--- title: 2026 April slug: docs/2026-april icon: 🐷 docTags: createdAt: 2026-05-13T17:48:12.377Z --- ## Find More Secrets Expand discovery across more areas of the environment and add detection for additional secret types, ensuring no secrets slip through the cracks. ### What's New - **Confluence Data Center PAT Detector** New detector for Confluence Data Center (on-prem) personal access tokens. Verifies tokens by querying the Confluence REST API and extracts user, display name, and instance URL for triage. - *Availability:* Enterprise and Open Source - **Jira Data Center PAT Detector** New detector for Jira Data Center (on-prem) personal access tokens, distinct from Jira Cloud API tokens. Verifies by hitting the Jira REST API and reports user identity, email, and instance URL. - *Availability:* Enterprise and Open Source - **Bitbucket Data Center PAT Detector** New detector for Bitbucket Data Center (on-prem) personal access tokens. Verifies tokens against the Bitbucket REST API and extracts user, display name, and instance URL. - *Availability:* Enterprise and Open Source - **Pinecone API Key Detector** New detector for Pinecone vector database API keys. Verifies keys against the Pinecone API and extracts project context for triage. - *Availability:* Enterprise and Open Source - **Cloudinary Detector** New detector for Cloudinary API credentials. Verifies keys against the Cloudinary API and extracts account details for investigation. - *Availability:* Enterprise and Open Source - **Customizable Success/Rotation Ranges for Custom Detectors** Custom detectors now support configurable `successRanges` and `rotatedRanges` HTTP status codes, allowing organizations to define which response codes indicate a valid or rotated credential for their internal services. - *Availability:* Enterprise and Open Source - **Confluence Scanning Resumption Fix** Customers will get more consistent results when scanning is resumed. - *Availability:* Enterprise Edition - **Confluence and Jira Rate Limiting** Added rate-limit handling that properly distinguishes between Atlassian Cloud (429 with `Retry-After`) and Data Center (custom headers). This eliminates scan failures caused by rate-limit responses being treated as errors. - *Availability:* Enterprise Edition - **Azure Expired Secret Fix and Revocation Signal** Fixed expired Azure secrets being silently dropped from results. Also added explicit handling for the `AADSTS50173` error code as a revocation signal for Azure refresh tokens, providing clearer triage guidance for responders. - *Availability:* Enterprise and Open Source - **Filesystem Location Uniqueness** When the same secret appears in multiple file locations, each distinct location is now tracked and displayed separately. Previously, duplicate file paths were collapsed, hiding the true blast radius. - *Availability:* Enterprise Edition - **Azure Repos: Skip Disabled Repositories** Azure Repos scanning now skips repositories that have been disabled in Azure DevOps, avoiding unnecessary API calls and scan timeouts on inaccessible repos. - *Availability:* Enterprise Edition - **SharePoint Progress Indicator** SharePoint scanning now reports progress based on the total row count, giving operators visibility into how far along a large SharePoint scan has progressed. - *Availability:* Enterprise Edition - **Bitbucket Workspace Metadata Population** Bitbucket scan results now include the workspace name in metadata, improving finding context and enabling workspace-level filtering and grouping in the dashboard. - *Availability:* Enterprise Edition - **GitLab Username Field Removed** Removed the unused username field from web-configured GitLab integrations, simplifying the integration setup form and eliminating a source of confusion. - *Availability:* Enterprise Edition - **Mesibo Detector Verification Fix** Fixed incorrect verification logic in the Mesibo detector that could cause false positive or false negative verification results. - *Availability:* Enterprise and Open Source - **GitHub Analyzer Nil Pointer Fixes** Fixed nil pointer panics in GitHub analyzer gist and repo binding functions, and added error context propagation. This eliminates crashes when analyzing certain GitHub credential types. - *Availability:* Enterprise and Open Source - **Bitbucket Line Number Fix** Fixed incorrect line numbers reported for Bitbucket secrets. Findings now point to the correct source line, improving response time when