Update trufflesecurity/trufflehog action to v3.97.2 by renovate[bot] · Pull Request #22 · steadforce/steadops-workflows

renovate · 2026-06-02T07:57:56Z

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	`v3.95.3` → `v3.97.2`

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

`v3.97.2`

Compare Source

What's Changed

detectors/github/v2: differentiate token type in ExtraData by @hartsock in #5223
Update dependency trufflesecurity/.github to v1.0.4 by @renovate[bot] in #5228
ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @bryanbeverly in #5231
Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @renovate[bot] in #5172
Update github-actions by @renovate[bot] in #5197
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5173
Update module github.com/aws/smithy-go to v1.27.9 by @renovate[bot] in #5174
[SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @dipto-truffle in #5234
[INS-377] Add V2 for weights and biases detector by @mustansir14 in #4951
Fix PagerDuty detector: treat 403 and 402 as verified credentials by @unsmith in #5230
[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @camgunz in #5248
Implement Enumerate for the Jenkins source by @Ahsan-Sarbaz in #5229
Update link to Truffle Security documentation by @shahzadhaider1 in #5256
Retry git clone on secondary rate limit (bare 403/429) by @kashifkhan0771 in #5260

New Contributors

@hartsock made their first contribution in #5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

`v3.97.1`

Compare Source

What's Changed

Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @renovate[bot] in #5196
Fix GHEC with Data Residency (*.ghe.com) base URL by @shahzadhaider1 in #4777
docs: add generic config-secret custom detector example by @pgmpofu in #5195
fix(detectors/docker): don't greedy match in keyPat by @mariduv in #5214
[SCAN-1020] neon scram pgx by @alafiand in #5217
Raised MongoDB detector timeout value by @jordanTunstill in #5222
preallocate bindings capacity in dockerhub and groq, with unit tests by @jordanTunstill in #5213
[SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @amanfcp in #5224
Refine SECURITY.md by @bradlarsen in #5216
Carry GitHub App installation ID on repo units by @bill-rich in #5215

New Contributors

@pgmpofu made their first contribution in #5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

`v3.97.0`

Compare Source

What's Changed

fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @genisis0x in #5127
Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @renovate[bot] in #5058
Remove url tag from common HTTP client metrics by @mcastorina in #5158
Update github.com/avast/apkparser digest to 7fcaee4 by @renovate[bot] in #5037
[INS-318] Add New Relic License Key Detector by @mustansir14 in #4760
[INS-348] Add New Relic Browser Key detector by @mustansir14 in #4769
[INS-339] Add New Relic User Key detector by @mustansir14 in #4794
[INS-345] Add New Relic Insights Query Key detector by @mustansir14 in #4781
fix(sources): stop UnitHook Close racing in-flight Finish sends by @bill-rich in #5154
There are now 3 CircleCI projects by @trufflesteeeve in #5166
Update github.com/shurcooL/githubv4 digest to 2402fdf by @renovate[bot] in #5038
Update github-actions by @renovate[bot] in #5036
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #4890
[INS-344] Add New Relic Mobile App Token Detector by @mustansir14 in #4810
Give each clone its own directory under --clone-path by @shahzadhaider1 in #5175
feat(output): add SARIF output format for GitHub code scanning by @kashifkhan0771 in #5165
[SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @alafiand in #5177
make cwd-changing normalization tests non-parallel to fix flaky clone failures by @jordanTunstill in #5178
[INS-456] Add Microsoft Teams Webhook V2 detector by @mustansir14 in #4902
surface git clone errors at v(0) by @jordanTunstill in #5162
Add Figma Personal Access Token v3 Detector by @shahzadhaider1 in #4790
fix(github): fallback resource Name to avoid empty-string proto validation failure by @kashifkhan0771 in #5182
[INT-643] Update Protos definition to cater bitbucket Api token authentication by @MuneebUllahKhan222 in #5171
Update regex pattern and 403 handling in the Lob detector to fix false positives by @MachiavelliII in #5188
Deprecate AppOptics detector by @Ahsan-Sarbaz in #5198
Anthropic detector: surface API error detail on non-2xx verification by @Ahsan-Sarbaz in #5180
Deprecated bingsubscriptionkey detector by @Ahsan-Sarbaz in #5179
Add SolarWinds Observability detector by @Ahsan-Sarbaz in #5199
fix(jiratoken): stop 202 reverification retry loop by @Ahsan-Sarbaz in #5200
Add custom endpoint support to the S3 source by @shahzadhaider1 in #5202
fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @unsmith in #5203
fix(huggingface): move unscoped fine-grained models to UnboundedResources by @unsmith in #5204
Add AWS Secrets Manager metadata type by @rosecodym in #5210
fix(detectors/harness): allow underscore in PAT account segment by @mattbrady-1 in #5153

