code.trufflehogtrufflehog secret scan
Runs trufflehog over the working tree for hardcoded secrets. Credentials are NOT verified by default (--no-verification), so nothing leaves the machine; set settings["code.trufflehog"].verify = true to let trufflehog send each found secret to its provider's API to confirm it is live (verified secrets are reported as critical).
- Engine
- Wrapped scanner
- Wraps
trufflehog- Targets
- Codebase
- Areas
- Security
- Runs
- By default, when the target applies
- Network
- Only the target itself
Run only this auditor
bunx openaudit . --only code.trufflehogWraps trufflehog. When it isn't installed, the auditor is skipped with an install hint and the rest of the audit runs.