Skip to content

Commit 8f114e7

Browse files
kellydunnkellydunn
authored
Merge branch 'main' into gha-fix
2 parents cfe9e00 + b84c3d1 commit 8f114e7

File tree

119 files changed

+6069
-2189
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

119 files changed

+6069
-2189
lines changed

‎README.md‎

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ This requires Cosign binary to be installed prior to running the installation sc
185185
Command:
186186

187187
```bash
188-
trufflehog git https://github.com/trufflesecurity/test_keys --results=verified,unknown
188+
trufflehog git https://github.com/trufflesecurity/test_keys --results=verified
189189
```
190190

191191
Expected output:
@@ -209,15 +209,15 @@ Timestamp: 2022-06-16 10:17:40 -0700 PDT
209209
## 2: Scan a GitHub Org for only verified secrets
210210

211211
```bash
212-
trufflehog github --org=trufflesecurity --results=verified,unknown
212+
trufflehog github --org=trufflesecurity --results=verified
213213
```
214214

215-
## 3: Scan a GitHub Repo for only verified keys and get JSON output
215+
## 3: Scan a GitHub Repo for only verified secrets and get JSON output
216216

217217
Command:
218218

219219
```bash
220-
trufflehog git https://github.com/trufflesecurity/test_keys --results=verified,unknown --json
220+
trufflehog git https://github.com/trufflesecurity/test_keys --results=verified --json
221221
```
222222

223223
Expected output:
@@ -233,7 +233,7 @@ Expected output:
233233
trufflehog github --repo=https://github.com/trufflesecurity/test_keys --issue-comments --pr-comments
234234
```
235235

236-
## 5: Scan an S3 bucket for verified keys
236+
## 5: Scan an S3 bucket for high-confidence results (verified + unknown)
237237

238238
```bash
239239
trufflehog s3 --bucket=<bucket name> --results=verified,unknown
@@ -269,25 +269,27 @@ Run trufflehog from the parent directory (outside the git repo).
269269
$ trufflehog git file://test_keys --results=verified,unknown
270270
```
271271

272-
## 10: Scan GCS buckets for verified secrets
272+
To guard against malicious git configs in local scanning (see CVE-2025-41390), TruffleHog clones local git repositories to a temporary directory prior to scanning. This follows [Git's security best practices](https://git-scm.com/docs/git#_security). If you want to specify a custom path to clone the repository to (instead of tmp), you can use the `--clone-path` flag. If you'd like to skip the local cloning process and scan the repository directly (only do this for trusted repos), you can use the `--trust-local-git-config` flag.
273+
274+
## 10: Scan GCS buckets for only verified secrets
273275

274276
```bash
275-
trufflehog gcs --project-id=<project-ID> --cloud-environment --results=verified,unknown
277+
trufflehog gcs --project-id=<project-ID> --cloud-environment --results=verified
276278
```
277279

278-
## 11: Scan a Docker image for verified secrets
280+
## 11: Scan a Docker image for only verified secrets
279281

280282
Use the `--image` flag multiple times to scan multiple images.
281283

282284
```bash
283285
# to scan from a remote registry
284-
trufflehog docker --image trufflesecurity/secrets --results=verified,unknown
286+
trufflehog docker --image trufflesecurity/secrets --results=verified
285287

286288
# to scan from the local docker daemon
287-
trufflehog docker --image docker://new_image:tag --results=verified,unknown
289+
trufflehog docker --image docker://new_image:tag --results=verified
288290

