TruffleHog: find verified secrets across your organization’s repositories

What verification adds

TruffleHog has hundreds of detectors, and many can check a candidate secret by calling the provider’s API with it. A verified result means the credential worked when checked. That ranking is the main difference from a pattern-only scanner: a team with 400 findings can start with the 6 that are live.

Verification sends the credential to the provider. Your organization’s policy may forbid that for some systems; --no-verification turns it off and leaves pattern matches only.

Scanning several kinds of source

The same binary reads a local git repository, a GitHub organization, a folder, or a container image. For GitHub, pass a read-only token through the environment rather than a flag so it does not land in shell history.

trufflehog git file://. --results=verified,unknown

export GITHUB_TOKEN=$(cat ~/.config/hb/gh-readonly)
trufflehog github --org=hackblue-lab --results=verified --json > org.jsonl

trufflehog filesystem ./build-output --no-verification
trufflehog docker --image ghcr.io/hackblue-lab/api:2026.10.2 --results=verified

Reading the JSON record

Each result carries the detector, verification state, a redacted form of the secret, and where it was found.

{"DetectorName":"Slack","Verified":true,
 "Redacted":"xoxb-2391...",
 "SourceMetadata":{"Data":{"Github":{
   "repository":"https://github.com/hackblue-lab/ops-scripts",
   "file":"notify.py","line":12,
   "commit":"a71c0e9","email":"dev@hackblue-lab.org"}}}}

jq -r 'select(.Verified) | [.DetectorName, .SourceMetadata.Data.Github.repository, .SourceMetadata.Data.Github.file] | @tsv' org.jsonl

Worked case: one live bot token

The org scan finds 212 results, 1 verified: a Slack bot token in ops-scripts. The bot can post to every channel it was invited to. The Slack admin revokes it and reissues a token stored in the CI secret store. The audit log for the old token shows no use outside the expected job, which goes into the ticket.

The unverified results are not ignored. They are batched by detector and reviewed in a quieter week, because an unverifiable key may belong to an internal system TruffleHog cannot reach.