TRUFFLEHOG(1)

NAME
trufflehog - find credentials in various sources

SYNOPSIS

trufflehog [<flags>] <command> [<args> ...]

DESCRIPTION
TruffleHog is a tool for finding credentials. Run without a command for interactive mode.

TruffleHog scans various data sources for verified and unverified secrets such as API keys, passwords, and other credentials. It supports scanning git repositories, GitHub and GitLab organizations, filesystems, S3 buckets, GCS buckets, Docker images, CI/CD systems, and more.

When run without a command in an interactive terminal, trufflehog launches a TUI (text user interface) that guides you through selecting a scan source and configuring options.

OPTIONS

-h, --help
    Show context-sensitive help (also try --help-long and --help-man).

--log-level=0
    Logging verbosity on a scale of 0 (info) to 5 (trace). Can be disabled with "-1".

--profile
    Enables profiling and sets a pprof and fgprof server on :18066.

-j, --json
    Output in JSON format.

--json-legacy
    Use the pre-v3.0 JSON format. Only works with git, gitlab, and github sources.

--github-actions
    Output in GitHub Actions format.

--concurrency=N
    Number of concurrent workers.

--no-verification
    Don't verify the results.

--results=RESULTS
    Specifies which type(s) of results to output: verified (confirmed valid by API), unknown (verification failed due to error), unverified (detected but not verified), filtered_unverified (unverified but would have been filtered out). Defaults to verified,unverified,unknown.

--no-color
    Disable colorized output

--allow-verification-overlap
    Allow verification of similar credentials across detectors

--filter-unverified
    Only output first unverified result per chunk per detector if there are more than one results.

--filter-entropy=FILTER-ENTROPY
    Filter unverified results with Shannon entropy. Start with 3.0.

--max-decode-depth=5
    Maximum depth of iterative decoding. Each decoder's output is fed back through all decoders, up to this limit. 1 = single pass, 2+ = chained decoding (e.g., base64 inside utf16).

--config=CONFIG
    Path to configuration file.

--print-avg-detector-time
    Print the average time spent on each detector.

--no-update
    Don't check for updates.

--fail
    Exit with code 183 if results are found.

--fail-on-scan-errors
    Exit with non-zero error code if an error occurs during the scan.

--verifier=VERIFIER
    Set custom verification endpoints.

--custom-verifiers-only
    Only use custom verification endpoints.

--detector-timeout=DETECTOR-TIMEOUT
    Maximum time to spend scanning chunks per detector (e.g., 30s).

--archive-max-size=ARCHIVE-MAX-SIZE
    Maximum size of archive to scan. (Byte units eg. 512B, 2KB, 4MB)

--archive-max-depth=ARCHIVE-MAX-DEPTH
    Maximum depth of archive to scan.

--archive-timeout=ARCHIVE-TIMEOUT
    Maximum time to spend extracting an archive.

--include-detectors="all"
    Comma separated list of detector types to include. Protobuf name or IDs may be used, as well as ranges.

--exclude-detectors=EXCLUDE-DETECTORS
    Comma separated list of detector types to exclude. Protobuf name or IDs may be used, as well as ranges. IDs defined here take precedence over the include list.

--no-verification-cache
    Disable verification caching

--force-skip-binaries
    Force skipping binaries.

--force-skip-archives
    Force skipping archives.

--skip-additional-refs
    Skip additional references.

--user-agent-suffix=USER-AGENT-SUFFIX
    Suffix to add to User-Agent.

--version
    Show application version.

COMMANDS

  help [<command>...]
Show help.

  git [<flags>] <uri>
Find credentials in git repositories.

-i, --include-paths=INCLUDE-PATHS
    Path to file with newline separated regexes for files to include in scan.

-x, --exclude-paths=EXCLUDE-PATHS
    Path to file with newline separated regexes for files to exclude in scan.

--exclude-globs=EXCLUDE-GLOBS
    Comma separated list of globs to exclude in scan. This option filters at the `git log` level, resulting in faster scans.

--since-commit=SINCE-COMMIT
    Commit to start scan from.

