dxa4481/truffleHog

Features

• Secret Detection - Searches through version control, cloud storage, and local files to identify leaked API keys and credentials.
• Secret Scanning - Comprehensive tool for detecting exposed credentials across version control, cloud storage, and local filesystems.
• Hidden Commit Enumeration - Enumerates deleted and hidden repository commits to discover secrets missing from the standard git history.
• Git History Enumeration - Traverses the full commit graph, including orphaned and hidden commits, to find deleted secrets.
• Cloud Storage Scanning - Inspects files within cloud storage buckets to identify leaked secrets using identity roles.
• Secret Detection - Inspects container images to identify and verify leaked secrets across multiple image layers.
• Active Secret Verifications - Implements a verification engine that makes network requests to service APIs to confirm if detected secrets are active.
• Credential Analysis - Analyzes discovered credentials to determine the specific resources and access levels they control.
• Credential Verification - Validates discovered secrets against service APIs to confirm they are active and eliminate false positives.
• Git Secret Scanners - Scans local and remote git repositories, enumerating hidden commits to find credentials in version history.
• Local Repository Secret Scanning - Searches local git repositories by cloning them to temporary directories to prevent configuration exploits on the host.
• Secret Type Classification - Identifies the specific service or provider associated with a discovered credential among hundreds of known types.
• Cloud Storage Auditing - Inspects files within cloud storage buckets and container images specifically to find exposed credentials.
• Pluggable Storage Drivers - Uses an abstract storage architecture to scan diverse targets like cloud buckets, docker images, and elastic clusters.
• Development Workflow Integrations - Integrates security scans into pipeline stages and commit hooks to block secrets from entering version control.
• Secret Suppressions - Allows users to suppress alerts for intentional secrets using specific ignore comments in the source code.
• Pre-commit Hooks - Uses git hooks to scan code locally and block commits containing credentials before they reach a remote repository.
• CI/CD Pipeline Integrations - Integrates into CI/CD pipelines to monitor code changes and block commits containing sensitive secrets.
• CI Pipeline Integrations - Provides a monitoring system for CI pipelines that returns failure codes when credentials appear in diffs.
• Binary and Document Secret Scanning - Provides the ability to scan binaries and documents for leaked credentials embedded in non-text formats.
• Cloud Auditing Tools - Scans Docker images, cloud storage buckets, and database clusters for embedded secrets and sensitive configuration data.
• Custom Detection Rules - Allows users to create tailored detection rules using regular expressions and entropy filters for proprietary credential formats.
• Dynamic Permission Discovery - Analyzes verified credentials to determine the specific access levels and resources they control.
• CI/CD - Prevents credentials from entering a codebase by scanning commits and pipeline changes before they are merged.
• Offensive Security Tools - Searches commit history for high-entropy strings and secrets.
• Secret Scanning - Searches commit history for high-entropy strings and secrets.
• Sensitive Data Leakage - Searches git repositories for high-entropy strings and secrets.

Star history