New Contributors

@MachiavelliII made their first contribution in #5188
@Ahsan-Sarbaz made their first contribution in #5198
@unsmith made their first contribution in #5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

`v3.96.0`

Compare Source

What's Changed

[INS-355] Added Hashicorp vault token detector by @MuneebUllahKhan222 in #4819
Tighten JiraToken v1 verification by @shahzadhaider1 in #5122
[INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @bill-rich in #5123
Fix GitLab project metadata cache and switch to LRU by @kashifkhan0771 in #4727
Log analyze errors for Anthropic Analyzer by @kashifkhan0771 in #5120
Add metrics for chunks and results by @mcastorina in #5128
Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @kashifkhan0771 in #5111
[INS-312] Duo API Secret Key Detector by @MuneebUllahKhan222 in #4771
[Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @nabeelalam in #4739
[INS-255] Updated datadog detector to set verificationError in case of a verification error by @MuneebUllahKhan222 in #4661
Log analyze errors for Postgres analyzer by @kashifkhan0771 in #5131
Log analyze errors for HuggingFace analyzer by @kashifkhan0771 in #5130
Engine - Config.SourceManager doc by @amanfcp in #5002
Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @renovate[bot] in #5034
Retry git clone on transient network errors by @shahzadhaider1 in #5132
Fix scan_all_installations Rejecting Org Member Personal Repos by @shahzadhaider1 in #5142
updated detector to include underscore char by @mattbrady-1 in #5121
[chore] Change job_id in metric to source_type by @mcastorina in #5149
Posthog regex update by @mattbrady-1 in #5133
fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @johannestaas-trufflesec in #5151

New Contributors

@mattbrady-1 made their first contribution in #5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

`v3.95.9`

Compare Source

What's Changed

feat: add OpenRouter detector by @McPatate in #4500
Integrations fully codeowns detectors by @trufflesteeeve in #5104
[INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
[INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
[INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
[INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
[INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
feat: Support archived repo exclusion from GH org scans by @hibare in #4875
[INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
[INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
[INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

@McPatate made their first contribution in #4500
@eightseventhreethree made their first contribution in #4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

`v3.95.8`

Compare Source

What's Changed

removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in #5068
fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in #5043
Add prometheus metrics for engine channels and workers by @mcastorina in #5095
[INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in #5072
[INS-334] Octopus Deploy detector by @MuneebUllahKhan222 in #4787
Fix Syntax error in feature.go by @MuneebUllahKhan222 in #5109
Include encoded resume info instead of clobbering it by @bill-rich in #5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

`v3.95.7`

Compare Source

What's Changed

fix(sources/filesystem): order resume comparison by path component by @genisis0x in #5041
test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in #5053
fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in #5029
Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-decker in #4774
fix: add git worktree support in PrepareRepo by @andoniaf in #4690
[INS-406] Braintrust detector by @MuneebUllahKhan222 in #4826
huggingface: add bucket scanning by @julien-c in #5017
Skip reverification results during deduplication by @mcastorina in #5069
chore(renovate): bump shared config to v1.0.3 by @bryanbeverly in #5044
Add scan_all_installations option for multi-org GitHub App scanning by @dustin-decker in #4775
Expose SecretParts in the JSON output by @bradlarsen in #5073
[INS-497] Add Pganalyze Read Key Detector by @MuneebUllahKhan222 in #4993
[INS-197] Add redhatpyxis api key detector by @MuneebUllahKhan222 in #4995
[INS-407] Fixed AWS detector producing non deterministic output by @MuneebUllahKhan222 in #4836

New Contributors

@genisis0x made their first contribution in #5041
@andoniaf made their first contribution in #4690
@julien-c made their first contribution in #5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

`v3.95.6`

Compare Source

What's Changed

Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011
fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022
fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968
Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987
fix: avoid terminal probes before CLI output by @Hackerchen716 in #4994
Update test containers dependency by @trufflesteeeve in #4978
Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in #5023
[INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in #4969
[INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in #5006
[INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in #5008
Updating Klaviyo PK new format by @breetan in #5009
Restructure Klaviyo detector pattern tests by @martinlocklear in #5026
Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in #4992
set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in #5027
GitHub finegrained analyzer was improperly handling errors by @dustin-decker in #4498
[INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in #5005
Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in #4999
[INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in #5007
Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in #5028
fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in #5012
fix: add filetype=sdist param to pypi detector by @lukem-ts in #4988
Handlers - Embed small HTTP test fixtures by @amanfcp in #5001
S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in #5035

