Alternatives to TruffleHog
Find exposed credentials in repositories and other data sources. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
TruffleHog
Find exposed credentials in repositories and other data sources.
Replacements
Listings that take over the same core job as TruffleHog.
Gitleaks
Scans Git repositories, files and pipelines for leaked secrets.
Gitleaks is MIT-licensed and fully free, scanning full Git history as a pre-commit hook or CI step, but it is feature complete with security patches only.
Also worth comparing
These listings name TruffleHog as their own alternative, so the relationship runs both ways.
detect-secrets
A command-line tool from Yelp that detects and prevents secrets such as keys being committed to code.
TruffleHog finds exposed credentials across repositories and other data sources, with some verification features that contact external services.
Similar software
Related functionality, not a direct replacement.
Semgrep
Find code patterns and potential problems with static analysis.
zizmor
Find security mistakes in CI configuration before they reach a runner.
Checkov
Scan infrastructure code for configuration problems.
HashiCorp Vault
Secrets management with dynamic credentials, encryption and PKI.
Bandit
A command-line static analyser that finds common security issues in Python code.
