TruffleHog
ID trufflehog
detector
TruffleHog is an open-source (AGPL-3.0) secret scanner from Truffle Security that searches git history, file systems, cloud storage and other sources for leaked credentials. Each of its several hundred detectors targets one service and combines keywords with a regular expression; many detectors then call the service's API to check whether the credential is live. The list of supported types covers only the registry datatypes that match a detector.
- Website
- https://github.com/trufflesecurity/trufflehog
- Supported types
- 46
Supported semantic types
| ID | Name | Categories | Countries | Description |
|---|---|---|---|---|
| anthropic_api_key | Anthropic API key draft | secrets | global | Secret key of the Anthropic (Claude) API, sent in the x-api-key header. Standard keys start with sk-ant-api03- and Admin API keys, which... |
| aws_access_key_id | AWS access key ID draft | secrets | global | Public half of an Amazon Web Services access key pair, sent with every signed API request together with the secret access key. It has 20... |
| aws_secret_access_key | AWS secret access key draft | secrets | global | Secret part of an Amazon Web Services access key pair, used with the access key ID to sign API requests (for example to Amazon S3): 40... |
| azure_storage_account_key | Azure Storage account key draft | secrets | global | Access key of an Azure Storage account: 512 bits encoded in Base64, which gives 86 characters followed by two equals signs. |
| cloudflare_origin_ca_key | Cloudflare Origin CA key draft | secrets | global | Key for the Cloudflare Origin CA certificates API, often sent in the X-Auth-User-Service-Key header and also used by the Keyless SSL key... |
| connection_string | Connection string with credentials draft | secrets | global | Connection string of a database or a cloud service that includes a password or an access key, for example Server=...;User... |
| databricks_access_token | Databricks personal access token draft | secrets | global | Personal access token of Databricks, used to authenticate to a Databricks workspace. It starts with dapi followed by 32 hexadecimal... |
| digitalocean_token | DigitalOcean API token draft | secrets | global | API token of DigitalOcean. The prefix tells the token type: dop_v1_ for a personal access token, doo_v1_ for an OAuth access token and... |
| doppler_token | Doppler token draft | secrets | global | Access token of the Doppler secrets manager. Doppler documents one format per token type, each starting with dp. and a type code: dp.pt.... |
| github_fine_grained_pat | GitHub fine-grained personal access token draft | secrets | global | Fine-grained personal access token of GitHub, limited to selected repositories and permissions: github_pat_ followed by 82 letters,... |
| github_token | GitHub token draft | secrets | global | Token issued by GitHub, such as a personal access token. It starts with a prefix that names the token type (ghp_, gho_, ghu_, ghs_ or... |
| gitlab_pat | GitLab personal access token draft | secrets | global | Personal access token of GitLab, which authenticates a user to the GitLab API and to Git over HTTPS. GitLab gives these tokens the... |
| google_api_key | Google API key draft | secrets | global | API key for Google Cloud and Google Maps APIs: the prefix AIza followed by 35 letters, digits, hyphens or underscores. |
| grafana_service_account_token | Grafana service account token draft | secrets | global | Token of a Grafana service account, sent as a bearer token to the Grafana HTTP API: glsa_ followed by 32 letters and digits, an... |
| hashicorp_vault_token | HashiCorp Vault token draft | secrets | global | Token that authenticates a client to HashiCorp Vault. Since Vault 1.10 the prefix names the token type - hvs. for service tokens, hvb.... |
| heroku_oauth_token | Heroku API OAuth access token draft | secrets | global | OAuth access token of the Heroku Platform API, which the Heroku CLI also uses. Tokens granted from April 2024 start with HRKU-: until... |
| huggingface_access_token | Hugging Face access token draft | secrets | global | User access token of the Hugging Face Hub, used in place of a password for git, as a bearer token for Inference Providers and in the... |
| jfrog_api_key | JFrog Artifactory API key draft | secrets | global | Deprecated API key of JFrog Artifactory: the prefix AKCp followed by 69 letters and digits (the format that the gitleaks secret scanner... |
| jfrog_reference_token | JFrog reference token draft | secrets | global | Short token of the JFrog Platform (Artifactory) that refers to a full JWT access token. It has 64 characters: the prefix cmVmd followed... |
| jwt | JSON Web Token (JWT) draft | secrets | global | Compact JSON Web Token (RFC 7519) signed with JWS: three Base64url parts (header, claims and signature) separated by dots. The header... |
| linear_api_key | Linear API key draft | secrets | global | Personal API key of Linear, the issue tracking service: lin_api_ followed by 40 letters and digits. |
| mailchimp_api_key | Mailchimp API key draft | secrets | global | API key of the Mailchimp Marketing API: 32 hexadecimal digits, a hyphen and the data center of the account (for example us6), which is... |
