TruffleHog: the detector name is not the account

The name is the detector

Each result names the detector that matched, such as a lab detector called LabToken. That string is the detector’s label. It does not name a tenant, a user, or a message. A row can exist with no account field at all.

If the row has no account, workspace, or channel field, write “account not on this row.” Do not copy the detector name into that blank.

The source is a different field

Where the match was found is the source metadata already on the row: a repository file, a filesystem path, or another source the scan declared. That location is not an account either. Keep the detector and the location as two facts.

This lesson does not check whether a value is live, and it does not print a raw credential. The detector name is enough for the note.

What to file

File DetectorName, the source location the row shows, and “account not on this row” when no account field is present. A ticket title can include the detector. It cannot include an account the JSON does not have.

Worked case: LabToken read as a workspace

A lab scan prints DetectorName LabToken and a filesystem path tmp/notes.txt. There is no workspace field and no user field. A draft says the LabToken workspace was accessed and names a channel the author remembers from another tool.

The note quotes LabToken as the detector and tmp/notes.txt as the place the scan reported. Account: not on this row. The remembered channel is not added.

DetectorName: LabToken
source: filesystem tmp/notes.txt
workspace field: absent
user field: absent
write: detector and path
not: a workspace login, and not a channel