--branch=BRANCH
    Branch to scan.

--max-depth=MAX-DEPTH
    Maximum depth of commits to scan.

--bare
    Scan bare repository (e.g. useful while using in pre-receive hooks)

--clone-path=CLONE-PATH
    Custom path where the repository should be cloned (default: temp dir).

--no-cleanup
    Do not delete cloned repositories after scanning (can only be used with --clone-path).

--trust-local-git-config
    Trust local git config.

--allow
    No-op flag for backwards compat.

--entropy
    No-op flag for backwards compat.

--regex
    No-op flag for backwards compat.

  github [<flags>]
Find credentials in GitHub repositories.

--endpoint="https://api.github.com"
    GitHub endpoint.

--repo=REPO
    GitHub repository to scan. You can repeat this flag. Example: "https://github.com/dustin-decker/secretsandstuff"

--org=ORG
    GitHub organization to scan. You can repeat this flag. Example: "trufflesecurity"

--token=TOKEN
    GitHub token. Can be provided with environment variable GITHUB_TOKEN.

--include-forks
    Include forks in scan.

--include-members
    Include organization member repositories in scan.

--include-repos=INCLUDE-REPOS
    Repositories to include in an org scan. This can also be a glob pattern. You can repeat this flag. Must use Github repo full name. Example: "trufflesecurity/trufflehog", "trufflesecurity/t*"

--include-wikis
    Include repository wikisin scan.

--exclude-repos=EXCLUDE-REPOS
    Repositories to exclude in an org scan. This can also be a glob pattern. You can repeat this flag. Must use Github repo full name. Example: "trufflesecurity/driftwood", "trufflesecurity/d*"

-i, --include-paths=INCLUDE-PATHS
    Path to file with newline separated regexes for files to include in scan.

-x, --exclude-paths=EXCLUDE-PATHS
    Path to file with newline separated regexes for files to exclude in scan.

--issue-comments
    Include issue descriptions and comments in scan.

--pr-comments
    Include pull request descriptions and comments in scan.

--gist-comments
    Include gist comments in scan.

--comments-timeframe=COMMENTS-TIMEFRAME
    Number of days in the past to review when scanning issue, PR, and gist comments.

--auth-in-url
    Embed authentication credentials in repository URLs instead of using secure HTTP headers

--clone-path=CLONE-PATH
    Custom path where the repository should be cloned (default: temp dir).

--no-cleanup
    Do not delete cloned repositories after scanning (can only be used with --clone-path).

--ignore-gists
    Ignore all gists in scan.

  github-experimental --repo=REPO [<flags>]
Run an experimental GitHub scan. Must specify at least one experimental sub-module to run: object-discovery.

--object-discovery
    Discover hidden data objects in GitHub repositories.

--token=TOKEN
    GitHub token. Can be provided with environment variable GITHUB_TOKEN.

--repo=REPO
    GitHub repository to scan. Example: https://github.com/<user>/<repo>.git

--collision-threshold=1
    Threshold for short-sha collisions in object-discovery submodule. Default is 1.

--delete-cached-data
    Delete cached data after object-discovery secret scanning.

  gitlab --token=TOKEN [<flags>]
Find credentials in GitLab repositories.

--endpoint="https://gitlab.com"
    GitLab endpoint.

--repo=REPO
    GitLab repo url. You can repeat this flag. Leave empty to scan all repos accessible with provided credential. Example: https://gitlab.com/org/repo.git

--token=TOKEN
    GitLab token. Can be provided with environment variable GITLAB_TOKEN.

--group-id=GROUP-ID
    GitLab group ID. If provided, it will scan the group and its subgroups. You can repeat this flag.

-i, --include-paths=INCLUDE-PATHS
    Path to file with newline separated regexes for files to include in scan.

-x, --exclude-paths=EXCLUDE-PATHS
    Path to file with newline separated regexes for files to exclude in scan.

