trufflehog

Find credentials in git history and live systems

trufflesecurity/trufflehog · Pre-commit & Secrets Detection · scanned v3.99.7 (released 2026-10-24) · commit 31ce31ee1abb · last scan 2026-11-02

335

declared dependencies

0 / 4

critical / high advisories

advisories with a fixed version

7.9

OpenSSF Scorecard (of 10); OpenSSF public dataset

verified

release verification

Changes since last week

no change.

Known vulnerabilities (12)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

Severity	Advisory	Package	Version	Fixed in	OSV	Released binary	KEV	EPSS	Declared in	Dispute
High	`GHSA-rg2x-37c3-w2rh` source CVE-2026-42306	`github.com/docker/docker` golang	`v28.5.2+incompatible`	no fix listed	✓	—	no	0.1%	`go.mod`	Dispute
High	`GHSA-x86f-5xw2-fm2r` source CVE-2026-41567	`github.com/docker/docker` golang	`v28.5.2+incompatible`	no fix listed	✓	—	no	0.2%	`go.mod`	Dispute
High	`GO-2026-4887` source CVE-2026-34040, GHSA-x744-4wpc-v9h2	`github.com/docker/docker` golang	`v28.5.2+incompatible`	no fix listed	✓	—	no	9.3%	`go.mod`	Dispute
High	`GHSA-mgcc-cww5-fp2q` source CVE-2026-116587	`github.com/go-jose/go-jose/v4` golang	`v4.1.4`	4.1.6	✓	—	no	0.4%	`go.mod`	Dispute
Medium	`GHSA-685w-q87j-wqw3` source CVE-2026-85747	`github.com/docker/distribution` golang	`v2.8.3+incompatible`	no fix listed	✓	—	no	0.2%	`go.mod`	Dispute
Medium	`GHSA-pxq6-2prw-chj9` source CVE-2026-33997	`github.com/docker/docker` golang	`v28.5.2+incompatible`	no fix listed	✓	—	no	0.4%	`go.mod`	Dispute
Medium	`GHSA-vp62-88p7-qqf5` source CVE-2026-41568	`github.com/docker/docker` golang	`v28.5.2+incompatible`	no fix listed	✓	—	no	0.1%	`go.mod`	Dispute
Medium	`GHSA-4w3g-jfj2-cw2q` source CVE-2026-116585	`github.com/go-jose/go-jose/v4` golang	`v4.1.4`	4.1.5	✓	—	no	0.3%	`go.mod`	Dispute
Medium	`GHSA-vvm8-gf78-28g4` source CVE-2026-116586	`github.com/go-jose/go-jose/v4` golang	`v4.1.4`	4.1.5	✓	—	no	0.3%	`go.mod`	Dispute
Unknown	`GO-2026-5932` source	`golang.org/x/crypto` golang	`v0.57.0`	no fix listed	✓	—	no	—	`go.mod`	Dispute
Unknown	`GO-2026-6860` source CVE-2026-78661	`golang.org/x/net` golang	`v0.60.0`	0.62.0	✓	—	no	0.2%	`go.mod`	Dispute
Unknown	`GO-2026-6866` source CVE-2026-97045	`golang.org/x/net` golang	`v0.60.0`	0.62.0	✓	—	no	0.2%	`go.mod`	Dispute

Second opinion: OSV-Scanner

OSV-Scanner found 12 advisories in the same files; 12 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.

Vulnerable code in the released binary

trufflehog_3.99.7_linux_amd64.tar.gz could not be analyzed: no Go build information (the binary may be compressed, for example with UPX, or not built with Go)

Release integrity

Verdict: verified for trufflehog_3.99.7_linux_amd64.tar.gz. The download matches GitHub's recorded digest.

Checksums file: yes
Signatures: yes
SLSA provenance: no
SBOM published with the release: no

Check	Result	Detail
Cosign signature	verified	GitHub Actions workflow in trufflesecurity/trufflehog; via checksums file trufflehog_3.99.7_checksums.txt

Verified means a signature, provenance, or attestation was checked against an identity in trufflesecurity/trufflehog's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

Score 7.9/10, assessed 2026-10-19 (OpenSSF public dataset). Scorecard viewer

All checks

Check	Score	Reason
CII-Best-Practices	0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	0	detected GitHub workflow tokens with excessive permissions
Branch-Protection	5	branch protection is not maximal on development and all release branches
Pinned-Dependencies	7	dependency not pinned by hash detected -- score normalized to 7
Signed-Releases	8	5 out of the last 5 releases have a total of 5 signed artifacts.
Binary-Artifacts	9	binaries present in source code
Code-Review	10	all changesets reviewed
Dangerous-Workflow	10	no dangerous workflow patterns detected
Fuzzing	10	project is fuzzed
License	10	license file detected
Maintained	10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging	10	packaging workflow detected
SAST	10	SAST tool is run on all commits
Security-Policy	10	security policy file detected