New Contributors

@Dawn-Fighter made their first contribution in #4968
@Hackerchen716 made their first contribution in #4994
@breetan made their first contribution in #5009
@lukem-ts made their first contribution in #5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

`v3.95.5`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

`v3.95.4`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-06-02T07:57:56Z

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	`v3.95.3` → `v3.97.2`

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

`v3.97.2`

Compare Source

What's Changed

detectors/github/v2: differentiate token type in ExtraData by @hartsock in #5223
Update dependency trufflesecurity/.github to v1.0.4 by @renovate[bot] in #5228
ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @bryanbeverly in #5231
Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @renovate[bot] in #5172
Update github-actions by @renovate[bot] in #5197
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5173
Update module github.com/aws/smithy-go to v1.27.9 by @renovate[bot] in #5174
[SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @dipto-truffle in #5234
[INS-377] Add V2 for weights and biases detector by @mustansir14 in #4951
Fix PagerDuty detector: treat 403 and 402 as verified credentials by @unsmith in #5230
[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @camgunz in #5248
Implement Enumerate for the Jenkins source by @Ahsan-Sarbaz in #5229
Update link to Truffle Security documentation by @shahzadhaider1 in #5256
Retry git clone on secondary rate limit (bare 403/429) by @kashifkhan0771 in #5260

New Contributors

@hartsock made their first contribution in #5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

`v3.97.1`

Compare Source

What's Changed

Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @renovate[bot] in #5196
Fix GHEC with Data Residency (*.ghe.com) base URL by @shahzadhaider1 in #4777
docs: add generic config-secret custom detector example by @pgmpofu in #5195
fix(detectors/docker): don't greedy match in keyPat by @mariduv in #5214
[SCAN-1020] neon scram pgx by @alafiand in #5217
Raised MongoDB detector timeout value by @jordanTunstill in #5222
preallocate bindings capacity in dockerhub and groq, with unit tests by @jordanTunstill in #5213
[SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @amanfcp in #5224
Refine SECURITY.md by @bradlarsen in #5216
Carry GitHub App installation ID on repo units by @bill-rich in #5215

New Contributors

@pgmpofu made their first contribution in #5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

`v3.97.0`

Compare Source

What's Changed

fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @genisis0x in #5127
Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @renovate[bot] in #5058
Remove url tag from common HTTP client metrics by @mcastorina in #5158
Update github.com/avast/apkparser digest to 7fcaee4 by @renovate[bot] in #5037
[INS-318] Add New Relic License Key Detector by @mustansir14 in #4760
[INS-348] Add New Relic Browser Key detector by @mustansir14 in #4769
[INS-339] Add New Relic User Key detector by @mustansir14 in #4794
[INS-345] Add New Relic Insights Query Key detector by @mustansir14 in #4781
fix(sources): stop UnitHook Close racing in-flight Finish sends by @bill-rich in #5154
There are now 3 CircleCI projects by @trufflesteeeve in #5166
Update github.com/shurcooL/githubv4 digest to 2402fdf by @renovate[bot] in #5038
Update github-actions by @renovate[bot] in #5036
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #4890
[INS-344] Add New Relic Mobile App Token Detector by @mustansir14 in #4810
Give each clone its own directory under --clone-path by @shahzadhaider1 in #5175
feat(output): add SARIF output format for GitHub code scanning by @kashifkhan0771 in #5165
[SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @alafiand in #5177
make cwd-changing normalization tests non-parallel to fix flaky clone failures by @jordanTunstill in #5178
[INS-456] Add Microsoft Teams Webhook V2 detector by @mustansir14 in #4902
surface git clone errors at v(0) by @jordanTunstill in #5162
Add Figma Personal Access Token v3 Detector by @shahzadhaider1 in #4790
fix(github): fallback resource Name to avoid empty-string proto validation failure by @kashifkhan0771 in #5182
[INT-643] Update Protos definition to cater bitbucket Api token authentication by @MuneebUllahKhan222 in #5171
Update regex pattern and 403 handling in the Lob detector to fix false positives by @MachiavelliII in #5188
Deprecate AppOptics detector by @Ahsan-Sarbaz in #5198
Anthropic detector: surface API error detail on non-2xx verification by @Ahsan-Sarbaz in #5180
Deprecated bingsubscriptionkey detector by @Ahsan-Sarbaz in #5179
Add SolarWinds Observability detector by @Ahsan-Sarbaz in #5199
fix(jiratoken): stop 202 reverification retry loop by @Ahsan-Sarbaz in #5200
Add custom endpoint support to the S3 source by @shahzadhaider1 in #5202
fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @unsmith in #5203
fix(huggingface): move unscoped fine-grained models to UnboundedResources by @unsmith in #5204
Add AWS Secrets Manager metadata type by @rosecodym in #5210
fix(detectors/harness): allow underscore in PAT account segment by @mattbrady-1 in #5153

