TruffleHog
The facts below are what the maker publishes about TruffleHog, checked and dated. Our editors have not written about it yet.
Plans and prices
From TruffleHog's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Open-source | Free | GitHub, S3, directory, GCS, and Docker scanning · 800+ secret detectors · GitHub Actions, pre-commit, and pre-receive hooks · custom regex and secret verification · automatic updates |
| Enterprise | Priced on request | 20+ integrations · on-premises or cloud scanning · continuous monitoring · Analyze for SaaS and Cloud add-ons · Forager add-on · SSO · role-based access control · onboarding and priority technical support |
The facts
Each one read from TruffleHog's own pages, with the date it was checked.
What it does
- Analysis
- TruffleHog Analyze identifies the resources and permissions associated with API keys and other secrets without requiring access to a provider’s UI.checked 30 Sep 2026
- Deployment options
- The product can run on the company’s isolated servers or on-premises, where scanners can reach internal sources and source credentials can remain in the customer’s infrastructure.checked 30 Sep 2026
- Deployment security
- The company says each customer installation has a private environment and isolated database encrypted at rest, and deployments receive randomly generated infrastructure credentials.checked 30 Sep 2026
- Detection
- It scans version history across branches and can find secrets in comments, Docker images, and other locations beyond repositories.checked 30 Sep 2026
- Integrations
- The integrations page lists GitHub, GitLab, Bitbucket, Gerrit, Docker, Jenkins, Slack, Teams, Jira, Confluence, Google Drive, S3, and SharePoint, among others.checked 30 Sep 2026
- Notifications
- When a secret is discovered, TruffleHog can send a Slack message, create a Jira ticket, or use Splunk, webhooks, email, and stdout.checked 30 Sep 2026
- Open-source license
- The project’s GitHub repository identifies its license as AGPL-3.0.checked 30 Sep 2026
- Operating systems
- The project documents Homebrew installation for macOS, Windows Docker examples, and binary releases; its installer supports Darwin, Linux, and Windows on amd64 and arm64.checked 30 Sep 2026
- Prevention and remediation
- Pre-commit and pre-receive hooks can scan before commits, and alerts can link to credential rotation and security guides.checked 30 Sep 2026
- Purpose
- TruffleHog scans code repositories and other sources to find exposed secrets, passwords, and sensitive keys.checked 30 Sep 2026
- Secret handling
- The company says scanning occurs in memory and it stores only finding location metadata and redacted credential information, not the secrets themselves.checked 30 Sep 2026
- Support
- The Enterprise plan lists deployment and onboarding support plus ongoing priority technical support.checked 30 Sep 2026
- Verification
- For detected credentials, TruffleHog uses their protocol or API to verify whether they are live and reduce false positives.checked 30 Sep 2026
The company
- Company
- Truffle Security Co. identifies itself as the company behind TruffleHog, and its website footer says “Since 2021.”checked 30 Sep 2026
- Founded
- 2021checked 23 Sep 2026
Alternatives to TruffleHog
- 1
DeepSource
Free planWebAPILinuxmacOS8.0From $30 a month - 2
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 3
Vooda AI
Free planWebAPILinuxmacOS6.9Free plan - 4
Arnica Secrets Security
Free planWebAPISelf-hosted6.6From $300 a year - 5
GitGuardian
Free planWebAPILinuxmacOS6.6Free plan - 6
detect-secrets
Free planLinuxmacOSSelf-hostedWindows6.5Free plan