GitHub Actions workflow audit (zizmor)

6 potential issues in 11 workflow files at this release: 3 high, 2 medium, 1 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

All findings

Severity	Rule	Location	Note
High	excessive-permissions overly broad permissions	`.github/workflows/release.yml:9`	contents: write is overly broad at the workflow level
High	excessive-permissions overly broad permissions	`.github/workflows/release.yml:10`	packages: write is overly broad at the workflow level
High	excessive-permissions overly broad permissions	`.github/workflows/release.yml:11`	id-token: write is overly broad at the workflow level
Medium	excessive-permissions overly broad permissions	`.github/workflows/performance.yml:6`	this job
Medium	excessive-permissions overly broad permissions	`.github/workflows/secrets.yml:13`	this job
Low	self-repository use GitHub's dedicated self-repository syntax	`.github/workflows/secrets.yml:22`	this step

Dependencies (335)

By ecosystem: golang 314, github 20, unknown 1.

Licenses (as declared in the SBOM): unknown 335.

golang (314)

Name	Version	Declared in
`cel.dev/expr`	`v0.25.2`	`go.mod`
`cloud.google.com/go`	`v0.121.6`	`go.mod`
`cloud.google.com/go/auth`	`v0.18.2`	`go.mod`
`cloud.google.com/go/auth/oauth2adapt`	`v0.2.8`	`go.mod`
`cloud.google.com/go/compute/metadata`	`v0.9.0`	`go.mod`
`cloud.google.com/go/iam`	`v1.5.3`	`go.mod`
`cloud.google.com/go/monitoring`	`v1.24.3`	`go.mod`
`cloud.google.com/go/secretmanager`	`v1.16.0`	`go.mod`
`cloud.google.com/go/storage`	`v1.56.1`	`go.mod`
`dario.cat/mergo`	`v1.0.2`	`go.mod`
`filippo.io/edwards25519`	`v1.1.1`	`go.mod`
`github.com/adrg/strutil`	`v0.3.1`	`go.mod`
`github.com/alecthomas/chroma/v2`	`v2.14.0`	`go.mod`
`github.com/alecthomas/kingpin/v2`	`v2.4.0`	`go.mod`
`github.com/alecthomas/units`	`v0.0.0-20211218093645-b94a6e3cc137`	`go.mod`
`github.com/andybalholm/brotli`	`v1.2.7`	`go.mod`
`github.com/atotto/clipboard`	`v0.1.4`	`go.mod`
`github.com/avast/apkparser`	`v0.0.0-20260423123151-7fcaee440f68`	`go.mod`
`github.com/aws/aws-sdk-go-v2`	`v1.43.7`	`go.mod`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.18`	`go.mod`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.38`	`go.mod`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.37`	`go.mod`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.38`	`go.mod`
`github.com/aws/aws-sdk-go-v2/feature/s3/manager`	`v1.22.44`	`go.mod`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.38`	`go.mod`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.38`	`go.mod`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.39`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.17`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.9.31`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.38`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.19.39`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.107.3`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.5.7`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/sns`	`v1.42.7`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.33.7`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.38.7`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.45.7`	`go.mod`
`github.com/aws/smithy-go`	`v1.27.9`	`go.mod`
`github.com/aymanbagabas/go-osc52`	`v1.2.2`	`go.mod`
`github.com/aymanbagabas/go-osc52/v2`	`v2.0.1`	`go.mod`
`github.com/aymerick/douceur`	`v0.2.0`	`go.mod`
`github.com/Azure/go-ansiterm`	`v0.0.0-20250102033503-faa5f7b0171c`	`go.mod`
`github.com/Azure/go-ntlmssp`	`v0.1.1`	`go.mod`
`github.com/AzureAD/microsoft-authentication-library-for-go`	`v1.3.2`	`go.mod`
`github.com/beorn7/perks`	`v1.0.1`	`go.mod`
