trufflehog

TruffleHog finds leaked credentials (API keys, passwords, tokens) then tries each one to see if it still works. That verification is the whole point: instead of a wall of random-looking strings, you get a short list of live secrets to rotate. It classifies 800+ secret types, and the CLI is free under AGPLv3.

It's a single Go binary from brew, Docker or a release download. It scans git history, GitHub and GitLab orgs, S3 and GCS buckets, Docker images, filesystems, Postman, Jenkins and Hugging Face. Add --results=verified --fail in CI to fail the build on a live key.

TruffleHog Enterprise adds continuous monitoring of Slack, Jira, Confluence, Teams and SharePoint, a dashboard, SSO, RBAC and revocation tracking. Pricing is contact-sales only. Solo, small and medium teams: the free CLI plus pre-commit hooks covers code. Large orgs: Enterprise, once secrets leak in chat and tickets.

The catch: verification sends every candidate secret to its provider's API; use --no-verification when that's off-limits. The official GitHub Action also let pull request authors hide real findings until v3.98.0, so pin a patched release. Gitleaks (now also run by Truffle Security) is the lighter MIT option; Betterleaks, MIT too, validates secrets as well.