$ man trufflehog

TruffleHog

Find secrets and check whether they still work.

fix at sourcepassive / local only

## why a developer should care

Verifies found keys against the provider, so you know which leaks are live and need rotating today. Point it at your GitHub organisation to see what an attacker would see.

## install

$ brew install trufflehog

Other platforms and pre-built binaries: official install guide ↗

Check it worked: open a new terminal and run trufflehog --version. "command not found" means it isn't installed or isn't on your PATH yet.

## shortcuts

GitHub org:

# This repo, verified secrets only

$ trufflehog git file://. --only-verified

# All public repos of your organisation

$ trufflehog github --org={{target}} --only-verified

## helps with

A04 Cryptographic Failures

→ official docs · ← all tools