--include-repos=INCLUDE-REPOS
    Repositories to include in an org scan. This can also be a glob pattern. You can repeat this flag. Must use Gitlab repo full name. Example: "trufflesecurity/trufflehog", "trufflesecurity/t*"

--exclude-repos=EXCLUDE-REPOS
    Repositories to exclude in an org scan. This can also be a glob pattern. You can repeat this flag. Must use Gitlab repo full name. Example: "trufflesecurity/driftwood", "trufflesecurity/d*"

--auth-in-url
    Embed authentication credentials in repository URLs instead of using secure HTTP headers

--clone-path=CLONE-PATH
    Custom path where the repository should be cloned (default: temp dir)

--no-cleanup
    Do not delete cloned repositories after scanning (can only be used with --clone-path).

  filesystem [<flags>] [<path>...]
Find credentials in a filesystem.

--directory=DIRECTORY
    Path to directory to scan. You can repeat this flag.

-i, --include-paths=INCLUDE-PATHS
    Path to file with newline separated regexes for files to include in scan.

-x, --exclude-paths=EXCLUDE-PATHS
    Path to file with newline separated regexes for files to exclude in scan.

-s, --max-symlink-depth=MAX-SYMLINK-DEPTH
    Maximum depth to follow symlinks during filesystem scan.

  s3 [<flags>]
Find credentials in S3 buckets.

--key=KEY
    S3 key used to authenticate. Can be provided with environment variable AWS_ACCESS_KEY_ID.

--role-arn=ROLE-ARN
    Specify the ARN of an IAM role to assume for scanning. You can repeat this flag.

--secret=SECRET
    S3 secret used to authenticate. Can be provided with environment variable AWS_SECRET_ACCESS_KEY.

--session-token=SESSION-TOKEN
    S3 session token used to authenticate temporary credentials. Can be provided with environment variable AWS_SESSION_TOKEN.

--cloud-environment
    Use IAM credentials in cloud environment.

--bucket=BUCKET
    Name of S3 bucket to scan. You can repeat this flag. Incompatible with --ignore-bucket.

--ignore-bucket=IGNORE-BUCKET
    Name of S3 bucket to ignore. You can repeat this flag. Incompatible with --bucket.

--max-object-size=250MB
    Maximum size of objects to scan. Objects larger than this will be skipped. (Byte units eg. 512B, 2KB, 4MB)

  gcs [<flags>]
Find credentials in GCS buckets.

--project-id=PROJECT-ID
    GCS project ID used to authenticate. Can NOT be used with unauth scan. Can be provided with environment variable GOOGLE_CLOUD_PROJECT.

--cloud-environment
    Use Application Default Credentials, IAM credentials to authenticate.

--service-account=SERVICE-ACCOUNT
    Path to GCS service account JSON file.

--without-auth
    Scan GCS buckets without authentication. This will only work for public buckets

--api-key=API-KEY
    GCS API key used to authenticate. Can be provided with environment variable GOOGLE_API_KEY.

-I, --include-buckets=INCLUDE-BUCKETS
    Buckets to scan. Comma separated list of buckets. You can repeat this flag. Globs are supported

-X, --exclude-buckets=EXCLUDE-BUCKETS
    Buckets to exclude from scan. Comma separated list of buckets. Globs are supported

-i, --include-objects=INCLUDE-OBJECTS
    Objects to scan. Comma separated list of objects. you can repeat this flag. Globs are supported

-x, --exclude-objects=EXCLUDE-OBJECTS
    Objects to exclude from scan. Comma separated list of objects. You can repeat this flag. Globs are supported

--max-object-size=10MB
    Maximum size of objects to scan. Objects larger than this will be skipped. (Byte units eg. 512B, 2KB, 4MB)

  syslog --format=FORMAT [<flags>]
Scan syslog

--address=ADDRESS
    Address and port to listen on for syslog. Example: 127.0.0.1:514

--protocol=PROTOCOL
    Protocol to listen on. udp or tcp

--cert=CERT
    Path to TLS cert.

--key=KEY
    Path to TLS key.

