TruffleHog

Make secrets easier

Also known as
trufflehog

What is TruffleHog?

TruffleHog uncovers exposed non-human identities (NHIs) and their secrets, helping security teams prioritize risk and remediate faster. It scans for sensitive credentials across source code, chat systems, and cloud platforms.

Independently observed

TruffleHog pricing

Plans, per-tier features and add-ons, dated and linked to live pricing. Pricing changes often; always verify at source before you rely on it.

Pricing as of verify at live pricing ↗Independently observed
Open sourceFree tier

Open source (free). Enterprise pricing available upon request.

Open Source

Free
Free

GitHub, S3, directory, GCS, and Docker scanning with 800+ secret detectors

  • GitHub, S3, directory, GCS, and Docker scanning
  • 800+ secret detectors
  • GitHub Actions, pre-commit, and pre-receive hooks
  • Custom regex and secrets verification
  • Automatic updates
  • On-premises and cloud scanning

Enterprise

Contact sales
Contact sales

Advanced features including continuous monitoring, integrations, SSO, and dedicated support

  • 19+ integrations (GitHub, Confluence, Jira, Slack, more)
  • Continuous monitoring
  • Intuitive dashboard
  • Alerting
  • Monitor vast public datasets
  • Single sign-on (SAML 2.0 or OAuth 2.0)
  • Role-based access control
  • Deployment and onboarding support
  • Ongoing priority technical support
  • Detailed analytics and reporting

What TruffleHog does

The capabilities that matter for devsecops tools, normalised so it lines up with every alternative. “-” means we haven't confirmed it, not that it's missing.

Scan types
SAST (static analysis)
DAST (dynamic analysis)
-
SCA / dependency scanning
-
Secret scanning
Container / image scanning
IaC misconfiguration scanning
-
Governance
OSS licence compliance
-
SBOM generation (SPDX/CycloneDX)
-
Remediation
Automated fix / upgrade PRs
-
Prioritisation
Reachability / exploitability prioritisation
Deployment
Hosting
Cloud + self-hosted
Integration
First-class CI / pipeline integration
In-editor / IDE scanning
-
Licensing
OSS engine available
Independently observed

Platform & deployment

Independently observed
Platforms
  • CLI
  • Web
Deployment
  • Cloud / SaaS
  • Self-hosted

Integrations (7)

Independently observed
  • GitHub
  • GitLab
  • Bitbucket
  • Gerrit
  • Confluence
  • Jira
  • Slack

TruffleHog alternatives

Other devsecops tools we track, ranked by the same independent score.

Independent · unbought · dated

The Vioscale score: one lens on the evidence

Not user reviews and not a paid placement: a confidence-weighted blend of the independent signals below (adoption, activity, security posture, and more), which you can sort and re-weight yourself. Vendors can correct their listing but can never move their rank, and stars are weighted low as a vanity metric. It is one way to read the evidence for TruffleHog, not the verdict.

Balanced composite 61 / 100
low · 26%
Signal contributions to the composite score
SignalScoreWeightContributionEvidence
Capabilities8112.00973.8
Github Activity5318.00957.8
Release Cadence9410.00938.9
Reliability5018.00900.0
Price Level1008.00800.0
Integrations3812.00456.3
Github Stars845.00418.4
Pricing Transparency2510.00250.0
Security Posture040.000.0-
Package Downloads026.000.0-
Stackoverflow Activity012.000.0-

Computed . Re-weight it by intent, or see the full method.

All data & sourcesshow ↓

Every value we hold, with its source, retrieval date, and confidence. This is the evidence behind the score: don't trust it, verify it.

Activity

AttributeValueEvidence
Commits last 30d48mediumsource · 2026-08-01 · 65%

Adoption

AttributeValueEvidence
Github stars27,267highsource · 2026-08-01 · 90%

Features

AttributeValueEvidence
Capabilities{"sast":true,"hosting":"both","ci_native":true,"open_source":true,"reachability":true,"secret_scanning":true,"container_scanning":true}mediumsource · 2026-08-01 · 60%

Integrations

AttributeValueEvidence
Count20mediumsource · 2026-08-01 · 60%

Language

AttributeValueEvidence
PrimaryGohighsource · 2026-08-01 · 90%

License

AttributeValueEvidence
SpdxAGPL-3.0highsource · 2026-08-01 · 95%

Pricing

AttributeValueEvidence
Free tierYesmediumsource · 2026-08-01 · 60%
Modelcommerciallowsource · 2026-08-01 · 40%
Price levelfreemediumsource · 2026-08-01 · 60%
TransparentNomediumsource · 2026-08-01 · 60%

Release

AttributeValueEvidence
Cadence days11mediumsource · 2026-08-01 · 70%

Reliability

AttributeValueEvidence
Status pageYesmediumsource · 2026-08-01 · 60%