New Contributors

@MachiavelliII made their first contribution in #5188
@Ahsan-Sarbaz made their first contribution in #5198
@unsmith made their first contribution in #5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

`v3.96.0`

Compare Source

What's Changed

[INS-355] Added Hashicorp vault token detector by @MuneebUllahKhan222 in #4819
Tighten JiraToken v1 verification by @shahzadhaider1 in #5122
[INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @bill-rich in #5123
Fix GitLab project metadata cache and switch to LRU by @kashifkhan0771 in #4727
Log analyze errors for Anthropic Analyzer by @kashifkhan0771 in #5120
Add metrics for chunks and results by @mcastorina in #5128
Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @kashifkhan0771 in #5111
[INS-312] Duo API Secret Key Detector by @MuneebUllahKhan222 in #4771
[Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @nabeelalam in #4739
[INS-255] Updated datadog detector to set verificationError in case of a verification error by @MuneebUllahKhan222 in #4661
Log analyze errors for Postgres analyzer by @kashifkhan0771 in #5131
Log analyze errors for HuggingFace analyzer by @kashifkhan0771 in #5130
Engine - Config.SourceManager doc by @amanfcp in #5002
Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @renovate[bot] in #5034
Retry git clone on transient network errors by @shahzadhaider1 in #5132
Fix scan_all_installations Rejecting Org Member Personal Repos by @shahzadhaider1 in #5142
updated detector to include underscore char by @mattbrady-1 in #5121
[chore] Change job_id in metric to source_type by @mcastorina in #5149
Posthog regex update by @mattbrady-1 in #5133
fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @johannestaas-trufflesec in #5151

New Contributors

@mattbrady-1 made their first contribution in #5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

`v3.95.9`

Compare Source

What's Changed

feat: add OpenRouter detector by @McPatate in #4500
Integrations fully codeowns detectors by @trufflesteeeve in #5104
[INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
[INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
[INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
[INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
[INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
feat: Support archived repo exclusion from GH org scans by @hibare in #4875
[INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
[INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
[INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

@McPatate made their first contribution in #4500
@eightseventhreethree made their first contribution in #4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

`v3.95.8`

Compare Source

What's Changed

removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in #5068
fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in #5043
Add prometheus metrics for engine channels and workers by @mcastorina in #5095
[INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in #5072
[INS-334] Octopus Deploy detector by @MuneebUllahKhan222 in #4787
Fix Syntax error in feature.go by @MuneebUllahKhan222 in #5109
Include encoded resume info instead of clobbering it by @bill-rich in #5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

`v3.95.7`

Compare Source

What's Changed

fix(sources/filesystem): order resume comparison by path component by @genisis0x in #5041
test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in #5053
fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in #5029
Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-decker in #4774
fix: add git worktree support in PrepareRepo by @andoniaf in #4690
[INS-406] Braintrust detector by @MuneebUllahKhan222 in #4826
huggingface: add bucket scanning by @julien-c in #5017
Skip reverification results during deduplication by @mcastorina in #5069
chore(renovate): bump shared config to v1.0.3 by @bryanbeverly in #5044
Add scan_all_installations option for multi-org GitHub App scanning by @dustin-decker in #4775
Expose SecretParts in the JSON output by @bradlarsen in #5073
[INS-497] Add Pganalyze Read Key Detector by @MuneebUllahKhan222 in #4993
[INS-197] Add redhatpyxis api key detector by @MuneebUllahKhan222 in #4995
[INS-407] Fixed AWS detector producing non deterministic output by @MuneebUllahKhan222 in #4836

New Contributors

@genisis0x made their first contribution in #5041
@andoniaf made their first contribution in #4690
@julien-c made their first contribution in #5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