289291
# to scan from an image saved as a tarball
290-
trufflehog docker --image file://path_to_image.tar --results=verified,unknown
292+
trufflehog docker --image file://path_to_image.tar --results=verified
291293
```
292294

293295
## 12: Scan in CI
@@ -389,7 +391,7 @@ aws s3 cp s3://example/gzipped/data.gz - | gunzip -c | trufflehog stdin
389391
- Why is the scan taking a long time when I scan a GitHub org
390392
- Unauthenticated GitHub scans have rate limits. To improve your rate limits, include the `--token` flag with a personal access token
391393
- It says a private key was verified, what does that mean?
392-
- Check out our Driftwood blog post to learn how to do this, in short we've confirmed the key can be used live for SSH or SSL [Blog post](https://trufflesecurity.com/blog/driftwood-know-if-private-keys-are-sensitive/)
394+
- A verified result means TruffleHog confirmed the credential is valid by testing it against the service's API. For private keys, we've confirmed the key can be used live for SSH or SSL authentication. Check out our Driftwood blog post to learn more [Blog post](https://trufflesecurity.com/blog/driftwood-know-if-private-keys-are-sensitive/)
393395
- Is there an easy way to ignore specific secrets?
394396
- If the scanned source [supports line numbers](https://github.com/trufflesecurity/trufflehog/blob/d6375ba92172fd830abb4247cca15e3176448c5d/pkg/engine/engine.go#L358-L365), then you can add a `trufflehog:ignore` comment on the line containing the secret to ignore that secrets.
395397

@@ -405,7 +407,13 @@ TruffleHog v3 is a complete rewrite in Go with many new powerful features.
405407

406408
## What is credential verification?
407409

408-
For every potential credential that is detected, we've painstakingly implemented programmatic verification against the API that we think it belongs to. Verification eliminates false positives. For example, the [AWS credential detector](pkg/detectors/aws/aws.go) performs a `GetCallerIdentity` API call against the AWS API to verify if an AWS credential is active.
410+
For every potential credential that is detected, we've painstakingly implemented programmatic verification against the API that we think it belongs to. Verification eliminates false positives and provides three result statuses:
411+
412+
- **verified**: Credential confirmed as valid and active by API testing
413+
- **unverified**: Credential detected but not confirmed valid (may be invalid, expired, or verification disabled)
414+
- **unknown**: Verification attempted but failed due to errors, such as a network or API failure
415+
416+
For example, the [AWS credential detector](pkg/detectors/aws/aws.go) performs a `GetCallerIdentity` API call against the AWS API to verify if an AWS credential is active.
409417

410418
# :memo: Usage
411419

@@ -444,7 +452,7 @@ Flags:
444452
--github-actions Output in GitHub Actions format.
445453
--concurrency=20 Number of concurrent workers.
446454
--no-verification Don't verify the results.
447-
--results=RESULTS Specifies which type(s) of results to output: verified, unknown, unverified, filtered_unverified. Defaults to all types.
455+
--results=RESULTS Specifies which type(s) of results to output: verified (confirmed valid by API), unknown (verification failed due to error), unverified (detected but not verified), filtered_unverified (unverified but would have been filtered out). Defaults to all types.
448456
--allow-verification-overlap
449457
Allow verification of similar credentials across detectors
450458
--filter-unverified Only output first unverified result per chunk per detector if there are more than one results.
@@ -677,7 +685,7 @@ webhook is used containing the regular expression matches.
677685
678686
TruffleHog will send a JSON POST request containing the regex matches to a
679687
configured webhook endpoint. If the endpoint responds with a `200 OK` response
680-
status code, the secret is considered verified.
688+
status code, the secret is considered verified. If verification fails due to network/API errors, the result is marked as unknown.
