trufflehog3
Find secrets in your codebase
Decision gist · record as of 2026-08-14
Yes, if you need secret detection in Git repositories and can accept the aging maintenance status. The package is stable and has no known vulnerabilities, but the last release was over a year ago and there is no recent development activity. Suitable for one-off scans or CI/CD integration where active updates are not critical; reconsider if you require ongoing security rule updates or active maintainer support.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python >=3.7; Git must be installed and accessible for repository scanning.
- Low install friction with four common runtime dependencies (attrs, GitPython, Jinja2, PyYAML).
- Maintenance status is aging—last release was 2024-05-24 and the repository shows no recent activity, though it remains unarchived.
License · maintenance · safety
GNU (unclear) — License is marked as GNU but SPDX classification is unclear, creating ambiguity about which GPL variant applies and what obligations it imposes on derivative works or bundled distributions.
last release 2024-05-24 (812 days) · last repo commit 2025-03-06 · 125 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 89,620 downloads/mo, #13,643 on PyPI
Alternatives
Verify before relying
pip install trufflehog3
trufflehog3 --depth 10 https://github.com/user/repo
trufflehog3 --no-history --format json --output report.json- Whether the unclear GNU license (raw: 'GNU', SPDX: null) is GPLv2, GPLv3, or another variant—affects compliance obligations.
- Current maintenance status and whether the aging codebase receives security updates or bug fixes.
- Whether multiprocessing support and incremental scan features work reliably in production environments.
What it is and what it does
Trufflehog3 is a secret scanner that searches Git repositories and source code for exposed credentials, API keys, and other sensitive data. It uses pattern-based detection to identify secrets in commit history, current files, or both, and can output results in multiple formats including JSON and interactive HTML reports.
The package is built on GitPython, Jinja2, and PyYAML, allowing it to clone remote repositories, parse configuration files, and generate formatted reports. It supports custom detection rules via YAML configuration, inline exclusion comments to suppress false positives, multiprocessing for faster scans, and incremental scanning against baseline reports to track new issues only.
Use it for
- Scan a Git repository's commit history to find accidentally committed secrets before they reach production.
- Generate an HTML report of secrets found in a codebase for security review and remediation tracking.
- Run incremental scans against a baseline to identify only new credential exposures in ongoing CI/CD pipelines.
- Exclude known false positives using inline nosecret comments or custom rule configuration.
- Scan a local directory without Git history to quickly check current source code for hardcoded credentials.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need secret detection in Git repositories and can accept the aging maintenance status.
The package is stable and has no known vulnerabilities, but the last release was over a year ago and there is no recent development activity. Suitable for one-off scans or CI/CD integration where active updates are not critical; reconsider if you require ongoing security rule updates or active maintainer support.
Install
trufflehog3 on PyPI
Before you install
Low install friction with four common runtime dependencies (attrs, GitPython, Jinja2, PyYAML). Maintenance status is aging—last release was 2024-05-24 and the repository shows no recent activity, though it remains unarchived.
Requires Python >=3.7; Git must be installed and accessible for repository scanning.
License in practice
License is marked as GNU but SPDX classification is unclear, creating ambiguity about which GPL variant applies and what obligations it imposes on derivative works or bundled distributions.
Quickstart
pip install trufflehog3
trufflehog3 --depth 10 https://github.com/user/repo
trufflehog3 --no-history --format json --output report.jsonVerify before relying
- Whether the unclear GNU license (raw: 'GNU', SPDX: null) is GPLv2, GPLv3, or another variant—affects compliance obligations.
- Current maintenance status and whether the aging codebase receives security updates or bug fixes.
- Whether multiprocessing support and incremental scan features work reliably in production environments.
Package facts
| License | GNU unclear |
| Python support | Supports the current Python release >=3.7 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 4 packagesattrsGitPythonJinja2PyYAML |
| Maintenance | Aging 812 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 89,620 / month, #13,643 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
Evidence: trufflehog3-3.0.10-py2.py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “find api keys in git history”
- trufflehog3Scans Git repositories and source code for secrets, API keys, and…
- truffleHogScans Git repositories and other sources for leaked credentials,…
- detect-secretsDetects secrets (API keys, tokens, credentials) in code repositories…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also scanoss · truffleHog · detect-secrets · bc-detect-secrets · kingfisher-bin · ggshield · cycode · flawfinder · pysonar · abi3audit