Self-discovery analyzers
Before TruffleHog Analyze, identifying a key's access often meant manually digging through a SaaS provider's settings page. With TruffleHog Analyze, we use the API to automatically discover a key's metadata, resources, and permissions.
We use self-discovery techniques so that the discovery portion is stateless and minimizes potential impacts. These include the following:
- Inferring scope from headers and API endpoints
- Testing permissions via stateless API calls
- Sending malformed requests to stateful endpoints to observe permission errors
If you have TruffleHog Analyze enabled, your scans (both cloud and on-premises) will automatically analyze live secrets on first discovery. There is no additional setup.
To get started, contact your account executive for more information.
We've open-sourced some of our most popular secret types! The analyzers can be found in our open-source project.
In open-source, if you run trufflehog analyze a terminal user interface (TUI) appears. Paste in your live secret and TruffleHog will begin analyzing the secret scope.
There is an optional Log file parameter where you can specify a file that then enumerates all the API calls the analyzer runs.