`github.com/bill-rich/go-syslog`	`v0.0.0-20220413021637-49edb52a574c`	`go.mod`
`github.com/BobuSumisu/aho-corasick`	`v1.0.3`	`go.mod`
`github.com/bodgit/plumbing`	`v1.3.0`	`go.mod`
`github.com/bodgit/sevenzip`	`v1.6.5`	`go.mod`
`github.com/bodgit/windows`	`v1.0.1`	`go.mod`
`github.com/bradleyfalzon/ghinstallation/v2`	`v2.16.0`	`go.mod`
`github.com/brianvoe/gofakeit/v7`	`v7.6.0`	`go.mod`
`github.com/cenkalti/backoff/v4`	`v4.3.0`	`go.mod`
`github.com/cespare/xxhash/v2`	`v2.3.0`	`go.mod`
`github.com/charmbracelet/bubbles`	`v0.18.0`	`go.mod`
`github.com/charmbracelet/bubbletea`	`v1.3.10`	`go.mod`
`github.com/charmbracelet/colorprofile`	`v0.2.3-0.20250311203215-f60798e515dc`	`go.mod`
`github.com/charmbracelet/glamour`	`v0.10.0`	`go.mod`
`github.com/charmbracelet/lipgloss`	`v1.1.1-0.20250404203927-76690c660834`	`go.mod`
`github.com/charmbracelet/x/ansi`	`v0.10.1`	`go.mod`
`github.com/charmbracelet/x/cellbuf`	`v0.0.13`	`go.mod`
`github.com/charmbracelet/x/exp/slice`	`v0.0.0-20250327172914-2fdc97757edf`	`go.mod`
`github.com/charmbracelet/x/term`	`v0.2.1`	`go.mod`
`github.com/cloudflare/circl`	`v1.6.3`	`go.mod`
`github.com/cncf/xds/go`	`v0.0.0-20260202195803-dba9d589def2`	`go.mod`
`github.com/containerd/errdefs`	`v1.0.0`	`go.mod`
`github.com/containerd/errdefs/pkg`	`v0.3.0`	`go.mod`
`github.com/containerd/log`	`v0.1.0`	`go.mod`
`github.com/containerd/platforms`	`v0.2.1`	`go.mod`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.16.3`	`go.mod`
`github.com/couchbase/gocb/v2`	`v2.11.0`	`go.mod`
`github.com/couchbase/gocbcore/v10`	`v10.8.0`	`go.mod`
`github.com/couchbase/gocbcoreps`	`v0.1.3`	`go.mod`
`github.com/couchbase/goprotostellar`	`v1.0.2`	`go.mod`
`github.com/couchbaselabs/gocbconnstr/v2`	`v2.0.0-20240607131231-fb385523de28`	`go.mod`
`github.com/cpuguy83/dockercfg`	`v0.3.2`	`go.mod`
`github.com/crewjam/rfc5424`	`v0.1.0`	`go.mod`
`github.com/csnewman/dextk`	`v0.3.0`	`go.mod`
`github.com/cyphar/filepath-securejoin`	`v0.6.1`	`go.mod`
`github.com/DataDog/zstd`	`v1.5.5`	`go.mod`
`github.com/decred/dcrd/dcrec/secp256k1/v4`	`v4.4.0`	`go.mod`
`github.com/distribution/reference`	`v0.6.0`	`go.mod`
`github.com/dlclark/regexp2`	`v1.11.0`	`go.mod`
`github.com/docker/cli`	`v29.3.1+incompatible`	`go.mod`
`github.com/docker/distribution`	`v2.8.3+incompatible`	`go.mod`
`github.com/docker/docker`	`v28.5.2+incompatible`	`go.mod`
`github.com/docker/docker-credential-helpers`	`v0.9.3`	`go.mod`
`github.com/docker/go-connections`	`v0.7.0`	`go.mod`
`github.com/docker/go-units`	`v0.5.0`	`go.mod`
`github.com/dsnet/compress`	`v0.0.2-0.20230904184137-39efe44ab707`	`go.mod`
`github.com/dustin/go-humanize`	`v1.0.1`	`go.mod`
`github.com/ebitengine/purego`	`v0.10.0`	`go.mod`
`github.com/elastic/elastic-transport-go/v8`	`v8.6.1`	`go.mod`
`github.com/elastic/go-elasticsearch/v8`	`v8.17.1`	`go.mod`
`github.com/emirpasic/gods`	`v1.18.1`	`go.mod`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.37.0`	`go.mod`
`github.com/envoyproxy/protoc-gen-validate`	`v1.3.3`	`go.mod`
`github.com/erikgeiser/coninput`	`v0.0.0-20211004153227-1c3628e74d0f`	`go.mod`
`github.com/fatih/color`	`v1.18.0`	`go.mod`
`github.com/felixge/fgprof`	`v0.9.5`	`go.mod`
`github.com/felixge/httpsnoop`	`v1.0.4`	`go.mod`
`github.com/fsnotify/fsnotify`	`v1.6.0`	`go.mod`
`github.com/gabriel-vasile/mimetype`	`v1.4.15`	`go.mod`
`github.com/getsentry/sentry-go`	`v0.32.0`	`go.mod`
`github.com/go-asn1-ber/asn1-ber`	`v1.5.8`	`go.mod`
`github.com/go-errors/errors`	`v1.5.1`	`go.mod`
`github.com/go-git/gcfg`	`v1.5.1-0.20230307220236-3a3c6141e376`	`go.mod`
`github.com/go-git/go-billy/v5`	`v5.9.0`	`go.mod`
`github.com/go-git/go-git/v5`	`v5.19.2`	`go.mod`
`github.com/go-jose/go-jose/v4`	`v4.1.4`	`go.mod`
`github.com/go-logr/logr`	`v1.4.4`	`go.mod`
