TruffleHog

• Category: secrets (CI verification, opt-in)
• Fingerprint: rule-file-surrounding-3-lines-v1
• License: AGPL — runs in a sidecar Docker container, never linked into the server binary.

When to enable

Enable after gitleaks has caught the easy matches. TruffleHog's distinguishing attribute is verification — it tests the credential against the issuer (e.g. STS for AWS) to separate pattern matches from confirmed incidents.

secrets:
  trufflehog:
    enabled: true
    verify: true

Dedup with gitleaks

Both use SchemeRuleFileSnippet — the same secret in the same file dedupes across the two tools.

Verified vs unverified

• properties.verified=true → SARIF level=error → merge gate hard-blocks.
• properties.verified=false → SARIF level=warning → gate soft-warns.

Raw secrets

The adapter reads the raw value from TruffleHog JSON but never emits it into the SARIF result. Only the Redacted preview survives the round-trip.