768 leaked AWS keys. Full admin rights. Still active. See how TruffleHog AWS Analyze shows you exactly what a leaked key can reach.

TRUFFLEHOG

COMPANY

RESOURCES

768 leaked AWS keys. Full admin rights. Still active. See how TruffleHog AWS Analyze shows you exactly what a leaked key can reach.

Make

Make secrets easier.

secrets easier.

TruffleHog™ uncovers exposed non-human identities (NHIs) and their secrets, making it easier for security teams to prioritize risk and remediate faster.

TruffleHog enterprise

TruffleHog open-source

Trusted by dev and security TEAMS at some of the most innovative companies

Millions of leaked secrets

Millions NHIs and its secrets, including API keys, passwords, and tokens, are frequently leaking from sources like source code, chat systems, support tickets, and more, underscoring the need for robust secret leak detection.

Read our research

TruffleHog digs deep

TruffleHog scans for sensitive credentials beyond the source code to include hidden content, deleted code, and version history from GitHub, Google Cloud, Slack, and more commonly used tools across your company.

TruffleHog enterprise

TruffleHog open-source

Secrets detection

TruffleHog sniffs out secrets everywhere: even the nooks and crannies of your GitHub comments and pull requests. TruffleHog supports the most complete list of integrations to scan across your entire SDLC.

Secrets verification

TruffleHog scans 800+ credential types, directly verified with key providers for unmatched scan accuracy - unearthing exposed, live, at-risk secrets.

In-depth analysis

TruffleHog Analyze automatically identifies the resources and permissions associated with NHIs, API key and other secrets without requiring access to a provider’s UI, reducing time to remediation.

Continuous monitoring

TruffleHog continuously tracks the status of all key types to identify whether remediation has occurred. Set up alerts across the platform of your choosing and include customized messages for developers to rotate and secure keys.

Shift left

With TruffleHog, security teams can make it easier for developers to revoke leaked secrets by providing them with an automatic process. Each fix is automatically reverified, giving security teams confidence that problems are resolved for good.

Over 250K daily runs by developers and security teams

With over 250,000 daily runs and 23,000 GitHub stars, TruffleHog is relied on by thousands of developers and security teams every day.

TruffleHog Enterprise extends that same trusted engine with enterprise-grade visibility, verification, and collaboration tools to help teams manage NHI and their secrets.

TruffleHog enterprise

TruffleHog open-source

250K+

Daily runs

23K+

GitHub stars

Klaviyo cuts through the noise with TruffleHog Enterprise

"TruffleHog doesn’t just tell us there’s a secret; it identifies what it is and where it came from. That makes the data actionable and builds genuine trust with our developers.”

Dominic Bunch, Security Engineering Manager

See how Klaviyo eliminated false alerts and used actionable context to remediate 200+ high-impact secrets.

Read the case study

Klaviyo cuts through the noise with TruffleHog Enterprise

"TruffleHog doesn’t just tell us there’s a secret; it identifies what it is and where it came from. That makes the data actionable and builds genuine trust with our developers.”

Dominic Bunch, Security Engineering Manager

See how Klaviyo eliminated false alerts and used actionable context to remediate 200+ high-impact secrets.

Read the case study