`github.com/go-logr/stdr`	`v1.2.2`	`go.mod`
`github.com/go-logr/zapr`	`v1.3.0`	`go.mod`
`github.com/go-ole/go-ole`	`v1.3.0`	`go.mod`
`github.com/go-redis/redis`	`v6.15.9+incompatible`	`go.mod`
`github.com/go-sql-driver/mysql`	`v1.8.1`	`go.mod`
`github.com/gobwas/glob`	`v0.2.3`	`go.mod`
`github.com/goccy/go-json`	`v0.10.3`	`go.mod`
`github.com/gofrs/flock`	`v0.12.1`	`go.mod`
`github.com/golang-jwt/jwt/v4`	`v4.5.2`	`go.mod`
`github.com/golang-jwt/jwt/v5`	`v5.2.3`	`go.mod`
`github.com/golang-sql/civil`	`v0.0.0-20220223132316-b832511892a9`	`go.mod`
`github.com/golang-sql/sqlexp`	`v0.1.0`	`go.mod`
`github.com/golang/groupcache`	`v0.0.0-20241129210726-2c02b8208cf8`	`go.mod`
`github.com/golang/snappy`	`v1.0.0`	`go.mod`
`github.com/google/go-cmp`	`v0.7.0`	`go.mod`
`github.com/google/go-containerregistry`	`v0.20.6`	`go.mod`
`github.com/google/go-github/v67`	`v67.0.0`	`go.mod`
`github.com/google/go-github/v72`	`v72.0.0`	`go.mod`
`github.com/google/go-querystring`	`v1.2.0`	`go.mod`
`github.com/google/pprof`	`v0.0.0-20240227163752-401108e1b7e7`	`go.mod`
`github.com/google/s2a-go`	`v0.1.9`	`go.mod`
`github.com/google/uuid`	`v1.6.0`	`go.mod`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.11`	`go.mod`
`github.com/googleapis/gax-go/v2`	`v2.17.0`	`go.mod`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.33.0`	`go.mod`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.53.0`	`go.mod`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.53.0`	`go.mod`
`github.com/gorilla/css`	`v1.0.1`	`go.mod`
`github.com/gorilla/websocket`	`v1.5.3`	`go.mod`
`github.com/grpc-ecosystem/go-grpc-middleware`	`v1.4.0`	`go.mod`
`github.com/h2non/parth`	`v0.0.0-20190131123155-b4df798d6542`	`go.mod`
`github.com/hashicorp/errwrap`	`v1.1.0`	`go.mod`
`github.com/hashicorp/go-cleanhttp`	`v0.5.2`	`go.mod`
`github.com/hashicorp/go-multierror`	`v1.1.1`	`go.mod`
`github.com/hashicorp/go-retryablehttp`	`v0.7.8`	`go.mod`
`github.com/hashicorp/golang-lru/v2`	`v2.0.7`	`go.mod`
`github.com/jackc/pgpassfile`	`v1.0.0`	`go.mod`
`github.com/jackc/pgservicefile`	`v0.0.0-20240606120523-5a60cdf6a761`	`go.mod`
`github.com/jackc/pgx/v5`	`v5.9.2`	`go.mod`
`github.com/jbenet/go-context`	`v0.0.0-20150711004518-d14ea06fba99`	`go.mod`
`github.com/jedib0t/go-pretty/v6`	`v6.6.8`	`go.mod`
`github.com/jlaffaye/ftp`	`v0.2.0`	`go.mod`
`github.com/joho/godotenv`	`v1.5.1`	`go.mod`
`github.com/jpillora/s3`	`v1.1.4`	`go.mod`
`github.com/k0kubun/go-ansi`	`v0.0.0-20180517002512-3bf9e2903213`	`go.mod`
`github.com/kevinburke/ssh_config`	`v1.2.0`	`go.mod`
`github.com/kjk/lzma`	`v0.0.0-20161016003348-3fd93898850d`	`go.mod`
`github.com/klauspost/compress`	`v1.20.3`	`go.mod`
`github.com/klauspost/cpuid/v2`	`v2.3.0`	`go.mod`
`github.com/klauspost/pgzip`	`v1.2.6`	`go.mod`
`github.com/kylelemons/godebug`	`v1.1.0`	`go.mod`
`github.com/lestrrat-go/blackmagic`	`v1.0.4`	`go.mod`
`github.com/lestrrat-go/httpcc`	`v1.0.1`	`go.mod`
`github.com/lestrrat-go/httprc/v3`	`v3.0.1`	`go.mod`
`github.com/lestrrat-go/jwx/v3`	`v3.0.12`	`go.mod`
`github.com/lestrrat-go/option`	`v1.0.1`	`go.mod`
`github.com/lestrrat-go/option/v2`	`v2.0.0`	`go.mod`
`github.com/lib/pq`	`v1.10.9`	`go.mod`
`github.com/lrstanley/bubblezone`	`v0.0.0-20250404061050-e13639e27357`	`go.mod`
`github.com/lucasb-eyer/go-colorful`	`v1.2.0`	`go.mod`
`github.com/lufia/plan9stats`	`v0.0.0-20260330125221-c963978e514e`	`go.mod`
`github.com/magiconair/properties`	`v1.8.10`	`go.mod`
`github.com/marusama/semaphore/v2`	`v2.5.0`	`go.mod`
`github.com/mattn/go-colorable`	`v0.1.13`	`go.mod`
`github.com/mattn/go-isatty`	`v0.0.20`	`go.mod`
`github.com/mattn/go-localereader`	`v0.0.1`	`go.mod`
`github.com/mattn/go-runewidth`	`v0.0.16`	`go.mod`