remediating. - *Availability:* Enterprise and Open Source - **Custom Endpoint Hardening: HashiCorp Vault Auth and Artifactory** Added custom endpoint configuration support for the HashiCorp Vault Auth detector and test coverage for custom endpoint behavior in Artifactory detectors. Organizations using self-hosted instances can now verify secrets against their own endpoints. - *Availability:* Open Source - **SquareUp Detector Deprecated** The SquareUp detector has been deprecated in favor of the existing Square detector. Existing findings are unaffected but new scans will use the consolidated detector. - *Availability:* Enterprise and Open Source *** ## Improve Response Features here help teams act faster and more effectively when secrets are found, streamlining investigation, triage, and collaboration. ### What's New - **Summary Dashboard** The new Summary Dashboard is the redesigned homepage of TruffleHog Enterprise. It provides an immediate read on the state of secrets detection and remediation in your environment: how many live secrets exist right now, where they're coming from, how quickly your team is rotating them, and how the trend is moving over time. - *Availability:* Enterprise Edition - **GCP Analyze Enhancements** GCP Analyze adds two new enrichment layers to GCP key findings. IAM Insights and Recommendations bring in least-privilege guidance from GCP's Recommender API, and Guided Secret Rotation surfaces the specific context needed to safely rotate a credential.. - *Availability:* Enterprise Edition - **Saved Filters Sort Override** Saved filters can now override the default similarity-score sort order, allowing analysts to sort searched results by other criteria while still using saved filter presets. - *Availability:* Enterprise Edition - **Improve Continuously Running Scan Progress Messages** Scan progress messages are now shown for continuously running scans. - *Availability:* Enterprise Edition *** ## Ease Administration Features here simplify ongoing management of the TruffleHog platform, including security hardening, performance improvements, and UI enhancements. ### What's New - **SBOM Generation in Release Pipeline** Added Software Bill of Materials (SBOM) generation to the Enterprise release pipeline, supporting compliance and supply-chain security requirements. - *Availability:* Enterprise Edition - **User Audit Log Identity Preservation** Modified user identity in audit logs is now preserved correctly, ensuring that admin audit trails accurately reflect which user performed each action. - *Availability:* Enterprise Edition - **Jira Notifier Error Messages** Improved Jira notifier error messages to surface the specific connection configuration issue, making it faster for admins to diagnose notification delivery failures. - *Availability:* Enterprise Edition - **Notifier Name Required** The `notifier_name` field is now `NOT NULL` on webhook sinks. The legacy `PlaceholderNotifierName` has been retired, ensuring all notifiers have meaningful names for audit and debugging. - *Availability:* Enterprise Edition *** ## Security - **Editor RBAC on Analyze Gateway Write Routes** Write routes on the Analyze gateway now require editor-level permissions, closing an authorization gap where read-only users could modify analysis settings. - *Availability:* Enterprise Edition - **Vulnerable Dependency Patches** Patched vulnerable Go and Python dependencies across thog, integrations, SIS, and driftwood-server, including `pgx/v5` (security), `otel/sdk` (security), `golang-jwt/v5`, and multiple frontend/e2e dependencies. - *Availability:* Enterprise Edition *** ## Infrastructure & Reliability - **Secret Ingestion Circuit Breaker (M3 Shedding Gate)** The volume-based circuit breaker for secret ingestion now includes a shedding gate in FoundSecret (M3), gated by the `CircuitBreakerEnabled` feature flag. This enables automatic load shedding when ingestion volume exceeds safe thresholds. - *Availability:* Enterprise Edition - **Large GitHub Event Handling** Oversized GitHub webhook events are now dropped instead of causing processing failures, preventing a single large event from blocking the ingestion pipeline. - *Availability:* Enterprise Edition - **Helm: trufflehog-0.4.0 with Update Strategy and Chart Release Automation** The Helm chart now includes an `updateStrategy` configuration and automated chart release workflows, simplifying upgrades for Kubernetes-based deployments. - *Availability:* Enterprise Edition