trufflesecurity/trufflehog
Find, verify, and analyze leaked credentials
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
Ranks #1 among Security repositories tracked this week, and #1 over the last 30 days; #15 of 1,950 repositories GStars tracks this week (top 1%).
This week's +171 stars is in line with its 30-day pace of about +144 per week.
5 releases in the last 90 days, the latest 5 days ago, with 206 contributors on GitHub.
Peaked at #14 in the weekly ranking the week of Sep 14, its best in the past year.
Use Cases & Benefits
- Find, verify, classify, and analyze leaked credentials across various data sources including Git repos, cloud storage, chat platforms, and more.
- Provides active verification of over 700 credential types against their APIs to eliminate false positives and confirm live secrets.
- Use for scanning GitHub repositories and organizations to detect and validate exposed secrets in code and commit history.
- Use for continuous monitoring of cloud storage buckets like AWS S3 or Google Cloud Storage for leaked credentials using IAM roles.
- Use for integrating secret scanning into CI/CD pipelines with GitHub Actions or pre-commit hooks to prevent credential leaks before deployment.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
AGPL 3.0
Network copyleft: like the GPL, and also triggered by offering the software over a network.
Community files
- README: present
- Contributing guide: present
- Code of conduct: present
Watch-outs
- AGPL-style copyleft also applies when the software is offered over a network.
General guidance from repository metadata, not legal advice. How we score
From the README
Find leaked credentials.
To learn more about TruffleHog and its features and capabilities, visit our product page.
Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint, and more.. for credentials? We have an enterprise product that can help! Learn more at https://trufflesecurity.com/trufflehog-enterprise.
We take the revenue from the enterprise product to fund more awesome open source projects that the whole community can benefit from.
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
+1,427 stars over 90 days across 31 snapshot days; best day +42 on Sep 12.
Forks
2.6K+144
Open issues
570+69
Compared with peers in Security
Fastest-growing repositories GStars tracks in this cohort for the week of Oct 11, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| vxcontrol/pentagi | 28.2K | +2.7K | 75 | 8 days ago |
| HunxByts/GhostTrack | 18.7K | +1.6K | 75 | — |
| caddyserver/caddy | 77.9K | +577 | 75 | 10 days ago |
| Armur-Ai/Pentest-Swarm-AI | 2.9K | +191 | 75 | 14 days ago |
| trufflesecurity/trufflehog | 28.5K | +171 | 75 | 5 days ago |
| microsoft/agent-governance-toolkit | 6.4K | +0 | 75 | 124 days ago |
| Category median | 18.7K | +577 | 75 | — |
Discover Repositories
Search across tracked repositories by name or description