`github.com/maypok86/otter/v2`	`v2.3.0`	`go.mod`
`github.com/mholt/archives`	`v0.0.0-20241216060121-23e0af8fe73d`	`go.mod`
`github.com/microcosm-cc/bluemonday`	`v1.0.27`	`go.mod`
`github.com/microsoft/go-mssqldb`	`v1.8.2`	`go.mod`
`github.com/Microsoft/go-winio`	`v0.6.2`	`go.mod`
`github.com/mitchellh/colorstring`	`v0.0.0-20190213212951-d06e56a500db`	`go.mod`
`github.com/mitchellh/go-homedir`	`v1.1.0`	`go.mod`
`github.com/mitchellh/go-ps`	`v1.0.0`	`go.mod`
`github.com/moby/docker-image-spec`	`v1.3.1`	`go.mod`
`github.com/moby/go-archive`	`v0.3.0`	`go.mod`
`github.com/moby/moby/api`	`v1.54.2`	`go.mod`
`github.com/moby/moby/client`	`v0.4.1`	`go.mod`
`github.com/moby/patternmatcher`	`v0.6.1`	`go.mod`
`github.com/moby/sys/sequential`	`v0.7.0`	`go.mod`
`github.com/moby/sys/user`	`v0.4.1`	`go.mod`
`github.com/moby/sys/userns`	`v0.1.0`	`go.mod`
`github.com/moby/term`	`v0.5.2`	`go.mod`
`github.com/montanaflynn/stats`	`v0.7.1`	`go.mod`
`github.com/muesli/ansi`	`v0.0.0-20230316100256-276c6243b2f6`	`go.mod`
`github.com/muesli/cancelreader`	`v0.2.2`	`go.mod`
`github.com/muesli/reflow`	`v0.3.0`	`go.mod`
`github.com/muesli/termenv`	`v0.16.0`	`go.mod`
`github.com/munnerz/goautoneg`	`v0.0.0-20191010083416-a7dc8b61c822`	`go.mod`
`github.com/nwaples/rardecode/v2`	`v2.4.5`	`go.mod`
`github.com/onsi/ginkgo`	`v1.16.5`	`go.mod`
`github.com/opencontainers/go-digest`	`v1.0.0`	`go.mod`
`github.com/opencontainers/image-spec`	`v1.1.1`	`go.mod`
`github.com/patrickmn/go-cache`	`v2.1.0+incompatible`	`go.mod`
`github.com/paulbellamy/ratecounter`	`v0.2.0`	`go.mod`
`github.com/pierrec/lz4/v4`	`v4.1.27`	`go.mod`
`github.com/pjbgf/sha1cd`	`v0.6.0`	`go.mod`
`github.com/pkg/errors`	`v0.9.1`	`go.mod`
`github.com/planetscale/vtprotobuf`	`v0.6.1-0.20240319094008-0393e58bdf10`	`go.mod`
`github.com/power-devops/perfstat`	`v0.0.0-20240221224432-82ca36839d55`	`go.mod`
`github.com/prometheus/client_golang`	`v1.20.5`	`go.mod`
`github.com/prometheus/client_model`	`v0.6.2`	`go.mod`
`github.com/prometheus/common`	`v0.55.0`	`go.mod`
`github.com/prometheus/procfs`	`v0.15.1`	`go.mod`
`github.com/ProtonMail/go-crypto`	`v1.1.6`	`go.mod`
`github.com/rabbitmq/amqp091-go`	`v1.14.0`	`go.mod`
`github.com/repeale/fp-go`	`v0.11.1`	`go.mod`
`github.com/rivo/uniseg`	`v0.4.7`	`go.mod`
`github.com/sahilm/fuzzy`	`v0.1.1-0.20230530133925-c48e322e2a8f`	`go.mod`
`github.com/sassoftware/go-rpmutils`	`v0.4.0`	`go.mod`
`github.com/schollz/progressbar/v3`	`v3.17.1`	`go.mod`
`github.com/segmentio/asm`	`v1.2.1`	`go.mod`
`github.com/sendgrid/rest`	`v2.6.9+incompatible`	`go.mod`
`github.com/sendgrid/sendgrid-go`	`v3.16.1+incompatible`	`go.mod`
`github.com/sergi/go-diff`	`v1.3.2-0.20230802210424-5b0b94c5c0d3`	`go.mod`
`github.com/shirou/gopsutil/v4`	`v4.26.4`	`go.mod`
`github.com/shuheiktgw/go-travis`	`v0.3.1`	`go.mod`
`github.com/shurcooL/githubv4`	`v0.0.0-20260209031235-2402fdf4a9ed`	`go.mod`
`github.com/shurcooL/graphql`	`v0.0.0-20230722043721-ed46e5a46466`	`go.mod`
`github.com/sirupsen/logrus`	`v1.9.4`	`go.mod`
`github.com/skeema/knownhosts`	`v1.3.1`	`go.mod`
`github.com/sorairolake/lzip-go`	`v0.3.5`	`go.mod`
`github.com/spf13/afero`	`v1.15.0`	`go.mod`
`github.com/spiffe/go-spiffe/v2`	`v2.7.0`	`go.mod`
`github.com/stangelandcl/ppmd`	`v0.1.1`	`go.mod`
`github.com/STARRY-S/zip`	`v0.2.1`	`go.mod`
`github.com/stretchr/objx`	`v0.5.3`	`go.mod`
`github.com/stretchr/testify`	`v1.12.1`	`go.mod`
`github.com/testcontainers/testcontainers-go`	`v0.42.0`	`go.mod`
`github.com/testcontainers/testcontainers-go/modules/elasticsearch`	`v0.42.0`	`go.mod`
`github.com/testcontainers/testcontainers-go/modules/mongodb`	`v0.42.0`	`go.mod`
`github.com/testcontainers/testcontainers-go/modules/mssql`	`v0.42.0`	`go.mod`
