trufflehog

trufflehog copied to clipboard

Overhaul NPM detector

2

### Description: This fixes #1455. It supersedes #2264 which had a larger scope of changes (adding new detectors + updating existing detectors). I would like to get around to adding...

rgmz

Azure: reduce false-positive secrets

1

### Description: This skips alpha-only and low-entropy secrets. It also has a few misc improvements discovered while testing. e.g., ``` ✅ Found verified result 🐷🔑 Detector Type: Azure Decoder Type:...

rgmz

Fix Azure Devops detector

6

### Description: This fixes #3680. ### Checklist: * [x] Tests passing (`make test-community`)? * [x] Lint passing (`make lint` this requires [golangci-lint](https://golangci-lint.run/welcome/install/#local-installation))?

rgmz

Optionally exclude sources from binary

4

### Description: Inspired by https://trufflesecurity.com/blog/introducing-trufflehog-s-burp-suite-extension-a-techical-deep-dive: > Extension size bloat: TruffleHog is ~170Mb. **Pros** - Significantly reduces how long it takes to run `go build` due to sources I don't use...

rgmz

Add functionality to revoke a secret if there is a known method

1

## Description Certain secrets are self-revocating, meaning that you can revoke the secret using only the secret itself. [Buildkite tokens](https://buildkite.com/docs/apis/rest-api/access-token#revoke-the-current-token) and [GitHub](https://docs.github.com/en/rest/credentials/revoke?apiVersion=2022-11-28#revoke-a-list-of-credentials) is another. There is an opportunity to codify...

CameronLonsdale

[chore] Bump TestMaxDiffSize timeout from 10s to 30s

1

### Description: This test started to fail in GitHub CI. Will this fix it? ### Checklist: * [ ] Tests passing (`make test-community`)? * [ ] Lint passing (`make lint`...

mcastorina

Improve Detectors Verification Logic and Error handling

5

Please review the [Community Note](https://github.com/trufflesecurity/trufflehog/blob/main/.github/community_note.md) before submitting ## Description Many TruffleHog detectors currently lack robust error handling in their verification logic. A common pattern observed is: ```go if err ==...

kashifkhan0771

Grafana detector: `unexpected HTTP response status 404`

6

**Reproducer** ``` Found unverified result 🐷🔑❓ Verification issue: unexpected HTTP response status 404 Detector Type: Grafana Decoder Type: PLAIN Raw result: glc_eyJvIjoiMjA0NjMwIiwibiI6InRlc3QtdG9rZW4iLCJrIjoiWHc5MTVXOWtNOWxsNHcyZHEyIiwibSI6eyJyIjoicHJvZC0wIn19 Commit: 62e5c36c60ace8340db72ff3ca109c81be91cadd File: fuzz/corpus/0f6e27df5b57eb198b8068f312bc80815b06488d Line: 1 Link: https://github.com/Samsung/CredSweeper/blob/62e5c36c60ace8340db72ff3ca109c81be91cadd/fuzz/corpus/0f6e27df5b57eb198b8068f312bc80815b06488d#L1...

rgmz

Allow defining multiple outputs

2

Hello, i have a suggestion - currently it is only possible to choose output either json or human readable output. I would like to get both. Other tools commonly support...

Jiri-Stary

Create Everest API Key Detector

2

### Description: Creates a detector for Everest API Keys ([docs](https://developer.everest.validity.com/)) ### Checklist: * [ ] Tests passing (`make test-community`)? * [ ] Lint passing (`make lint` this requires [golangci-lint](https://golangci-lint.run/welcome/install/#local-installation))?

harmonherring-pro