681689

682690
Custom Detectors support a few different filtering mechanisms: entropy, regex targeting the entire match, regex targeting the captured secret,
683691
and excluded word lists checked against the secret (captured group if present, entire match if capture group is not present). Note that if

‎examples/generic_with_filters.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ detectors:
1111
regex:
1212
secret: |-
1313
(?i)[\w.-]{0,50}?(?:access|auth|(?-i:[Aa]pi|API)|credential|creds|key|passw(?:or)?d|secret|token)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([\w.=-]{10,150}|[a-z0-9][a-z0-9+/]{11,}={0,3})(?:[\x60'"\s;]|\\[nr]|$)
14+
validations:
15+
secret: # name of the regex to apply these validations to
16+
contains_digit: true
17+
contains_special_char: true
1418
entropy: 3.5
1519
# exclude_regexes_capture:
1620
# - |-

‎go.mod‎

Lines changed: 48 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -14,29 +14,29 @@ replace gitlab.com/gitlab-org/api/client-go => gitlab.com/gitlab-org/api/client-
1414

1515
require (
1616
cloud.google.com/go/secretmanager v1.15.0
17-
cloud.google.com/go/storage v1.56.0
17+
cloud.google.com/go/storage v1.56.1
1818
github.com/BobuSumisu/aho-corasick v1.0.3
1919
github.com/TheZeroSlave/zapsentry v1.23.0
2020
github.com/adrg/strutil v0.3.1
2121
github.com/alecthomas/kingpin/v2 v2.4.0
2222
github.com/avast/apkparser v0.0.0-20250626104540-d53391f4d69d
23-
github.com/aws/aws-sdk-go-v2 v1.36.6
24-
github.com/aws/aws-sdk-go-v2/config v1.29.18
25-
github.com/aws/aws-sdk-go-v2/credentials v1.17.71
26-
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.85
27-
github.com/aws/aws-sdk-go-v2/service/s3 v1.84.1
28-
github.com/aws/aws-sdk-go-v2/service/sns v1.34.8
29-
github.com/aws/aws-sdk-go-v2/service/sts v1.34.1
30-
github.com/aws/smithy-go v1.22.5
23+
github.com/aws/aws-sdk-go-v2 v1.39.0
24+
github.com/aws/aws-sdk-go-v2/config v1.31.7
25+
github.com/aws/aws-sdk-go-v2/credentials v1.18.11
26+
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.19.5
27+
github.com/aws/aws-sdk-go-v2/service/s3 v1.88.0
28+
github.com/aws/aws-sdk-go-v2/service/sns v1.38.2
29+
github.com/aws/aws-sdk-go-v2/service/sts v1.38.3
30+
github.com/aws/smithy-go v1.23.0
3131
github.com/aymanbagabas/go-osc52 v1.2.1
3232
github.com/bill-rich/go-syslog v0.0.0-20220413021637-49edb52a574c
3333
github.com/bradleyfalzon/ghinstallation/v2 v2.16.0
34-
github.com/brianvoe/gofakeit/v7 v7.3.0
34+
github.com/brianvoe/gofakeit/v7 v7.6.0
3535
github.com/charmbracelet/bubbles v0.18.0
3636
github.com/charmbracelet/bubbletea v1.3.6
3737
github.com/charmbracelet/glamour v0.10.0
3838
github.com/charmbracelet/lipgloss v1.1.1-0.20250404203927-76690c660834
39-
github.com/couchbase/gocb/v2 v2.10.1
39+
github.com/couchbase/gocb/v2 v2.11.0
4040
github.com/crewjam/rfc5424 v0.1.0
4141
github.com/csnewman/dextk v0.3.0
4242
github.com/docker/docker v28.3.3+incompatible
@@ -45,7 +45,7 @@ require (
4545
github.com/envoyproxy/protoc-gen-validate v1.2.1
4646
github.com/fatih/color v1.18.0
4747
github.com/felixge/fgprof v0.9.5
48-
github.com/gabriel-vasile/mimetype v1.4.9
48+
github.com/gabriel-vasile/mimetype v1.4.10
4949
github.com/getsentry/sentry-go v0.32.0
5050
github.com/go-errors/errors v1.5.1
5151
github.com/go-git/go-git/v5 v5.13.2
@@ -63,7 +63,7 @@ require (
6363
github.com/googleapis/gax-go/v2 v2.15.0
6464
github.com/hashicorp/go-retryablehttp v0.7.8
6565
github.com/hashicorp/golang-lru/v2 v2.0.7
66-
github.com/jedib0t/go-pretty/v6 v6.6.7
66+
github.com/jedib0t/go-pretty/v6 v6.6.8
6767
github.com/jlaffaye/ftp v0.2.0
6868
github.com/joho/godotenv v1.5.1
6969
github.com/jpillora/overseer v1.1.6
@@ -89,8 +89,8 @@ require (
8989
github.com/sendgrid/sendgrid-go v3.16.1+incompatible
9090
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
9191
github.com/shuheiktgw/go-travis v0.3.1
92+
github.com/shurcooL/githubv4 v0.0.0-20240727222349-48295856cce7
9293
github.com/stretchr/testify v1.10.0
93-
github.com/tailscale/depaware v0.0.0-20250112153213-b748de04d81b