`github.com/testcontainers/testcontainers-go/modules/mysql`	`v0.42.0`	`go.mod`
`github.com/testcontainers/testcontainers-go/modules/postgres`	`v0.42.1-0.20260423004847-9fc0246c3859`	`go.mod`
`github.com/tetratelabs/wazero`	`v1.12.0`	`go.mod`
`github.com/therootcompany/xz`	`v1.0.1`	`go.mod`
`github.com/TheZeroSlave/zapsentry`	`v1.23.0`	`go.mod`
`github.com/tklauser/go-sysconf`	`v0.4.0`	`go.mod`
`github.com/tklauser/numcpus`	`v0.12.0`	`go.mod`
`github.com/trufflesecurity/disk-buffer-reader`	`v0.2.1`	`go.mod`
`github.com/trufflesecurity/ldap-verify`	`v0.0.0-20261012152128-4a15fafb6e19`	`go.mod`
`github.com/trufflesecurity/overseer`	`v1.2.8`	`go.mod`
`github.com/trufflesecurity/touchfile`	`v0.1.1`	`go.mod`
`github.com/trufflesecurity/waas-client-library-go`	`v1.0.9`	`go.mod`
`github.com/ulikunitz/xz`	`v0.5.15`	`go.mod`
`github.com/vbatts/tar-split`	`v0.12.1`	`go.mod`
`github.com/wasilibs/go-re2`	`v1.12.0`	`go.mod`
`github.com/wasilibs/wazero-helpers`	`v0.0.0-20250123031827-cd30c44769bb`	`go.mod`
`github.com/xanzy/ssh-agent`	`v0.3.3`	`go.mod`
`github.com/xdg-go/pbkdf2`	`v1.0.0`	`go.mod`
`github.com/xdg-go/scram`	`v1.1.2`	`go.mod`
`github.com/xdg-go/stringprep`	`v1.0.4`	`go.mod`
`github.com/xhit/go-str2duration/v2`	`v2.1.0`	`go.mod`
`github.com/xi2/xz`	`v0.0.0-20171230120015-48954b6210f8`	`go.mod`
`github.com/xo/dburl`	`v0.23.8`	`go.mod`
`github.com/xo/terminfo`	`v0.0.0-20220910002029-abceb7e1c41e`	`go.mod`
`github.com/youmark/pkcs8`	`v0.0.0-20240726163527-a2c0da244d78`	`go.mod`
`github.com/yuin/goldmark`	`v1.7.17`	`go.mod`
`github.com/yuin/goldmark-emoji`	`v1.0.5`	`go.mod`
`github.com/yusufpapurcu/wmi`	`v1.2.4`	`go.mod`
`gitlab.com/gitlab-org/api/client-go`	`v1.12.0`	`go.mod`
`go.mongodb.org/mongo-driver`	`v1.17.7`	`go.mod`
`go.opentelemetry.io/auto/sdk`	`v1.2.1`	`go.mod`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.44.0`	`go.mod`
`go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc`	`v0.62.0`	`go.mod`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.68.0`	`go.mod`
`go.opentelemetry.io/otel`	`v1.45.0`	`go.mod`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace`	`v1.45.0`	`go.mod`
`go.opentelemetry.io/otel/metric`	`v1.45.0`	`go.mod`
`go.opentelemetry.io/otel/sdk`	`v1.45.0`	`go.mod`
`go.opentelemetry.io/otel/sdk/metric`	`v1.45.0`	`go.mod`
`go.opentelemetry.io/otel/trace`	`v1.45.0`	`go.mod`
`go.opentelemetry.io/proto/otlp`	`v1.11.0`	`go.mod`
`go.uber.org/automaxprocs`	`v1.6.0`	`go.mod`
`go.uber.org/mock`	`v0.6.0`	`go.mod`
`go.uber.org/multierr`	`v1.11.0`	`go.mod`
`go.uber.org/zap`	`v1.27.0`	`go.mod`
`go.yaml.in/yaml/v3`	`v3.0.5`	`go.mod`
`go4.org`	`v0.0.0-20260112195520-a5071408f32f`	`go.mod`
`golang.org/x/crypto`	`v0.57.0`	`go.mod`
`golang.org/x/mod`	`v0.41.0`	`go.mod`
`golang.org/x/net`	`v0.60.0`	`go.mod`
`golang.org/x/oauth2`	`v0.36.0`	`go.mod`
`golang.org/x/sync`	`v0.23.0`	`go.mod`
`golang.org/x/sys`	`v0.48.0`	`go.mod`
`golang.org/x/term`	`v0.46.0`	`go.mod`
`golang.org/x/text`	`v0.42.0`	`go.mod`
`golang.org/x/time`	`v0.14.0`	`go.mod`
`google.golang.org/api`	`v0.264.0`	`go.mod`
`google.golang.org/genproto`	`v0.0.0-20260128011058-8636f8732409`	`go.mod`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260720211330-0afa2a65878a`	`go.mod`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260720211330-0afa2a65878a`	`go.mod`
`google.golang.org/grpc`	`v1.83.2`	`go.mod`
`google.golang.org/protobuf`	`v1.36.11`	`go.mod`
`gopkg.in/h2non/gock.v1`	`v1.1.2`	`go.mod`
`gopkg.in/warnings.v0`	`v0.1.2`	`go.mod`
`gopkg.in/yaml.v2`	`v2.4.0`	`go.mod`
`gopkg.in/yaml.v3`	`v3.0.1`	`go.mod`
`pault.ag/go/debian`	`v0.18.0`	`go.mod`
`pault.ag/go/topsort`	`v0.1.1`	`go.mod`
`pgregory.net/rapid`	`v1.2.0`	`go.mod`
`sigs.k8s.io/yaml`	`v1.4.0`	`go.mod`