`v3.95.6`

Compare Source

What's Changed

Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011
fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022
fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968
Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987
fix: avoid terminal probes before CLI output by @Hackerchen716 in #4994
Update test containers dependency by @trufflesteeeve in #4978
Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in #5023
[INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in #4969
[INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in #5006
[INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in #5008
Updating Klaviyo PK new format by @breetan in #5009
Restructure Klaviyo detector pattern tests by @martinlocklear in #5026
Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in #4992
set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in #5027
GitHub finegrained analyzer was improperly handling errors by @dustin-decker in #4498
[INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in #5005
Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in #4999
[INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in #5007
Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in #5028
fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in #5012
fix: add filetype=sdist param to pypi detector by @lukem-ts in #4988
Handlers - Embed small HTTP test fixtures by @amanfcp in #5001
S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in #5035

New Contributors

@Dawn-Fighter made their first contribution in #4968
@Hackerchen716 made their first contribution in #4994
@breetan made their first contribution in #5009
@lukem-ts made their first contribution in #5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

`v3.95.5`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

`v3.95.4`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-06-02T07:57:56Z

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	`v3.95.3` → `v3.97.2`

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

`v3.97.2`

Compare Source

What's Changed

detectors/github/v2: differentiate token type in ExtraData by @hartsock in #5223
Update dependency trufflesecurity/.github to v1.0.4 by @renovate[bot] in #5228
ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @bryanbeverly in #5231
Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @renovate[bot] in #5172
Update github-actions by @renovate[bot] in #5197
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5173
Update module github.com/aws/smithy-go to v1.27.9 by @renovate[bot] in #5174
[SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @dipto-truffle in #5234
[INS-377] Add V2 for weights and biases detector by @mustansir14 in #4951
Fix PagerDuty detector: treat 403 and 402 as verified credentials by @unsmith in #5230
[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @camgunz in #5248
Implement Enumerate for the Jenkins source by @Ahsan-Sarbaz in #5229
Update link to Truffle Security documentation by @shahzadhaider1 in #5256
Retry git clone on secondary rate limit (bare 403/429) by @kashifkhan0771 in #5260

New Contributors

@hartsock made their first contribution in #5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

`v3.97.1`

Compare Source

What's Changed

Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @renovate[bot] in #5196
Fix GHEC with Data Residency (*.ghe.com) base URL by @shahzadhaider1 in #4777
docs: add generic config-secret custom detector example by @pgmpofu in #5195
fix(detectors/docker): don't greedy match in keyPat by @mariduv in #5214
[SCAN-1020] neon scram pgx by @alafiand in #5217
Raised MongoDB detector timeout value by @jordanTunstill in #5222
preallocate bindings capacity in dockerhub and groq, with unit tests by @jordanTunstill in #5213
[SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @amanfcp in #5224
Refine SECURITY.md by @bradlarsen in #5216
Carry GitHub App installation ID on repo units by @bill-rich in #5215

New Contributors

@pgmpofu made their first contribution in #5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

`v3.97.0`

Compare Source

What's Changed

fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @genisis0x in #5127
Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @renovate[bot] in #5058
Remove url tag from common HTTP client metrics by @mcastorina in #5158
Update github.com/avast/apkparser digest to 7fcaee4 by @renovate[bot] in #5037
[INS-318] Add New Relic License Key Detector by @mustansir14 in #4760
[INS-348] Add New Relic Browser Key detector by @mustansir14 in #4769
[INS-339] Add New Relic User Key detector by @mustansir14 in #4794
[INS-345] Add New Relic Insights Query Key detector by @mustansir14 in #4781
fix(sources): stop UnitHook Close racing in-flight Finish sends by @bill-rich in #5154
There are now 3 CircleCI projects by @trufflesteeeve in #5166
Update github.com/shurcooL/githubv4 digest to 2402fdf by @renovate[bot] in #5038
Update github-actions by @renovate[bot] in #5036
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #4890
[INS-344] Add New Relic Mobile App Token Detector by @mustansir14 in #4810
Give each clone its own directory under --clone-path by @shahzadhaider1 in #5175
feat(output): add SARIF output format for GitHub code scanning by @kashifkhan0771 in #5165
[SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @alafiand in #5177
make cwd-changing normalization tests non-parallel to fix flaky clone failures by @jordanTunstill in #5178
[INS-456] Add Microsoft Teams Webhook V2 detector by @mustansir14 in #4902
surface git clone errors at v(0) by @jordanTunstill in #5162
Add Figma Personal Access Token v3 Detector by @shahzadhaider1 in #4790
fix(github): fallback resource Name to avoid empty-string proto validation failure by @kashifkhan0771 in #5182
[INT-643] Update Protos definition to cater bitbucket Api token authentication by @MuneebUllahKhan222 in #5171
Update regex pattern and 403 handling in the Lob detector to fix false positives by @MachiavelliII in #5188
Deprecate AppOptics detector by @Ahsan-Sarbaz in #5198
Anthropic detector: surface API error detail on non-2xx verification by @Ahsan-Sarbaz in #5180
Deprecated bingsubscriptionkey detector by @Ahsan-Sarbaz in #5179
Add SolarWinds Observability detector by @Ahsan-Sarbaz in #5199
fix(jiratoken): stop 202 reverification retry loop by @Ahsan-Sarbaz in #5200
Add custom endpoint support to the S3 source by @shahzadhaider1 in #5202
fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @unsmith in #5203
fix(huggingface): move unscoped fine-grained models to UnboundedResources by @unsmith in #5204
Add AWS Secrets Manager metadata type by @rosecodym in #5210
fix(detectors/harness): allow underscore in PAT account segment by @mattbrady-1 in #5153

