TruffleHog finds API keys, passwords and other secrets in Git history,
local files and cloud services. It can verify detected credentials and
report results as text, JSON or SARIF.
Run trufflehog for the interactive terminal interface, or scan a project:
trufflehog filesystem ~/projects/my-project --no-verification
trufflehog git file://$HOME/projects/my-project --no-verification
Files must be in accessible home directories. For removable storage:
sudo snap connect trufflehog:removable-media
Credential verification contacts the corresponding services unless
--no-verification is set. Application updates are managed by snapd.