trufflehog
Adopt now+389 this week★ 27,622 · 2,557 forks
Finds leaked credentials in code
Mature enough to put in production this quarter.
Who it's for
Small teams with public codebases
What it replaces
Manual credential audits
The catch
AGPL-3.0 license may restrict commercial use
Your first hour
Run trufflehog against a test repository
Licence check
AGPL-3.0. If you run a modified version as part of a service you offer to others, you may be required to publish your source. Many companies buy a commercial licence instead.
This is a reading of the licence label, not legal advice.
The numbers
Stars27,622
Forks2,557
Stars added (7d)+389
Open issues525
LanguageGo
LicenceAGPL-3.0
Last pushUpdated today
Project age10 years old
Maintainers describe it as: “Find, verify, and analyze leaked credentials”
credentialsdevsecopsdynamic-analysisprecommitscanningsecretsecret-managementsecretssecuritysecurity-tools
trufflehog, in short
- Should a small team use trufflehog?
- Adopt now. Mature enough to put in production this quarter. Small teams with public codebases
- What does trufflehog actually do?
- Finds leaked credentials in code
- What does trufflehog replace?
- Manual credential audits
- What is the downside of trufflehog?
- AGPL-3.0 license may restrict commercial use
- Can trufflehog be used in a commercial product?
- Its licence is AGPL-3.0, which carries obligations or restrictions for commercial use. Read the LICENSE file, and get a lawyer's read before you ship it inside a product you sell.