github (20)

Name	Version	Declared in
`actions/cache/restore`	`v6`	`.github/workflows/detector-corpora-test.yml`
`actions/cache/save`	`v6`	`.github/workflows/detector-corpora-test.yml`
`actions/checkout`	`v7`	`.github/workflows/codeql-analysis.yml`
`actions/github-script`	`v9`	`.github/workflows/detector-corpora-test.yml`
`actions/setup-go`	`v7`	`.github/workflows/codeql-analysis.yml`
`aws-actions/configure-aws-credentials`	`v6`	`.github/workflows/detector-corpora-test.yml`
`buildpulse/buildpulse-action`	`v3`	`.github/workflows/test.yml`
`docker/login-action`	`v4`	`.github/workflows/release-bot.yml`
`docker/setup-qemu-action`	`v4`	`.github/workflows/release.yml`
`github/codeql-action/analyze`	`v4`	`.github/workflows/codeql-analysis.yml`
`github/codeql-action/init`	`v4`	`.github/workflows/codeql-analysis.yml`
`golangci/golangci-lint-action`	`v9`	`.github/workflows/lint.yml`
`google-github-actions/auth`	`v3`	`.github/workflows/release-bot.yml`
`goreleaser/goreleaser-action`	`v7`	`.github/workflows/release.yml`
`jaxxstorm/action-install-gh-release`	`v3.0.0`	`.github/workflows/detector-tests.yml`
`mikepenz/action-junit-report`	`v6`	`.github/workflows/test.yml`
`peter-evans/create-or-update-comment`	`v5`	`.github/workflows/detector-corpora-test.yml`
`peter-evans/find-comment`	`v4`	`.github/workflows/detector-corpora-test.yml`
`rwx-research/setup-captain`	`v1.4.1`	`.github/workflows/detector-tests.yml`
`sigstore/cosign-installer`	`v3.10.1`	`.github/workflows/release.yml`

