Patience Mpofu
e12da3c72f
* docs: add generic config-secret custom detector example
Custom Detectors already support omitting the `verify` webhook, in
which case matches are simply reported as unverified. This makes them
usable for flagging generic hardcoded secrets (e.g. *.password=,
*.secret=) in config files like .properties, .env, and .yaml, which
the built-in verified detectors intentionally don't cover.
Adds examples/generic_config_secrets.yml, tuned for that use case
(looser than generic_with_filters.yml, which requires a digit and a
special char), with entropy filtering and exclude rules for common
placeholders (changeme, ${VAR}, {{ .template }}, etc.) to keep false
positives down. Also links to it from README.md and
CUSTOM_DETECTORS.md next to the existing `verify`-optional docs.
Addresses #4957.
* fix: scope placeholder excludes to captured value, not full match
exclude_regexes_match runs against the entire key=value match, so the
env/vault/kms exclude rules were dropping real hardcoded secrets
whenever the key path happened to contain a word like "env" (e.g.
env.password=..., app.env.secret=...) -- common in config files this
example targets. Switch to exclude_regexes_capture so these rules only
look at the value being reported.
Flagged by Cursor Bugbot on PR #5195.
Examples
This folder contains various examples like custom detectors, scripts, etc. Feel free to contribute!
Generic Detector
An often requested feature for TruffleHog is a generic detector. By default, we do not support generic detection as it would result in lots of false positives. However, if you want to attempt detect generic secrets you can use a custom detector.
Try it out:
wget https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/examples/generic.yml
trufflehog filesystem --config=$PWD/generic.yml $PWD
# to filter so that _only_ generic credentials are logged:
trufflehog filesystem --config=$PWD/generic.yml --json --no-verification $PWD | awk '/generic-api-key/{print $0}'