9494
github.com/testcontainers/testcontainers-go v0.34.0
9595
github.com/testcontainers/testcontainers-go/modules/elasticsearch v0.34.0
9696
github.com/testcontainers/testcontainers-go/modules/mongodb v0.34.0
@@ -105,14 +105,14 @@ require (
105105
go.uber.org/automaxprocs v1.6.0
106106
go.uber.org/mock v0.5.2
107107
go.uber.org/zap v1.27.0
108-
golang.org/x/crypto v0.40.0
109-
golang.org/x/net v0.42.0
108+
golang.org/x/crypto v0.41.0
109+
golang.org/x/net v0.43.0
110110
golang.org/x/oauth2 v0.30.0
111111
golang.org/x/sync v0.16.0
112-
golang.org/x/text v0.27.0
112+
golang.org/x/text v0.28.0
113113
golang.org/x/time v0.12.0
114-
google.golang.org/api v0.243.0
115-
google.golang.org/protobuf v1.36.8
114+
google.golang.org/api v0.247.0
115+
google.golang.org/protobuf v1.36.9
116116
gopkg.in/h2non/gock.v1 v1.1.2
117117
gopkg.in/yaml.v2 v2.4.0
118118
gopkg.in/yaml.v3 v3.0.1
@@ -123,10 +123,10 @@ require (
123123

124124
require (
125125
cel.dev/expr v0.24.0 // indirect
126-
cloud.google.com/go v0.121.4 // indirect
127-
cloud.google.com/go/auth v0.16.3 // indirect
126+
cloud.google.com/go v0.121.6 // indirect
127+
cloud.google.com/go/auth v0.16.5 // indirect
128128
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
129-
cloud.google.com/go/compute/metadata v0.7.0 // indirect
129+
cloud.google.com/go/compute/metadata v0.8.0 // indirect
130130
cloud.google.com/go/iam v1.5.2 // indirect
131131
cloud.google.com/go/monitoring v1.24.2 // indirect
132132
dario.cat/mergo v1.0.0 // indirect
@@ -145,18 +145,18 @@ require (
145145
github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 // indirect
146146
github.com/andybalholm/brotli v1.1.1 // indirect
147147
github.com/atotto/clipboard v0.1.4 // indirect
148-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 // indirect
149-
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.33 // indirect
150-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.37 // indirect
151-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.37 // indirect
148+
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 // indirect
149+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.7 // indirect
150+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.7 // indirect
151+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.7 // indirect
152152
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
153-
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.37 // indirect
154-
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 // indirect
155-
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.5 // indirect
156-
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.18 // indirect
157-
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.18 // indirect
158-
github.com/aws/aws-sdk-go-v2/service/sso v1.25.6 // indirect
159-
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.4 // indirect
153+
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.7 // indirect
154+
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
155+
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.7 // indirect
156+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.7 // indirect
157+
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.7 // indirect
158+
github.com/aws/aws-sdk-go-v2/service/sso v1.29.2 // indirect
159+
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.3 // indirect
160160
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
161161
github.com/aymerick/douceur v0.2.0 // indirect
162162
github.com/beorn7/perks v1.0.1 // indirect
@@ -177,7 +177,7 @@ require (
177177
github.com/containerd/log v0.1.0 // indirect
178178
github.com/containerd/platforms v0.2.1 // indirect
179179
github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
180-
github.com/couchbase/gocbcore/v10 v10.7.1 // indirect
180+
github.com/couchbase/gocbcore/v10 v10.8.0 // indirect
181181
github.com/couchbase/gocbcoreps v0.1.3 // indirect
182182
github.com/couchbase/goprotostellar v1.0.2 // indirect
183183
github.com/couchbaselabs/gocbconnstr/v2 v2.0.0-20240607131231-fb385523de28 // indirect
