THE DIG
Thoughts, research, reports, and more from Truffle Security Co.
We've written a lot, so here's a search…
Dylan Ayrey
Model Distillation: Why Attackers Want Your API Keys
Truffle Security
The Next Supply Chain Attack May Start With a Stolen Token
Truffle Security
Focused S3 Scanning and OAuth2 Authentication in TruffleHog Enterprise October 2026 Release
Brittany Bodane
Leaked Credentials Let an AI Agent Into Two Companies’ Systems
Truffle Security Research
One non-human identity, two states
Truffle Security Research
Why exposed credentials stay live for years
Truffle Security Research
GitHub Repos Exposed 543,699 Credentials. Nobody Revoked Them.
Dylan Ayrey
AI Worms Are Coming Soon
Dylan Ayrey
The 14 leaked API keys that fueled OpenAI's Hugging Face attack
Luke Marshall
We discovered a Ruby account takeover; Rogue OpenAI Agents exploited it 2 months prior
Luke Marshall
How We Almost Owned the Internet's TLS
Dzianis Skliar
Scanning 1.2 Million DotNetFiddle Snippets for Secrets
Matt Brady
Beyond Laptops: What secrets to expect on your endpoints
Truffle Security Research
768 Leaked Corporate AWS Keys Held Full Admin Rights
Jim Freely
Introducing TruffleHog AWS Analyze: Know What a Leaked AWS Key Can Reach
Luke Marshall
API Keys Leaking in PNG Metadata of AI Images
Ian Sharpe
What's New in TruffleHog Enterprise: August 2026 Release Highlights
Dylan Ayrey
Scanning 7.6 Petabytes of Hugging Face Training Data for Secrets
Luke Marshall
Securing the Supply Chain: Cache Vulnerability in RubyGems
Luke Marshall
Preventing a Supply Chain Attack: A Leaked Docker Token in a Public CI Artifact
Ian Sharpe
What's New in TruffleHog Enterprise: July 2026 Release highlights
Truffle Security Research Team
Google Fixes the Gemini API Key Privilege Escalation Issue
Jacob Dowdy
Your PR scan is missing half the problem
Luke Marshall
Admin on Apache Org Exposed for 2.5 Years in Deleted PyPI Package
Dylan Ayrey
CISA's Leaked Admin GitHub Token Remained Live 2 Days After Krebs Reported It Leaked
Ian Sharpe
What’s New in TruffleHog Enterprise: May 2026 Release Highlights
Ben Zimmermann
Thousands of Live Secrets Found Across Four Cloud Development Environments
Luke Marshall
Leaked and Still Live: Why Developers Fail to Remediate Exposed Credentials
Joe Leon
Contributor Spotlight: Strengthening TruffleHog's SSRF Protections
Dylan Ayrey
Claude Tried to Hack 30 Companies. Nobody Asked It To.
Joe Leon
Google API Keys Weren't Secrets. But then Gemini Changed the Rules.
Brad Larsen
TruffleHog now detects JWTs with public-key signatures and verifies them for liveness
Dylan Ayrey
The Rise of API Worms
Luke Marshall
Scanning 5.6 million public GitLab repositories for secrets
Luke Marshall
Scanning 2.6 million public Bitbucket Cloud repositories for secrets
Dylan Ayrey, Brad Larsen, & Zach Rice
We've been doing NHI since 2016
Joe Leon
Contributor Spotlight: Adam Reiser of Cisco Talos
Joe Leon
TruffleHog in Your Logs?
Joe Leon
Detecting Exposed Secrets in Salesforce with TruffleHog
Eduard Agavriloae & Matei Josephs
Guest Post: GCP CloudQuarry: Searching for Secrets in Public GCP Images
Joe Leon
How to Scan Force Pushed Commits for Secrets
Sharon Brizinov
Guest Post: How I Scanned all of GitHub’s “Oops Commits” for Leaked Secrets
Dylan Ayrey
This is how you build an AI Ransomware Worm
Joe Leon
Introducing TruffleHog's Burp Suite Extension: A Techical Deep Dive
Joe Leon
Research finds 12,000 ‘Live’ API Keys and Passwords in DeepSeek's Training Data
Dylan Ayrey and Jake King
Removing Jeff Bezos From My Bed
Ahrav Dutta
Under the Hood: The Algorithmic Power Behind TruffleHog’s Secret Scanning
Dylan Ayrey
Millions of Accounts Vulnerable due to Google’s OAuth Flaw
Dylan Ayrey
Vigilante Justice on GitHub
Joe Leon
Mishandled OAuth Tokens Open Backdoors
Joe Leon
LLMs are Teaching Developers to Hardcode API Keys
Joe Leon
Cracking Open APK Files at Scale
Zach Rice
Announcing the Winners of the TruffleHog Hacktoberfest 2024 Detector Competition
Joe Leon
7 Spooky Places Your Secrets Leak Online
Dylan Ayrey & Joe Leon
10% of TLS Certificates Reuse Private Keys
Joe Leon
Secret Scanning Encoded and Archived Data
Joe Leon
Securely Open-Sourcing on GitHub
Zach Rice
Hacktoberfest 2024: Detector Improvement Competition at Truffle Security!