unknown (1)

Name	Version	License	Declared in
`./`	`UNKNOWN`		`.github/workflows/secrets.yml`

History

Week	Version	Dependencies	Critical	High	Medium	Low	Unknown	Changes
2026-11-02	v3.99.7	335	0	4	5	0	3	—
2026-11-01	v3.99.7	335	0	4	5	0	3	—

SBOM minimum elements

Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.

Standard	Score	Checks passed	Failed checks
NTIA 2021	71	5/7	Supplier Name, Dependency Relationship
CISA 2025	50	5/10	Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author
BSI TR-03183	44	4/9	Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact

Evidence

Downloads for this week: CycloneDX SBOM · Grype report

Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/trufflesecurity__trufflehog/.

13 manifests and lockfiles scanned

.github/workflows/codeql-analysis.yml, .github/workflows/detector-corpora-test.yml, .github/workflows/detector-tests.yml, .github/workflows/lint.yml, .github/workflows/performance.yml, .github/workflows/release-bot.yml, .github/workflows/release.yml, .github/workflows/secrets.yml, .github/workflows/smoke.yml, .github/workflows/test.yml, action.yml, go.mod, go.sum

Full JSON for this project · Atom feed of weekly changes

Badges

shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.

[![release verification](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Ftrufflesecurity%2Ftrufflehog%2Frelease.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/trufflesecurity/trufflehog/index.html)

How this report is made

Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.

Tool	What it does here	Version this week
Syft	Generates a CycloneDX SBOM from each release's manifests and lockfiles.	1.55.0
Grype	Matches the SBOM against known vulnerabilities.	0.121.0
OSV-Scanner	Checks the same files against the OSV database to confirm or add matches.	2.7.0
govulncheck	For Go tools, finds which advisories have vulnerable code compiled into the released Linux binary.	1.9.0
zizmor	Audits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions.	1.31.1
OpenSSF Scorecard	Scores repository security practices such as code review, branch protection, and pinned dependencies.	5.6.0
Cosign	Verifies Sigstore signatures on the release binary or its checksums file.	3.1.4
slsa-verifier	Verifies SLSA build provenance published with the release.	2.7.1
GitHub CLI attestations	Verifies GitHub artifact attestations for the release binary.	—
sbomlyze	Diffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer.	0.6.0