@@ -210,8 +210,7 @@ require (
210210
github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
211211
github.com/golang-sql/sqlexp v0.1.0 // indirect
212212
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
213-
github.com/golang/snappy v0.0.4 // indirect
214-
github.com/google/go-github/v69 v69.0.0 // indirect
213+
github.com/golang/snappy v1.0.0 // indirect
215214
github.com/google/go-github/v72 v72.0.0 // indirect
216215
github.com/google/go-querystring v1.1.0 // indirect
217216
github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7 // indirect
@@ -252,14 +251,12 @@ require (
252251
github.com/muesli/cancelreader v0.2.2 // indirect
253252
github.com/muesli/termenv v0.16.0 // indirect
254253
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
255-
github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78 // indirect
256-
github.com/olekukonko/tablewriter v0.0.5 // indirect
254+
github.com/nwaples/rardecode/v2 v2.2.1 // indirect
257255
github.com/onsi/ginkgo v1.16.5 // indirect
258256
github.com/opencontainers/go-digest v1.0.0 // indirect
259257
github.com/opencontainers/image-spec v1.1.1 // indirect
260258
github.com/pierrec/lz4/v4 v4.1.21 // indirect
261259
github.com/pjbgf/sha1cd v0.3.2 // indirect
262-
github.com/pkg/diff v0.0.0-20200914180035-5b29258ca4f7 // indirect
263260
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
264261
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
265262
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
@@ -271,6 +268,7 @@ require (
271268
github.com/sendgrid/rest v2.6.9+incompatible // indirect
272269
github.com/shirou/gopsutil/v3 v3.23.12 // indirect
273270
github.com/shoenig/go-m1cpu v0.1.6 // indirect
271+
github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466 // indirect
274272
github.com/sirupsen/logrus v1.9.3 // indirect
275273
github.com/skeema/knownhosts v1.3.0 // indirect
276274
github.com/sorairolake/lzip-go v0.3.5 // indirect
@@ -298,24 +296,23 @@ require (
298296
github.com/zeebo/errs v1.4.0 // indirect
299297
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
300298
go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
301-
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
299+
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0 // indirect
302300
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
303-
go.opentelemetry.io/otel v1.36.0 // indirect
301+
go.opentelemetry.io/otel v1.37.0 // indirect
304302
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 // indirect
305-
go.opentelemetry.io/otel/metric v1.36.0 // indirect
306-
go.opentelemetry.io/otel/sdk v1.36.0 // indirect
307-
go.opentelemetry.io/otel/sdk/metric v1.36.0 // indirect
308-
go.opentelemetry.io/otel/trace v1.36.0 // indirect
303+
go.opentelemetry.io/otel/metric v1.37.0 // indirect
304+
go.opentelemetry.io/otel/sdk v1.37.0 // indirect
305+
go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
306+
go.opentelemetry.io/otel/trace v1.37.0 // indirect
309307
go.uber.org/multierr v1.11.0 // indirect
310308
go4.org v0.0.0-20230225012048-214862532bf5 // indirect
311309
golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 // indirect
312-
golang.org/x/mod v0.25.0 // indirect
313-
golang.org/x/sys v0.34.0 // indirect
314-
golang.org/x/term v0.33.0 // indirect
315-
golang.org/x/tools v0.34.0 // indirect
310+
golang.org/x/mod v0.26.0 // indirect
311+
golang.org/x/sys v0.35.0 // indirect
312+
golang.org/x/term v0.34.0 // indirect
316313
google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
317-
google.golang.org/genproto/googleapis/api v0.0.0-20250721164621-a45f3dfb1074 // indirect
318-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250721164621-a45f3dfb1074 // indirect
314+
google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
315+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c // indirect
319316
google.golang.org/grpc v1.74.2 // indirect
320317
gopkg.in/warnings.v0 v0.1.2 // indirect
321318
pault.ag/go/topsort v0.1.1 // indirect

0 commit comments

Comments
 (0)