Freedom251 › Secrets Scanning Software
TruffleHog
What TruffleHog is
TruffleHog scans code repositories and other sources for exposed secrets, passwords, and sensitive keys. It searches version history across branches and can find credentials in comments, Docker images, and other locations. For detected credentials, it checks the relevant protocol or API to determine whether they are live, which can help reduce false positives. TruffleHog Analyze identifies resources and permissions associated with API keys and other secrets without requiring access to a provider’s interface. Pre-commit and pre-receive hooks can scan before changes are committed, while alerts can direct teams to credential rotation and security guidance. Integrations include source-control services, Docker, Jenkins, collaboration tools, and cloud storage; notifications can go through Slack, Jira, Splunk, webhooks, email, or stdout. The open-source plan costs nothing and includes 800+ secret detectors and scanning for GitHub, S3, directories, GCS, and Docker. Deployment options include the company’s isolated servers or on-premises.
Who it suits
It suits development and security teams that need to scan repositories, CI/CD workflows, or other sources for exposed credentials. Teams can choose the open-source plan or consider Enterprise for on-premises deployment and listed integrations.
What it does well
- Scans version history across branches.
- Verifies whether detected credentials are live.
- Includes pre-commit and pre-receive scanning hooks.
- Open-source plan includes 800+ secret detectors.
- Supports on-premises or company-server deployment.
What to know first
- Open-source license is AGPL-3.0.
- Enterprise priority support is limited to that plan.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Open-source | GitHub, S3, directory, GCS, and Docker scanning · 800+ secret detectors · GitHub Actions, pre-commit, and pre-receive hooks · custom regex and secret verification · automatic updates | Free |
| Enterprise | 20+ integrations · on-premises or cloud scanning · continuous monitoring · Analyze for SaaS and Cloud add-ons · Forager add-on · SSO · role-based access control · onboarding and priority technical support | On request |
As trufflesecurity.com lists them, read 30 Sept 2026. The maker's own page has the final word.
Verdict
TruffleHog combines secret discovery with credential verification and ways to route findings to teams. The free open-source plan includes multiple scanning sources; organizations needing Enterprise features should request pricing details.
Facts from TruffleHog's own pages
- Analysis
- TruffleHog Analyze identifies the resources and permissions associated with API keys and other secrets without requiring access to a provider’s UI. · trufflesecurity.com, 30 Sept 2026
- Company
- Truffle Security Co. identifies itself as the company behind TruffleHog, and its website footer says “Since 2021.” · trufflesecurity.com, 30 Sept 2026
- Deployment options
- The product can run on the company’s isolated servers or on-premises, where scanners can reach internal sources and source credentials can remain in the customer’s infrastructure. · trufflesecurity.com, 30 Sept 2026
- Deployment security
- The company says each customer installation has a private environment and isolated database encrypted at rest, and deployments receive randomly generated infrastructure credentials. · trufflesecurity.com, 30 Sept 2026
- Detection
- It scans version history across branches and can find secrets in comments, Docker images, and other locations beyond repositories. · trufflesecurity.com, 30 Sept 2026
- Founded
- 2021 · trufflesecurity.com, 23 Sept 2026
- Integrations
- The integrations page lists GitHub, GitLab, Bitbucket, Gerrit, Docker, Jenkins, Slack, Teams, Jira, Confluence, Google Drive, S3, and SharePoint, among others. · trufflesecurity.com, 30 Sept 2026
- Notifications
- When a secret is discovered, TruffleHog can send a Slack message, create a Jira ticket, or use Splunk, webhooks, email, and stdout. · trufflesecurity.com, 30 Sept 2026
- Open-source license
- The project’s GitHub repository identifies its license as AGPL-3.0. · github.com, 30 Sept 2026
- Operating systems
- The project documents Homebrew installation for macOS, Windows Docker examples, and binary releases; its installer supports Darwin, Linux, and Windows on amd64 and arm64. · github.com, 30 Sept 2026
- Prevention and remediation
- Pre-commit and pre-receive hooks can scan before commits, and alerts can link to credential rotation and security guides. · trufflesecurity.com, 30 Sept 2026
- Purpose
- TruffleHog scans code repositories and other sources to find exposed secrets, passwords, and sensitive keys. · trufflesecurity.com, 30 Sept 2026
- Secret handling
- The company says scanning occurs in memory and it stores only finding location metadata and redacted credential information, not the secrets themselves. · trufflesecurity.com, 30 Sept 2026
- Support
- The Enterprise plan lists deployment and onboarding support plus ongoing priority technical support. · trufflesecurity.com, 30 Sept 2026
- Verification
- For detected credentials, TruffleHog uses their protocol or API to verify whether they are live and reduce false positives. · trufflesecurity.com, 30 Sept 2026
Where TruffleHog stands on Freedom251
- Secrets Scanning Software#16 of 24