--format=FORMAT
    Log format. Can be rfc3164 or rfc5424

  circleci --token=TOKEN
Scan CircleCI

--token=TOKEN
    CircleCI token. Can also be provided with environment variable

  docker [<flags>]
Scan Docker Image

--image=IMAGE
    Docker image to scan. Use the file:// prefix to point to a local tarball, the docker:// prefix to point to the docker daemon, otherwise an image registry is assumed.

--token=TOKEN
    Docker bearer token. Can also be provided with environment variable

--exclude-paths=EXCLUDE-PATHS
    Comma separated list of paths to exclude from scan

--namespace=NAMESPACE
    Docker namespace (organization or user). For non-Docker Hub registries, include the registry address as well (e.g., ghcr.io/namespace or quay.io/namespace).

--registry-token=REGISTRY-TOKEN
    Optional Docker registry access token. Provide this if you want to include private images within the specified namespace.

  travisci --token=TOKEN
Scan TravisCI

--token=TOKEN
    TravisCI token. Can also be provided with environment variable

  postman [<flags>]
Scan Postman

--token=TOKEN
    Postman token. Can also be provided with environment variable

--workspace-id=WORKSPACE-ID
    Postman workspace ID to scan. You can repeat this flag.

--collection-id=COLLECTION-ID
    Postman collection ID to scan. You can repeat this flag.

--environment=ENVIRONMENT
    Postman environment to scan. You can repeat this flag.

--include-collection-id=INCLUDE-COLLECTION-ID
    Collection ID to include in scan. You can repeat this flag.

--include-environments=INCLUDE-ENVIRONMENTS
    Environments to include in scan. You can repeat this flag.

--exclude-collection-id=EXCLUDE-COLLECTION-ID
    Collection ID to exclude from scan. You can repeat this flag.

--exclude-environments=EXCLUDE-ENVIRONMENTS
    Environments to exclude from scan. You can repeat this flag.

--workspace-paths=WORKSPACE-PATHS
    Path to Postman workspaces.

--collection-paths=COLLECTION-PATHS
    Path to Postman collections.

--environment-paths=ENVIRONMENT-PATHS
    Path to Postman environments.

  elasticsearch [<flags>]
Scan Elasticsearch

--nodes=NODES
    Elasticsearch nodes

--username=USERNAME
    Elasticsearch username

--password=PASSWORD
    Elasticsearch password

--service-token=SERVICE-TOKEN
    Elasticsearch service token

--cloud-id=CLOUD-ID
    Elasticsearch cloud ID. Can also be provided with environment variable

--api-key=API-KEY
    Elasticsearch API key. Can also be provided with environment variable

--index-pattern="*"
    Filters the indices to search

--query-json=QUERY-JSON
    Filters the documents to search

--since-timestamp=SINCE-TIMESTAMP
    Filters the documents to search to those created since this timestamp; overrides any timestamp from --query-json

--best-effort-scan
    Attempts to continuously scan a cluster

  jenkins --url=URL [<flags>]
Scan Jenkins

--url=URL
    Jenkins URL

--username=USERNAME
    Jenkins username

--password=PASSWORD
    Jenkins password

--insecure-skip-verify-tls
    Skip TLS verification

  huggingface [<flags>]
Find credentials in HuggingFace datasets, models and spaces.

--endpoint="https://huggingface.co"
    HuggingFace endpoint.

--model=MODEL
    HuggingFace model to scan. You can repeat this flag. Example: 'username/model'

--space=SPACE
    HuggingFace space to scan. You can repeat this flag. Example: 'username/space'

--dataset=DATASET
    HuggingFace dataset to scan. You can repeat this flag. Example: 'username/dataset'

--org=ORG
    HuggingFace organization to scan. You can repeat this flag. Example: "trufflesecurity"

--user=USER
    HuggingFace user to scan. You can repeat this flag. Example: "trufflesecurity"

--token=TOKEN
    HuggingFace token. Can be provided with environment variable HUGGINGFACE_TOKEN.

