trufflehog icon indicating copy to clipboard operation
trufflehog copied to clipboard

Published 20 hours ago • verified publisher icon trufflesecurity

NotGitBleed trufflehog support

Open carolosf opened this issue 2 years ago • 1 comments

Although trufflehog scans file systems and git repos as far as I am aware it doesn't currently scan commit metadata for passwords.

Recently this has been published: https://www.notgitbleed.com

A lot of Github users of large open source projects accidentally commit their GitHub credentials even when tools such as trufflehog are being used at an alarming rate.

Since this work has been published we have worked with GitHub to mitigate this on GitHub and they have built a scanning tool: https://github.blog/changelog/2022-04-11-secret-scanning-detects-and-revokes-leaked-passwords/

It would be great to confirm that trufflehog doesn't currently scan git commit metadata and to find out if this is something you can support in future.

carolosf avatar Apr 13 '22 16:04 carolosf

That's pretty interesting, thank you for sharing. TruffleHog does not currently scan commit metadata.

dustin-decker avatar Apr 13 '22 23:04 dustin-decker