog/ongo...
Il télécharge et exécute des outils comme TruffleHog puis cherche des tokens, crée des workflows GitHub Actions non autorisés et exfiltre des données.
👉 socket.dev/blog/ongo...
Truffle Security found 543,699 valid credentials in code from public GitHub repos analyzed in The Stack v3, exposing API keys, tokens, database logins, and service accounts. #GitHub #HuggingFace #OpenSource
GitHub Credentials Also Exposed In Datasets For AI Training
Truffle Security found 543,699 still-valid credentials inside code from public GitHub repositories after analyzing The Stack v3 dataset, which was built from about 224 million repositories. The research showed exposed API keys, access tokens, database credentials, and service accounts, and recommends revoking or rotating any leaked credentials because they may already exist in forks or copies of the repository. #Truffle Security #GitHub #The Stack v3 #Hugging Face #TruffleHog
www.hendryadrian.com
October 2, 2026 at 9:45 AM
Truffle Security found 543,699 valid credentials in code from public GitHub repos analyzed in The Stack v3, exposing API keys, tokens, database logins, and service accounts. #GitHub #HuggingFace #OpenSource
Trufflehog: Find, verify, and analyze leaked credentials
GitHub: github.com/trufflesecur...
ShinyHunters stated they used this tool in the Salesforce/Salesloft hack.
www.bleepingcomputer.com/news/securit...
GitHub: github.com/trufflesecur...
ShinyHunters stated they used this tool in the Salesforce/Salesloft hack.
www.bleepingcomputer.com/news/securit...
September 17, 2025 at 9:30 PM
Trufflehog: Find, verify, and analyze leaked credentials
GitHub: github.com/trufflesecur...
ShinyHunters stated they used this tool in the Salesforce/Salesloft hack.
www.bleepingcomputer.com/news/securit...
GitHub: github.com/trufflesecur...
ShinyHunters stated they used this tool in the Salesforce/Salesloft hack.
www.bleepingcomputer.com/news/securit...
TruffleHog Explorer - A User-Friendly Web-Based Tool To Visualize And Analyze Data Extracted Using TruffleHog www.kitploit.com/2025/04/truf...
TruffleHog Explorer - A User-Friendly Web-Based Tool To Visualize And Analyze Data Extracted Using TruffleHog
Welcome to TruffleHog Explorer , a user-friendly web-based tool to visualize and analyze data extracted using TruffleHog. TruffleHog is on...
www.kitploit.com
April 18, 2025 at 2:51 PM
TruffleHog Explorer - A User-Friendly Web-Based Tool To Visualize And Analyze Data Extracted Using TruffleHog www.kitploit.com/2025/04/truf...