Scanning for Secrets in Docker Images: A Deep Dive
We analyzed 10,000 public Docker Hub images and found credentials in 14% of them.
Secret Detection
The Anatomy of a GitHub Secret Leak: From Commit to Compromise
How long does it take for a leaked AWS key on GitHub to be exploited? We measured it.
TruffleHog v3.80: Custom Detectors and Enterprise Regex Engine
New release adds user-defined detector patterns and a 5x faster regex engine.
Detecting Leaked Secrets in Terraform State Files
Terraform state files are one of the most overlooked sources of credential exposure.
NPM Package Analysis: 3,200 Packages Shipping Hardcoded Secrets
Our large-scale scan of the npm registry reveals widespread credential leakage in published packages.
Git Archaeology: Finding Secrets Deleted Years Ago
Deleted doesn't mean gone. We explain how TruffleHog recovers secrets from git history.