TruffleHog
Hunts secrets in repos and verifies them (checks if the credential is still live).
A secret hunter that goes a step further: besides finding credentials in repos, files or storage systems, it VERIFIES them (checks against the provider whether the key is still valid). That cuts the noise down to the secrets that actually matter. Widely used in both offensive auditing and defense.
Family Web discovery & fuzzing
Flags git file:// --only-verified
Concepts Secrets in git history, Credentials in source code
Cheatsheet Common apps (Tomcat, Jenkins, Git...)
Installation
go install github.com/trufflesecurity/trufflehog/v3@latestUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.