Shared Secrets

overview share secrets turns a detected finding into a secure, access controlled link you can send to the person who needs to rotate or investigate it the recipient opens the link, authenticates with your organization's identity provider, and sees the finding's details and where it was found without needing to login to trufflehog enterprise every link is scoped to a single secret, requires a login from a domain you control, and expires automatically how it works you generate a share link from a secret's detail page in trufflehog by clicking share in the upper right corner when you create the link you choose an expiration window, and trufflehog enterprise returns a url you can send to the recipient when someone opens the link, they must sign in through your configured identity provider (google sso or saml sso) trufflehog enterprise checks the email address on their account against your list of trusted domains if the domain matches and the link hasn't expired, they land on a read only page showing the finding which includes secret type and locator, verification status, when it was first detected and last seen, the expiration time of the shared secret, location details (such as the granting account, arn, resource type, and user id), and each location where it was found the page also links to rotation guidance for the secret type if the domain doesn't match, they're denied access even though they have the url you manage everything from the shared secrets page, which has two tabs active shared secrets lists every unexpired link, and sharing settings holds your trusted domains and default authentication method you can revoke every active link at once from there prerequisites requirement detail identity provider google sso, or saml sso configured under authentication saml must have completed at least one login before it can be selected as the default trusted domains at least one domain configured under settings > shared secrets > edit trusted domains you cannot share a secret until trusted domains are set role admin or editor viewer role users cannot create or revoke shares or edit sharing settings configuration options field type required description trusted domains comma separated list yes email domains you control (for example your org com) only recipients whose idp account uses one of these domains can open a link sharing authentication google oauth | saml sso yes the default identity provider recipients use to authenticate when a link is generated saml sso is only selectable once it's set up expiration window on read | 1 hour | 1 day | 7 days | 1 month yes how long the link stays valid chosen per link at creation time notes on read links expire after the first successful read, not after a fixed time a short grace window (a few seconds) is allowed after the first open so the finding's locations can finish loading a share link never reveals the raw plaintext credential the recipient sees the redacted locator and analyzer results, not the secret value itself troubleshooting error cause solution you aren't authorized to view this shared secret (403) the recipient is signed in with an account whose email domain isn't on your trusted domains add the recipient's domain under edit trusted domains , or have them log out and sign in with a trusted domain account this secret share expired (410) the link passed its expiration window, or an on read link was already read generate a new link with a longer expiration window secret share not found (404) the link was revoked or never existed generate a new link