Fighting Secrets In Source Code With TruffleHog
summary
Tool hunts secrets in git history using entropy scanning and curated regexes, packaged as truffleHog and extended to npm/PyPI as SantaHog. Scans flagged thousands of leaked tokens historically and finds ~2% of npm packages mentioning AWS contain live keys. Regexes are now a shared JSON repo; current tool is single-threaded, yields false positives that need triage, and supports automatic verification for public APIs but warns of CFAA risks and the need to rotate and scrub keys.
AI-written summary · about
chapters (11)
- 0:00Introduction to TruffleHog
- 1:28Why secrets in source code matter
- 4:03Where source code lives
- 7:53Scanning revision history for secrets
- 10:43Entropy detection vs regex rules
- 13:31DevOps pipeline integration
- 14:34Scanning package managers for secrets
- 17:06Introducing SantaHog
- 20:16Future features and community help
- 22:02Automated key verification
- 24:32Q&A and community discussion
related talks
35mGit those secrets out your repos!
35mFollow the data to learn the secret
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
46mRollout Your Hardcoded Secrets Detection With Min Effort & Max Impact!
45mWrongSecrets: We Have a Secret for Everyone!
24mHow to Find Secure Software in Open Source Repositories
15mStop Committing Your Secrets - Git Hooks To The Rescue!
43mSelf-Discovering API Key Permissions and Resources