2026 September

find more secrets expand discovery across more areas of the environment and add detection for additional secret types, ensuring no secrets slip through the cracks what's new s3 compatible storage scanning s3 sources can now point at a custom endpoint with its own signing region, so object storage that speaks the s3 api but is not hosted at amazon can be scanned as a first class source configure the endpoint and region alongside the existing authentication settings when setting up or editing an s3 integration availability enterprise and open source humio and crowdstrike falcon logscale token detection trufflehog now detects humio and crowdstrike falcon logscale api tokens, both the personal and repository scoped forms, which grant read and write access to log data availability enterprise and open source nine new open source detectors figma personal access tokens (v3 format), microsoft teams webhooks (v2 format), solarwinds observability keys, weights & biases keys (v2 format), and five new relic credential types — license key, browser key, user key, insights query key, and mobile app token availability open source sarif output for github code scanning a new sarif flag emits a sarif 2 1 0 log, letting scan results be uploaded to github code scanning verified findings map to errors and unverified findings to warnings, each with a stable fingerprint so github can track findings as new or fixed across scans availability open source improvements and fixes bitbucket atlassian api token support bitbucket sources now accept an atlassian api token paired with the account email as an explicit credential type, separate from the username used for git clones customers who had been putting an email address into the username field to make api tokens work can now configure both identities correctly availability enterprise edition missing slack file permissions are reported a slack token that was never granted the files\ read scope silently failed every file listing it attempted, so file coverage was dropped without explanation the missing scope is now reported instead of being swallowed alongside transient api failures availability enterprise edition github token types are distinguished the github detector matched all six token prefixes but reported every one as a personal access token findings now carry the actual credential type, so an oauth token, app token, or refresh token is identified as such during triage availability enterprise and open source github enterprise cloud with data residency github app authentication against a ghe com data residency host now inherits the enterprise base url correctly, so those instances can be scanned availability enterprise and open source neon postgres credential verification postgres credentials pointing at neon endpoints are now verified with a driver that accepts neon's scram iteration count, so those secrets resolve to a definite live or not live result availability enterprise and open source harness token detection harness personal access tokens containing underscores in the account segment were missed by the detector pattern and are now found availability enterprise and open source fewer false positives in docker and blogger findings the docker detector no longer matches unintended data past the end of a credentials block, and multiple credential blocks on one line are all reported instead of only the first the blogger detector now requires the google api key prefix rather than matching any hex string of the right length availability enterprise and open source more reliable verification results pagerduty findings now reflect all documented api response codes, anthropic verification failures surface the api's error detail, hugging face tokens with unscoped model owners no longer produce invalid results, mongodb verification timeouts were doubled to stop live credentials failing to verify, slack webhook invalid token responses are treated as a definite not live result, and jira token reverification no longer loops on a 202 response availability enterprise and open source retired detectors removed the appoptics and bing subscription key detectors have been deprecated availability enterprise and open source lob false positives reduced the lob detector pattern now excludes underscores and requires lowercase hex, and forbidden responses are distinguished by their api error code availability open source improve response features here help teams act faster and more effectively when secrets are found, streamlining investigation, triage, and collaboration what's new secret locations in csv export secret locations are now included at the end of the csv export, so an exported finding carries where it was found without a second lookup availability enterprise edition improvements and fixes accurate notifier health the external api reported every notifier's health status as error regardless of its actual state it now reports the real status, so notifier health can be monitored programmatically availability enterprise edition clearer finding dates each date shown on a finding now says what it means, removing the ambiguity between when a secret was first seen, last seen, and last verified availability enterprise edition cross account aws analysis permission check aws credential analysis checked for the sts\ assumerole permission on the assumed role rather than the base role, so valid cross account configurations were rejected availability enterprise edition analyze filtering matches detector types the analyze filter matched on the analyzer name instead of the detector type, so filtering could omit results it should have returned availability enterprise edition expired shared secret links opening an expired shared secret link showed "undefined" instead of an explanation it now states that the link has expired availability enterprise edition hosted splunk notifications splunk notifications configured as a hosted sink now resolve on both scanner delivery paths previously only one path recognized splunk, so notifications could be built and then silently fail to deliver availability enterprise edition ease administration features here simplify ongoing management of the trufflehog platform, including security hardening, performance improvements, and ui enhancements what's new scan details some integration now have a scans tab showing its retained scan history when each run started, how long it actively ran, how many resources it reached, and the change in live secrets it produced runs are listed newest first with filtering by status and start time, so a source's scanning record can be reviewed without reconstructing it from the dashboard availability enterprise edition scan details read api scan run history is available through a read api covering the global run list, per source run lists, and individual run detail, with documented filters, cursor pagination, and stable error codes scan history can be pulled into external reporting instead of being read by hand the api accepts administrator or editor api keys availability enterprise edition archived integrations in the activity log archiving an integration now writes an event to the activity log, and integration archived is available in the event type filter activity logging stops once a source is archived, so an archived source's history ends where the archive did availability enterprise edition improvements and fixes faster confluence scans confluence page queries now report up front whether a page has attachments or comments, and those fetches are skipped when there are none, removing two api round trips per page from most scans availability enterprise edition confluence attachment size limit confluence attachments are now capped at 25 mb for download, matching the limits already enforced on sharepoint, s3, and git a single very large attachment could previously stall a scan, exhaust memory, or time out availability enterprise edition confluence reliability on self hosted instances session cookies are now preserved across confluence api requests, fixing authentication failures on self hosted instances, and user email addresses are populated on findings instead of showing as unknown availability enterprise edition filter chips can be removed removing a filter chip belonging to a combined option family immediately re added it, so the removal appeared to do nothing availability enterprise edition infrastructure & reliability git clone retries on secondary rate limits a bare 403 at clone time was classified as a permanent permission error and failed the scan immediately, even though github and gitlab both return 403 or 429 for secondary rate limiting those responses are now retried with backoff availability enterprise and open source scanner crash on concurrent scans fixed scanners could panic with a send on a closed channel when a source's progress hooks were closed while metrics were still in flight availability enterprise and open source