How to Install and Use TruffleHog in Linux to Scan Repositories for Leaked Secrets and Credentials

Accidentally committing hardcoded API tokens, private SSH keys, database passwords, or cloud credentials to public or private Git repositories is one of the leading causes of enterprise cloud compromises. Once pushed, sensitive secrets linger permanently in Git history even if subsequent commits delete the code. trufflehog is a fast, open-source security scanner that searches deep into Git commit logs, branches, uncommitted files, and filesystem directories to detect active and leaked credentials, verifying their validity against live cloud providers in real time.

What Is TruffleHog in Linux?

Unlike standard text search tools (such as grep or ripgrep) that trigger thousands of false positives on random hex strings, trufflehog uses over 800 detector rules combined with Shannon entropy analysis and active credential verification. When trufflehog detects a potential AWS key, GitHub token, Slack webhook, or Stripe secret, it attempts an unprivileged verification request to confirm whether the credential is live and exploitable.

Key capabilities include:

• Deep Commit History Traversal: Scans every commit, tag, branch, and stash across your repository’s entire historical timeline.
• Live Credential Verification: Tests detected secrets against service APIs to distinguish active security risks from inactive mock tokens.
• Multiple Source Targets: Scans local Git repositories, remote GitHub/GitLab URLs, S3 buckets, Docker image layers, and plain filesystem directories.
• CI/CD Integration: Exits with non-zero error codes when active secrets are discovered, preventing insecure commits in automated pull request pipelines.

Installing TruffleHog on Linux

You can install trufflehog via direct script, Go, package managers, or Docker.

Method 1: Direct Install Script (Recommended)

Download and run the official installation script:

curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sudo sh -s -- -b /usr/local/bin

# Verify installation
trufflehog --version

Method 2: Arch Linux (AUR)

Arch users can install trufflehog using an AUR helper:

yay -S trufflehog-bin

Method 3: Install via Go

If you have the Go development environment configured on Linux:

go install github.com/trufflesecurity/trufflehog/v3@latest

Method 4: Run via Docker Container

Run trufflehog without local installation by mounting your repository:

docker run --rm -v "$(pwd):/pwd" trufflesecurity/trufflehog:latest filesystem /pwd

Scanning Local Git Repositories

To audit a repository on your local machine, navigate to its root directory and execute:

cd ~/projects/my-app
trufflehog git file://.

trufflehog will parse every commit across the repository and print details of any discovered secrets:

Found verified result 🐷
Detector Type: AWS
Decoder Type: PLAIN
Raw: AKIAIOSFODNN7EXAMPLE
Commit: a1b2c3d4e5f6g7h8...
File: config/aws_credentials.json
Email: [email protected]
Verified: TRUE

Scanning Remote GitHub or GitLab Repositories

You can audit open-source projects or private remote repositories without cloning them locally first:

# Scan a public repository
trufflehog git https://github.com/organization/public-repo.git

# Scan a private repository using an authentication token
trufflehog git https://x-access-token:[email protected]/organization/private-repo.git

Scanning Plain Filesystem Directories and Archives

To inspect non-versioned folders, server configuration directories, or extracted backups:

trufflehog filesystem /etc/nginx/ /opt/deployments/

Filtering and Excluding Noise

In large codebases containing documentation examples or test suites, mock credentials can trigger unnecessary notifications. You can configure exclusions:

1. Filter Only Verified (Live) Secrets

To suppress unverified candidate tokens and display strictly live credentials:

trufflehog git file://. --only-verified

2. Exclude Specific Paths or Vendor Folders

trufflehog git file://. --exclude-paths=vendor/,node_modules/,tests/fixtures/

Automating Secret Scans in Pre-Commit Hooks

Prevent developers from pushing secrets by adding trufflehog to Git’s pre-commit hook:

# In your repository root:
cat << 'EOF' > .git/hooks/pre-commit
#!/bin/bash
echo "Scanning staged files for leaked secrets..."
trufflehog git file://. --since-commit HEAD --only-verified --fail
EOF

chmod +x .git/hooks/pre-commit

With this hook active, Git aborts any commit containing verified secrets before it reaches local history.