Truffle Security is the company behind TruffleHog, an open-source secrets scanning project, and TruffleHog Enterprise, a commercial platform that finds, verifies and helps remediate exposed credentials belonging to non-human identities (NHIs). The company is led by co-founder and CEO Dylan Ayrey, with co-founder Dustin Decker as CTO. TruffleHog scans for API keys, passwords, tokens and private keys across code, collaboration tools, CI/CD, cloud storage and the public web. Its core idea is that a finding should be tested against the credential’s provider to confirm whether it is still live, then mapped to the identity and permissions behind it, and re-tested after remediation to confirm it has been revoked. This overview explains how the platform works and what it covers, based on Truffle Security’s public product documentation and announcements.
At A Glance
| Vendor | Truffle Security Co., maker of TruffleHog |
|---|---|
| Category | Secrets detection, verification and remediation; NHI exposure management |
| Identities covered | Non-human identities and the credentials they use: API keys, tokens, database passwords, cloud keys, private keys |
| Deployment | Open-source CLI; Enterprise with hosted scanners (managed by Truffle Security) or self-hosted scanners on Linux, Docker, Helm or Kubernetes |
| Coverage | 800+ credential types classified and verified; analysis of identity and permissions for 40+ SaaS providers, AWS and Google Cloud |
| Funding | Backed by investors including a16z |
What The Platform Does
Truffle Security offers TruffleHog in two editions. The open-source edition is a scanner that developers run locally or in pipelines; the company reports over 250,000 daily runs and more than 23,000 GitHub stars. TruffleHog Enterprise builds on the same detection engine and adds continuous monitoring, a web dashboard, integrations, alerting, single sign-on (SAML 2.0 or OAuth 2.0), role-based access control, and analytics and reporting.
Discovery And Classification
TruffleHog looks for secrets in Git repositories, including deleted code, version history, comments and pull requests, as well as in chat, wikis, tickets, logs, object storage, filesystems and container images. It classifies each finding by credential type, distinguishing, for example, an AWS key from a Stripe key, a Postgres password or an SSL private key.
Verification
For every credential type it can classify, TruffleHog attempts to authenticate with the relevant provider to determine whether the secret is live. Truffle Security positions this as the main way to remove false positives: only verified, live credentials become Enterprise findings. Findings for the same secret across multiple locations are consolidated into one alert.
TruffleHog Analyze
Analyze is described as the identity intelligence layer of TruffleHog Enterprise. For verified credentials, it queries provider APIs to establish who owns the credential, which NHI it represents, what resources it can reach and what permissions it has. It includes specialised analysers for SaaS platforms (40+ providers), for AWS (identities, effective permissions, assumable roles) and for Google Cloud (service account permissions, IAM inheritance and accessible resources). The aim is to help teams separate low-risk development credentials from high-impact production identities.
TruffleHog Forager
Forager monitors public GitHub pushes and the npm registry for live credentials that trace back to a customer’s organisation, correlating attributes such as email addresses and account IDs. A public explorer is available on the Forager site.
Remediation And Confirmed Revocation
TruffleHog Enterprise routes findings to the credential’s owner through Slack, Jira or another alerting platform, with rotation guidance for the specific credential type. After remediation, it re-tests the credential, confirms that it has been revoked and logs the outcome, so time to remediation can be tracked. Truffle Security also publishes How to Rotate, a public collection of rotation guides.
Preventing Leaks
Both editions support GitHub Actions, pre-commit hooks and pre-receive hooks, allowing secrets to be caught before they are committed or pushed. Custom regular-expression detectors and custom verification are also supported in both editions. The open-source CLI can emit SARIF output for upload to GitHub code scanning, with verified findings mapped to errors and unverified findings to warnings.
How The Architecture Works
TruffleHog Enterprise separates scanning, which can run in the customer’s environment, from a customer-isolated API that stores findings.
| Component | What it does |
|---|---|
| Scanners | Scanners connect to sources and perform discovery, extraction, fingerprinting and verification. Customers choose hosted scanners managed by Truffle Security or self-hosted scanners deployed on a Linux host, with Docker, with a Helm chart or with a Kubernetes manifest. Each scanner is configured with the sources to scan and how often. |
| FoundSecret API | When a scanner finds a secret, it sends type, verification status, a redacted form or key ID (up to 20 characters), a cryptographic fingerprint and source context such as file path, line number, commit and author. The documentation states that raw secret values and full file contents are never transmitted to or stored by the API. |
| Fingerprinting and storage | Cryptographic fingerprints are used to deduplicate findings without storing the secret itself. Stored data is encrypted at rest, and the API communicates with its storage layer over mutual TLS. |
| Web UI and APIs | Findings appear in a web dashboard, and Enterprise provides APIs, including a read API for scan history introduced in September 2026. |
Integrations
| Area | Documented integrations |
|---|---|
| Version control | GitHub, GitLab, Git, Bitbucket, Gerrit, Azure Repos |
| Artifacts and containers | Artifactory, Docker |
| CI/CD | Jenkins, GitHub, GitLab, Buildkite, Azure Repos, Travis CI, CircleCI |
| Chat | Slack, Microsoft Teams |
| Tickets and logs | Jira, Vector |
| File and knowledge stores | Confluence, Google Drive, Amazon S3 and S3-compatible storage, SharePoint |
| Notifications | Slack, Jira, Splunk, webhook, email, stdout |
The company states that TruffleHog integrates with more than 20 platforms and tools.
Use Cases And Industries
Truffle Security’s published use cases centre on continuous secrets scanning across the software development lifecycle, prioritising exposed credentials by their identity and access, monitoring public code for leaked organisational keys, and proving that leaked credentials have been revoked. Customer case studies on its website include Optro, which scans code, Jira, Slack and S3 application logs; TextNow, which scans source code, Jira and Confluence; and Klaviyo, which the company reports remediated more than 200 high-impact secrets.