---
title: "Use TruffleHog to find leaked secrets · Agent Wranglers"
url: https://agentwranglers.se/playbook/stack/testing-and-code-quality/secret-scanner
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Use TruffleHog to find leaked secrets

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

For AI agents: [llms.txt](https://agentwranglers.se/llms.txt) is a short guide that sends you to the rules your problem needs, and [rules.json](https://agentwranglers.se/playbook/stack/rules.json) holds every rule of this playbook as JSON.

- Level: Recommended
- Chapter: [Testing and code quality](https://agentwranglers.se/playbook/stack/testing-and-code-quality)
- Rule: Scan every pull request and the full Git history for secrets with TruffleHog, and fail the build on any verified or unknown finding.
- Cost: Open source. AGPL-3.0 licence, free to run in your own builds.
- How: TruffleHog first came out in December 2016, and its 1.0.0 reached PyPI in February 2017. Version 3.0, a rewrite in Go under AGPL-3.0, came out in April 2022. Version 3.99.3 shipped on 19 October 2026, and its GitHub repository had about 28,600 stars. It knows over 800 secret types and tests each found key against its provider, which separates live keys from dead ones. Gitleaks now fails the maintenance test. Its README says it is feature complete and gets security patches only, and 8.30.1 on 21 March 2026 was its last release. Replace any key it finds, as [Keep secrets out of code](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code) says. Choose something else when your policy bars AGPL-3.0 tools in the build. Betterleaks, from the author of gitleaks, is MIT, but in October 2026 its 2.0 had only release candidates.
- Check: Every pull request runs `trufflehog git` with `--results=verified,unknown --fail`. A run over the full history exits 0.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
# Pull request: only the new commits
trufflehog git file://. --since-commit main --branch "$PR_BRANCH" --results=verified,unknown --fail
# Once, and after any leak: the full history
trufflehog git file://. --results=verified,unknown --fail
```

### YAML example

```yaml
# .github/workflows/secrets.yml
on: pull_request
jobs:
  trufflehog:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with: { fetch-depth: 0 }
      - run: docker run --rm -v "$PWD:/repo" trufflesecurity/trufflehog:3.99.3 git file:///repo --since-commit origin/main --results=verified,unknown --fail
```

## Sources

- [TruffleHog](https://github.com/trufflesecurity/trufflehog)

## Related rules

- [Keep secrets out of code](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code) in Security testing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/stack/testing-and-code-quality/secret-scanner">Agent Wranglers software choices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Use Semgrep for static security scans](https://agentwranglers.se/playbook/stack/testing-and-code-quality/semgrep)
- [Testing and code quality](https://agentwranglers.se/playbook/stack/testing-and-code-quality)