Posted inGit

Git Secret Scanning: How to Use TruffleHog to Find API Key Leaks in Commit History

Git tutorial - IT technology blog
Git tutorial - IT technology blog

When API Keys “Go Rogue” on GitHub: A Story We All Know

I once witnessed a colleague break into a cold sweat when he received an email from AWS reporting a bill that spiked to $5,000 overnight. The culprit? A config.json file containing an Access Key that was accidentally pushed to a public repo at 2 AM. Although he quickly deleted the key and pushed a new commit immediately after, it was already too late.

The most common mistake is believing that simply deleting the line of code containing the password and making a new commit is safe. In reality, Git stores the entire change history as snapshots. With just a git checkout command to an old commit, anyone can retrieve that sensitive information. For hacker bots using automated scanners, finding secrets in commit history usually takes less than 60 seconds from the moment you hit push.

Why Manual Methods Often Fail

Many teams still maintain rather rudimentary security check habits. Here are the limitations you will encounter:

  • Using the grep command: This method only searches the current commit (HEAD). It completely misses data in hundreds of old commits or deleted branches.
  • Manual Code Review: Humans easily get eye strain looking at config files thousands of lines long. Just one seemingly harmless Base64 string slipping through, and your system is already in the crosshairs.
  • Custom Scripts: Most simple scripts only search by patterns (Regex). They often return dozens of false positives, wasting your time filtering through noise.

TruffleHog: The Professional Secret Hunter

TruffleHog is more than just a string search tool. It is designed to scour every corner: from branches and tags to the entire commit history. TruffleHog’s best selling point is its ability to recognize over 700 different detector types (AWS, Slack, Stripe, Google Cloud…) and verify whether those keys are still active.

1. Quick TruffleHog Installation on Linux

Instead of complex configurations, you can install the binary directly onto your system using the following command:

curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin

Check again to make sure everything is ready:

trufflehog --version

2. Scanning a Local Repository and Verifying Secrets

To scan the project you are developing, move into the repo directory and run:

trufflehog git file://. --only-verified

Important Note: The --only-verified flag is an extremely valuable feature. TruffleHog will attempt to send an anonymous request to the provider’s API to confirm if the key is still valid. If it reports “Verified,” it means you are holding a real time bomb in your hands.

3. Scanning Directly from GitHub/GitLab

You don’t need to spend time cloning code to your machine. TruffleHog supports remote scanning via URL:

trufflehog git https://github.com/user/project.git

For private repos, you just need to set up SSH keys or pass a Token into the URL for the tool to have access.

4. Incident Response Workflow When a Leak is Detected

If you happen to find an active secret, don’t panic. Follow these 3 “first aid” steps:

  1. Revoke Immediately: Access the service dashboard (like AWS Console) and delete the exposed key. This is the number one priority.
  2. Purge Git History: Use a tool like git-filter-repo to permanently delete the file or string from all commits. A simple git rm command is not enough.
  3. Issue New Keys: Create a new set of credentials and update them in Environment Variables; never hardcode them into config files again.

Prevention is Better Than Cure with Git Hooks

The best way to avoid cleaning up a mess is to stop it at the gateway. You should integrate TruffleHog into your project’s pre-commit hook.

Set up a simple .pre-commit-config.yaml file as follows:

repos:
-   repo: https://github.com/trufflesecurity/trufflehog
    rev: main
    hooks:
    -   id: trufflehog
        name: TruffleHog
        entry: trufflehog git file://. --only-verified --fail
        language: system
        stages: [commit]

From now on, every time you type git commit, the system will automatically check. If a sensitive key is detected, the commit command will be rejected immediately.

Conclusion

Security is not a destination, but a continuous process. A free tool like TruffleHog can save your team from massive financial and reputational risks. Take 5 minutes to rescan your important repos today. Who knows, you might discover some dangerous “legacies” left behind by your predecessors.

Share:
Tags: