secret-scan-trufflehog
Secret Scanning with TruffleHog
You are a security engineer running secret detection using TruffleHog to find and verify hardcoded secrets.
When to use
Use this skill when asked to scan for secrets with verification (checking if secrets are still active/valid). TruffleHog can scan git repos, filesystems, S3, and more.
Prerequisites
- TruffleHog installed (
brew install trufflehogorpip install trufflehog) - Verify:
trufflehog --version
Instructions
-
Identify the target — Determine the source to scan.
-
Run the scan:
Git repository:
trufflehog git file://<repo-path> --json > trufflehog-results.jsonFilesystem:
trufflehog filesystem <path> --json > trufflehog-results.jsonGitHub org/repo (remote):
trufflehog github --org=<org-name> --json > trufflehog-results.json- Only verified secrets:
trufflehog git file://. --only-verified --json - Exclude paths:
--exclude-paths=<exclude-file>
- Only verified secrets:
-
Parse the results — Read JSON output and present findings:
| # | Detector | Verified | File | Commit | Raw (redacted) | Severity |
|---|----------|----------|------|--------|----------------|----------|
IMPORTANT: Always redact secret values. Never display full secrets.
- Summarize — Provide:
- Total findings: verified (active) vs unverified
- Verified secrets require immediate rotation
- Remediation priority: verified active secrets first
- Steps: rotate, revoke, remove from history (
git filter-branchor BFG)
More from vchirrav/owasp-secure-coding-md
mobile-security-mobsf
Run MobSF (Mobile Security Framework) for automated static and dynamic analysis of Android and iOS apps. Detects insecure storage, weak crypto, hardcoded secrets, and permission issues.
14sast-eslint-security
Run ESLint with security plugins on JavaScript/TypeScript code. Detects eval usage, non-literal RegExp, prototype pollution, and other JS/TS security anti-patterns.
5api-security-schemathesis
Run Schemathesis for property-based API security testing. Generates test cases from OpenAPI/GraphQL schemas to find crashes, 500 errors, and spec violations.
4sbom-syft
Run Syft to generate Software Bill of Materials (SBOM) from container images and filesystems. Outputs CycloneDX or SPDX formats for supply chain compliance.
3secret-scan-gitleaks
Run Gitleaks to detect hardcoded secrets in git repositories. Finds API keys, tokens, passwords, and credentials in code and git history.
3network-scan-nmap
Run Nmap for network discovery and security auditing. Performs port scanning, service detection, OS fingerprinting, and vulnerability script scanning.
3