--include-models=INCLUDE-MODELS
    Models to include in scan. You can repeat this flag. Must use HuggingFace model full name. Example: 'username/model' (Only used with --user or --org)

--include-spaces=INCLUDE-SPACES
    Spaces to include in scan. You can repeat this flag. Must use HuggingFace space full name. Example: 'username/space' (Only used with --user or --org)

--include-datasets=INCLUDE-DATASETS
    Datasets to include in scan. You can repeat this flag. Must use HuggingFace dataset full name. Example: 'username/dataset' (Only used with --user or --org)

--ignore-models=IGNORE-MODELS
    Models to ignore in scan. You can repeat this flag. Must use HuggingFace model full name. Example: 'username/model' (Only used with --user or --org)

--ignore-spaces=IGNORE-SPACES
    Spaces to ignore in scan. You can repeat this flag. Must use HuggingFace space full name. Example: 'username/space' (Only used with --user or --org)

--ignore-datasets=IGNORE-DATASETS
    Datasets to ignore in scan. You can repeat this flag. Must use HuggingFace dataset full name. Example: 'username/dataset' (Only used with --user or --org)

--skip-all-models
    Skip all model scans. (Only used with --user or --org)

--skip-all-spaces
    Skip all space scans. (Only used with --user or --org)

--skip-all-datasets
    Skip all dataset scans. (Only used with --user or --org)

--include-discussions
    Include discussions in scan.

--include-prs
    Include pull requests in scan.

  stdin
Find credentials from stdin.

  multi-scan
Find credentials in multiple sources defined in configuration.

  json-enumerator [<path>...]
Find credentials from a JSON enumerator input.

  analyze
Analyze API keys for fine-grained permissions information.

EXIT STATUS

0   Successful execution.

183 Credentials were found and --fail was specified.

1   An error occurred during scanning.

EXAMPLES

Launch the interactive TUI
        trufflehog

Scan a git repository
        trufflehog git https://github.com/example/repo.git

Scan a GitHub organization
        trufflehog github --org=trufflesecurity --token=$GITHUB_TOKEN

Scan a local filesystem
        trufflehog filesystem /path/to/directory

Scan an S3 bucket
        trufflehog s3 --bucket=my-bucket --cloud-environment

Scan a Docker image
        trufflehog docker --image=myregistry/myimage:latest

Read from stdin
        cat secrets.txt | trufflehog stdin

Output JSON and filter with jq
        trufflehog git https://github.com/example/repo.git --json \
          | jq 'select(.Verified == true)'

Fail in CI if secrets are found
        trufflehog git file://. --fail --results=verified,unknown

Use a configuration file
        trufflehog git https://github.com/example/repo.git \
          --config=trufflehog-config.yaml

ENVIRONMENT

GITHUB_TOKEN
    Authentication token for GitHub scanning.

GITLAB_TOKEN
    Authentication token for GitLab scanning.

AWS_ACCESS_KEY_ID
    AWS access key for S3 scanning.

AWS_SECRET_ACCESS_KEY
    AWS secret key for S3 scanning.

AWS_SESSION_TOKEN
    AWS session token for temporary credentials.

GOOGLE_CLOUD_PROJECT
    GCP project ID for GCS scanning.

GOOGLE_API_KEY
    GCP API key for GCS scanning.

CIRCLECI_TOKEN
    Authentication token for CircleCI scanning.

DOCKER_TOKEN
    Authentication token for Docker scanning.

TRAVISCI_TOKEN
    Authentication token for TravisCI scanning.

POSTMAN_TOKEN
    Authentication token for Postman scanning.

HUGGINGFACE_TOKEN
    Authentication token for HuggingFace scanning.

ELASTICSEARCH_NODES
    Comma-separated list of Elasticsearch nodes.

JENKINS_URL
    URL of the Jenkins server.

FILES

trufflehog-config.yaml
    Optional configuration file specified via --config. See the project documentation for the configuration file format.

BUGS
Report bugs at the TruffleHog issue tracker (https://github.com/trufflesecurity/trufflehog/issues).

SEE ALSO
TruffleHog on GitHub (https://github.com/trufflesecurity/trufflehog), Truffle Security website (https://trufflesecurity.com).