Running the scanner

5 min

If you’ve provided the configuration as a file, run the scanner with filepath provided.

./scanner scan --config=path/to/config.yaml
🐷🔑🐷 TruffleHog. Unearth your secrets. 🐷🔑🐷

Resource requirements

The TruffleHog scanner supports concurrency. By default, it uses a concurrency value that is equal to the number of CPU cores that you have. The detection engine will fully utilize this concurrency, but only some source integrations support concurrency. Some source integrations that fetch data via APIs, such as Slack, Jira, and Confluence may have their throughput limited on the API server side and may not saturate your CPU.

Minimum recommended requirements

CPU: 4 cores or more

Memory: 16GB or more

Storage: 10GB or more in the system’s temporary directory

See Resource requirements for more details.

CLI flags

--debug, -v: Enables debug mode, increasing verbosity of logs for detailed output useful in debugging. Activates a pprof server for application profiling during execution.

--json: Formats the output as JSON.

--run-once: Executes the scan only once, making the program exit after a single scan instead of running and scanning periodically. WARNING: Using this flag will prevent notifications being sent from local scanners.

--fail-verified: Returns a non-zero exit code when verified secrets are found.

--archive-max-size: Sets a limit on the size of archives to scan, taking a value representing the maximum size in bytes.

--archive-max-depth: Limits how deeply nested archives are inspected. Accepts a value representing the maximum depth to scan.

--archive-timeout: Sets a limit on the time to spend extracting an archive. Accepts a duration value (e.g., “5m” for 5 minutes).

--use-system-certs: use custom CA certificates. Additionally, you can set an environment variable with SSL_CERT_FILE to point to a specific CA bundle.

Note: Obtain a full list of commands and flags by running the “–help” command.

./scanner --help

If you’ve uploaded the configuration to a secrets management solution (recommended), run the scanner with the secret provided as a

./scanner scan --config="gsm://my-gcp-project/secret-name"

See Credential management for more information on loading configuration from your secret manager.

Hosted Scanner Concurrency

The TruffleHog Hosted scanner has a concurrency limit of 4 active hosted scanners at a given time. If more than 4 hosted scanners are initiated, the 5th scanner and beyond will wait for space to be available. This is for all hosted scanners across your organization.

Overlapping Scan Durations

If a currently running scan for a source does not complete before the next configured Duration between scans (Web app) or scanPeriod (Config file), the currently running scan will continue and no new scan will start.