TruffleHog
Scans repositories, S3, GCS, Docker images and directories for leaked secrets and checks whether they still work.
How the 7.6 was reached
- Quality of output8/10
28,187 GitHub stars, active project, 800+ detectors with credential verification to cut false positives. github.com
- Ease of use6/10
Open source with an integrations page, but no direct evidence of quick onboarding steps. trufflesecurity.com
- Pricing value9/10
Open-source version is free with 800+ detectors under AGPL-3.0; paid tiers are optional. trufflesecurity.com
- API and integration quality7/10
GitHub Actions, pre-commit and pre-receive hooks plus an integrations page; no API reference cited. trufflesecurity.com
- Solves the problem it claims to solve8/10
Heavy adoption supports secret scanning across repositories, including all branches, as claimed. github.com
7.6/10 is the mean of the 5 criteria that apply. Scored on the five-criteria rubric v1, 29 September 2026. How scoring works
Pricing
- 800+ detectors
- GitHub, S3, directory, GCS and Docker scanning
- GitHub Actions, pre-commit and pre-receive hooks
- AGPL-3.0
- 20+ integrations
- Continuous monitoring
- Dashboard
- SSO and role-based access control
Key Features
- Classifies 800+ secret types
- Credential verification to cut false positives
- Scans all branches, not only main
- GitHub Actions, pre-commit and pre-receive hooks
- Custom regex
Pros & Cons
Pros
- Free open-source version with 800+ detectors
- Verification cuts false positives
- 28,187 GitHub stars and an active project
- Blocks leaks before commit through hooks
Cons
- No direct evidence of quick onboarding
- No API reference cited
- AGPL-3.0 license may matter for some companies
- Dashboard, SSO and monitoring need the paid tier
A strong pick for any team that wants secret scanning in CI or pre-commit for free. Larger orgs needing dashboards and access control will need the Enterprise tier.
Try TruffleHog →Added to scored.tools on
Competitors to TruffleHog
Other tools in the coding category worth comparing.