| npm_access_token | npm access token draft | secrets | global | Access token of the npm package registry in the format introduced in 2021: the prefix npm_ followed by 36 letters and digits, the last... |
| openai_api_key | OpenAI API key draft | secrets | global | Secret key of the OpenAI API. Keys start with sk-; project, service account and admin keys start with sk-proj-, sk-svcacct- or... |
| planetscale_password | PlanetScale database password draft | secrets | global | Password of a PlanetScale database: pscale_pw_ followed by 32 to 64 letters, digits and the characters _ = . -. |
| planetscale_token | PlanetScale API token draft | secrets | global | Token for the PlanetScale API and CLI: a service token starts with pscale_tkn_ and an OAuth token with pscale_oauth_. Secret scanners... |
| postman_api_key | Postman API key draft | secrets | global | API key of the Postman API, sent in the X-API-Key header: PMAK- followed by 24 hexadecimal digits, a hyphen and 34 more hexadecimal digits. |
| pulumi_access_token | Pulumi access token draft | secrets | global | Access token of Pulumi Cloud (a personal, organization or team token): pul- followed by 40 hexadecimal digits. |
| pypi_token | PyPI API token draft | secrets | global | API token of the Python Package Index, used to upload packages. It is a serialized macaroon with the prefix pypi-; PyPI documents that... |
| rubygems_api_key | RubyGems API key draft | secrets | global | API key of RubyGems.org, used by the gem CLI to push and manage gems, for example through the GEM_HOST_API_KEY environment variable:... |
| sendgrid_api_key | SendGrid API key draft | secrets | global | API key of Twilio SendGrid, also used as the SMTP password. Keys are always 69 characters long and start with SG. followed by letters,... |
| sendinblue_api_key | Sendinblue API key draft | secrets | global | API key of the Sendinblue email marketing service: xkeysib- followed by 64 hexadecimal digits, a hyphen and 16 letters and digits. |
| sentry_auth_token | Sentry auth token draft | secrets | global | Auth token of Sentry, the error monitoring service. Personal (user) tokens are sntryu_ followed by 64 hexadecimal digits. Organization... |
| shared_access_signature | Azure shared access signature (SAS) draft | secrets | global | Shared access signature of Azure services (Storage, Service Bus, Logic Apps): a URL query string with permissions, an expiry time and a... |
| shopify_access_token | Shopify access token draft | secrets | global | Access token of a Shopify app. The prefix tells the kind of token: shpat_ for an app access token, shpca_ for a custom app and shppa_... |
| slack_token | Slack token draft | secrets | global | Access token of the Slack API. The prefix names the token type, for example xoxb- for bot tokens and xoxp- for user tokens. |
| slack_webhook_url | Slack incoming webhook URL draft | secrets | global | URL of a Slack incoming webhook or workflow trigger on hooks.slack.com. Anyone who knows the URL can post messages to the channel, so... |
| sonarqube_token | SonarQube token draft | secrets | global | Token of SonarQube Server used to run an analysis or call the web API instead of a login and password. Current tokens start with one of... |
| square_access_token | Square access token draft | secrets | global | Personal or OAuth access token of the Square APIs. Square does not document the format; secret scanners such as gitleaks recognize it by... |
| square_oauth_secret | Square OAuth application secret draft | secrets | global | Application secret of a Square developer application, which the application uses to exchange OAuth authorization codes for access... |
| stripe_api_key | Stripe secret or restricted API key draft | secrets | global | Server-side API key of Stripe. Secret keys start with sk_ and restricted keys with rk_, followed by test_ for a sandbox or live_ for... |
| telegram_bot_token | Telegram bot token draft | secrets | global | Token that authorizes a bot in the Telegram Bot API: the numeric bot ID, a colon and a secret that starts with A. Telegram documents the... |
| terraform_cloud_api_token | HashiCorp Terraform Cloud API token draft | secrets | global | User or organization API token of HashiCorp Terraform Cloud: 14 letters and digits, the marker .atlasv1. and 60 to 70 more letters,... |
| twilio_api_key_sid | Twilio API key SID draft | secrets | global | String identifier (SID) of a Twilio API key: SK followed by 32 hexadecimal digits. The SID is used together with the API key secret as... |
| uri_with_password | URI with embedded password PII draft | secrets, internet | global | URI whose user information part contains a password, as in scheme://user:password@host/. RFC 3986 deprecates this form, but database and... |
| x509_private_key | X.509 certificate private key draft | secrets, cryptography | global | Private key of an X.509 certificate, usually written as a PEM block that starts with -----BEGIN PRIVATE KEY----- (or RSA PRIVATE KEY, EC... |
Use this record
- JSON: API v1 · legacy shape
- Improve it: edit
data/tools/detectors/trufflehog.yamlon GitHub