Joe Leon
Announcing Truffle Security’s CFP
Joe Leon
8 Must-See Talks at OWASP 2024 Global AppSec
Joe Leon
You can Access Private Azure DevOps Repo Data
Joe Leon
TruffleHog Partners With Hugging Face to Scan for Secrets
Joe Leon
Why TruffleHog Analyze is a Game-Changer for Security Teams
Dustin Decker
Contributor Spotlight: Karan Bamal
Dylan Ayrey & The Analyze Team
TruffleHog Now Analyzes Permissions Of API Keys and Passwords
Joe Leon
TruffleHog now finds all Deleted & Private Commits on GitHub
Joe Leon
Anyone can Access Deleted and Private Repository Data on GitHub
Dylan Ayrey & Zach Rice
Secrets in Source Code Are Not A Code Security Problem
Haoxi Tan
Leaked Secrets in Public Jenkins Logs
Dylan Ayrey & Joe Leon
TruffleHog Scans Deleted Git Branches
Joe Leon
TruffleHog Now Scans Jenkins Logs
Charlie Gunyon
TruffleHog Partnering With Elastic to Scan for Secrets
Dylan Ayrey
11,000+ GitHub users' SSH keys are too weak
Joe Leon
Credentials Leaking with Subdomain Takeover
Dylan Ayrey
Stop Recommending JWTs (with symmetric keys)
Joe Leon and Dylan Ayrey
Bug Bounty Hunting Leaked Credentials
Joe Leon
Scan Postman for Secrets with TruffleHog
Joe Leon
(The) Postman Carries Lots of Secrets
Joe Leon
Do Secrets Leak on Public GitHub Gists in 2024?
Joe Leon
Scan Every Tag and Architecture of a Docker Image for Secrets
Sam Chan
How to Scan Jira for Secrets
Dylan Ayrey
The Keyboard Button that Displays Linux Root Memory
Dylan Ayrey
Contributor Spotlight: Helena Rosenzweig and Assetnote team
Joe Leon
How TruffleHog Verifies Secrets
Dylan Ayrey
TruffleHog Now Detects AWS Canaries without setting them off
Haoxi Tan
How to Scan S3 Buckets for Secrets
Haoxi Tan
How to Scan Azure Blobs for Secrets in 2024
Haoxi Tan
Scanning Git for Secrets: The 2024 Comprehensive Guide
Haoxi Tan
The Risks of a Leaked Stripe API Key
Joe Leon
Introducing whoamislack: Identify Slack Workspace Names from Webhook URLs
Joe Leon
74% of publicly leaked keys are never revoked
Joe Leon
Research Uncovers AWS Account Numbers Hidden in Access Keys
Dylan Ayrey
Google OAuth is Broken (Sort Of)
Haoxi Tan
Why did 1 GitHub Repo leak 5,000 Live GCP Keys?
Joe Leon
Running TruffleHog in Travis CI
Zach Rice
Improving TruffleHog Part I: Adding a New Detector
Zach Rice
Announcing the TruffleHog Hacktoberfest 2023 Winners!
Joe Leon
Tailscale + Truffle: A Blueprint for Open Source TruffleHog Contributions
Karim Rahal
Mirror, Mirror, on the Wall, Secrets Leaked from Repos All
Zach Rice
Contributor Spotlight: Richard Gomez
Zach Rice
TruffleHog Detector Competition at Hacktoberfest 2023!
Joe Leon
Think Twice Before Commenting: Thousands of GitHub Comments Leak Live API Keys
Joe Leon
How to Rotate: Key Rotation Tutorials
Joe Leon
How Secrets Leak out of Docker Images
Joe Leon
4,500 of the Top 1 Million Websites Leaked Source Code, Secrets
Miccah Castorina
Do Pre-Commit Hooks Prevent Secrets Leakage?
Joe Leon
Running TruffleHog in Azure Pipelines
Joe Leon
TruffleHog Commands: Git vs Filesystem
Karim Rahal
Does Travis CI leak secrets in 2023?
Hon Kwok
Announcing TruffleHog Terminal UI
Dylan Ayrey
Discovering a Vulnerability in Forager AuthZ, Hours before Public Launch
Joe Leon
Deleting leaked API keys isn’t a solution
Karim Rahal
How Secrets Leak in CI/CD Pipelines
Hon Kwok
Introducing Forager: Browse Millions of Leaked API keys Found With TruffleHog
Mike Vanbuskirk
Running TruffleHog in a GitHub action
Zach Rice
Making TruffleHog Faster with Aho Corasick
Dustin Decker
Secure Credential Storage in 2023
Dylan Ayrey
Introducing: A New XSSHunter, Hosted by the Truffle Security Co.
Dustin Decker
Introducing cloudsql-exporter, a New Way to Protect Cloud SQL Data
Dylan Ayrey
TruffleHog Now Scans CircleCI Build Logs
Chris Grayson
Bypass firewalls with of-CORs and typo-squatting
Dylan Ayrey
Email Graffiti: Hacking Old Email
Dylan Ayrey
It’s Impossible to Find Every Vulnerability, So We Don’t Try To
Dylan Ayrey
Introducing TruffleHog v3
Dylan Ayrey
Introducing Driftwood: Know if Private Keys are Sensitive
Dylan Ayrey
The Breach They Kept Secret
Dylan Ayrey
Truffle Security raises $14 million Series A led by a16z
Dylan Ayrey
Introducing TruffleHog, The Chrome Extension
Dylan Ayrey
Why Isn’t XSS Used More in the Wild?
Dylan Ayrey
A Leaky Key That Led to Jail Time
Dylan Ayrey
Uber’s Wild Story of Leaky Keys
Dylan Ayrey
Leaked Code Leads to Leaked Keys
Dylan Ayrey
Remediating TruffleHog Findings with Doppler
Guest User
An API Worm In The Making: Thousands Of Secrets Found In Open S3 Buckets
Truffle Security Research
AWS Key Quarantine is Not Revocation
PREVIOUS
9