For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

Cost

Open source. AGPL-3.0 licence, free to run in your own builds.

How to do it

TruffleHog first came out in December 2016, and its 1.0.0 reached PyPI in February 2017. Version 3.0, a rewrite in Go under AGPL-3.0, came out in April 2022. Version 3.99.3 shipped on 19 October 2026, and its GitHub repository had about 28,600 stars. It knows over 800 secret types and tests each found key against its provider, which separates live keys from dead ones. Gitleaks now fails the maintenance test. Its README says it is feature complete and gets security patches only, and 8.30.1 on 21 March 2026 was its last release. Replace any key it finds, as Keep secrets out of code says. Choose something else when your policy bars AGPL-3.0 tools in the build. Betterleaks, from the author of gitleaks, is MIT, but in October 2026 its 2.0 had only release candidates.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

Shell example

# Pull request: only the new commits
trufflehog git file://. --since-commit main --branch "$PR_BRANCH" --results=verified,unknown --fail
# Once, and after any leak: the full history
trufflehog git file://. --results=verified,unknown --fail

YAML example

# .github/workflows/secrets.yml
on: pull_request
jobs:
  trufflehog:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with: { fetch-depth: 0 }
      - run: docker run --rm -v "$PWD:/repo" trufflesecurity/trufflehog:3.99.3 git file:///repo --since-commit origin/main --results=verified,unknown --fail

How to check

Every pull request runs trufflehog git with --results=verified,unknown --fail. A run over the full history exits 0.

Sources

• TruffleHog

Related rules

• Keep secrets out of code in Security testing