2026 November
2 min
Find More Secrets
Expand discovery across more areas of the environment and add detection for additional secret types, ensuring no secrets slip through the cracks.
Whats new
- Slack Continuous Scans Inside Archives Files shared in Slack are now unpacked before scanning, so a secret inside a zip, tar, or gzip attachment is found. Before, Slack Continuous scanned the raw file and missed anything inside an archive.
- Availability: Enterprise Edition
- Confluence Scans Resume Where They Left Off An interrupted Confluence scan now resumes each space from its last checkpoint instead of rescanning from the newest page.
- Availability: Enterprise Edition
- Coinbase Analysis Keeps Partial Results Coinbase key analysis no longer fails outright when one listing fails. It keeps what it found and names the endpoint that failed.
- Availability: Enterprise Edition
- Configurable Gerrit API Timeout Gerrit sources have a new API timeout setting, so scans of slow or heavily loaded Gerrit servers no longer fail at the 20-second default.
- Availability: Enterprise Edition
- Complete GitHub Comment Scans on Large Repositories Comment scans on large repositories no longer stop early or report complete when they are not. Repositories with issues or pull requests turned off no longer log errors, and when a GitHub App lacks a permission, the scan names the missing permission.
- Availability: Enterprise and Open Source
- SonarQube Server, Fireworks AI, Lambda Cloud TruffleHog now finds SonarQube Server user, analysis, and project tokens, Fireworks AI API keys, Lambda Cloud API keys and checks whether they are live. The SonarQube Server detector reads the server address from nearby sonar.host.url settings, and the Infisical detector checks both US and EU cloud regions.
- Availability: Enterprise and Open Source
- xAI Analyzer Analyze now supports xAI keys, showing what a leaked key can access.
- Availability: Enterprise and Open Source
- Archives That Used to Fail Are Now Scanned Some valid 7z and rar archives crashed the archive handler and went unscanned. They are now scanned. A 7z entry that cannot be opened is skipped with a warning, and the rest of the archive is still scanned.
- Availability: Enterprise and Open Source
- Fewer False Positives in Verification Box OAuth and Anypoint OAuth2 credentials are no longer reported as live when the service never confirmed them. Azure service principal secrets are verified against the nearest client and tenant IDs first. SQL Server verification uses the driver's default port.
- Availability: Enterprise and Open Source
- Git Diff Scans at Shallow Clone Boundaries Diff scans of shallow clones now handle the oldest commit in the clone correctly.
- Availability: Enterprise and Open Source
- Composio, Infisical, Serval Detectors TruffleHog now finds Composio API keys, Infisical service tokens, and Serval API keys (public API, work and managed worker) and checks whether they are live.
- Availability: Open Source
Ease Administration
Features here simplify ongoing management of the TruffleHog platform, including security hardening, performance improvements, and UI enhancements.
- Integrations Are Now Connections The Integrations area is renamed Connections, and scanners have their own tab in it. Old /integrations links redirect, and saved column preferences carry over. Sources and notifiers are shown as sortable tables with a compact filter row.
- Availability: Enterprise Edition
- Finish Time and Configurable Columns in Scan Details Scan Details shows when each scan finished and can be sorted by finish time. You can choose which columns appear.
- Availability: Enterprise Edition
- Secrets Page Improvements Whole rows on the Secrets table are clickable. The Filters menu and saved-filter dialogs are simpler. Search help now sits in the search box. The reverification badge shows queued and running separately. Rows dim while results refresh instead of flashing.
- Availability: Enterprise Edition
- Refreshed Navigation and Branding The navigation menu, logo, and wordmark are updated, and labels across the app use sentence case.
- Availability: Enterprise Edition
- Accessibility Improvements Contrast issues found in an audit are fixed, and a high-contrast mode is available. Sortable column headers work from the keyboard, keep focus after sorting, and announce their sort state. Buttons have accessible labels.
- Availability: Enterprise Edition
- Clearer Source Configuration Source errors now appear on the configuration options page, and optional fields are labeled. Sources scheduled from a scanner's local config file show that instead of an estimated next scan.
- Availability: Enterprise Edition
- Clear Error for Sources Missing From a Scanner Config When a self-hosted scanner receives a job for a source that is not in its config file, the scan now reports that clearly.
- Availability: Enterprise Edition
- Source Overview Tab Each source now opens on an Overview tab that shows what the source is, which scanner runs it, and its current and next scan at a glance. The cards refresh as soon as you save a configuration change.
- Availability: Enterprise Edition
- Secrets CSV Export Runs in the Background Confirm an export and keep working. The file is prepared in the background, survives navigation and sign-out, and a notification offers it when it is ready. The export contains only the rows your filters select. The same export is available through the API and documented in the API reference.
- Availability: Enterprise Edition
Security
- Compromised Certificate Authorities Distrusted The scanner, API, and gateway no longer accept certificate chains through the compromised eMudhra intermediate CAs (CVE-2026-111943).
- Availability: Enterprise Edition
- Dependency Security Updates Dependencies were updated to clear published advisories, including brotli (CVE-2026-111497), x/net, go-jose, chi, cryptography, Django, and several frontend packages. Go moved to 1.27.3.
- Availability: Enterprise and Open Source