New Contributors

@MachiavelliII made their first contribution in #5188
@Ahsan-Sarbaz made their first contribution in #5198
@unsmith made their first contribution in #5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

`v3.96.0`

Compare Source

What's Changed

[INS-355] Added Hashicorp vault token detector by @MuneebUllahKhan222 in #4819
Tighten JiraToken v1 verification by @shahzadhaider1 in #5122
[INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @bill-rich in #5123
Fix GitLab project metadata cache and switch to LRU by @kashifkhan0771 in #4727
Log analyze errors for Anthropic Analyzer by @kashifkhan0771 in #5120
Add metrics for chunks and results by @mcastorina in #5128
Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @kashifkhan0771 in #5111
[INS-312] Duo API Secret Key Detector by @MuneebUllahKhan222 in #4771
[Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @nabeelalam in #4739
[INS-255] Updated datadog detector to set verificationError in case of a verification error by @MuneebUllahKhan222 in #4661
Log analyze errors for Postgres analyzer by @kashifkhan0771 in #5131
Log analyze errors for HuggingFace analyzer by @kashifkhan0771 in #5130
Engine - Config.SourceManager doc by @amanfcp in #5002
Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @renovate[bot] in #5034
Retry git clone on transient network errors by @shahzadhaider1 in #5132
Fix scan_all_installations Rejecting Org Member Personal Repos by @shahzadhaider1 in #5142
updated detector to include underscore char by @mattbrady-1 in #5121
[chore] Change job_id in metric to source_type by @mcastorina in #5149
Posthog regex update by @mattbrady-1 in #5133
fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @johannestaas-trufflesec in #5151

New Contributors

@mattbrady-1 made their first contribution in #5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

`v3.95.9`

Compare Source

What's Changed

feat: add OpenRouter detector by @McPatate in #4500
Integrations fully codeowns detectors by @trufflesteeeve in #5104
[INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
[INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
[INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
[INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
[INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
feat: Support archived repo exclusion from GH org scans by @hibare in #4875
[INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
[INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
[INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

@McPatate made their first contribution in #4500
@eightseventhreethree made their first contribution in #4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

`v3.95.8`

Compare Source

What's Changed

removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in #5068
fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in #5043
Add prometheus metrics for engine channels and workers by @mcastorina in #5095
[INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in #5072
[INS-334] Octopus Deploy detector by @MuneebUllahKhan222 in #4787
Fix Syntax error in feature.go by @MuneebUllahKhan222 in #5109
Include encoded resume info instead of clobbering it by @bill-rich in #5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

`v3.95.7`

Compare Source

What's Changed

fix(sources/filesystem): order resume comparison by path component by @genisis0x in #5041
test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in #5053
fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in #5029
Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-decker in #4774
fix: add git worktree support in PrepareRepo by @andoniaf in #4690
[INS-406] Braintrust detector by @MuneebUllahKhan222 in #4826
huggingface: add bucket scanning by @julien-c in #5017
Skip reverification results during deduplication by @mcastorina in #5069
chore(renovate): bump shared config to v1.0.3 by @bryanbeverly in #5044
Add scan_all_installations option for multi-org GitHub App scanning by @dustin-decker in #4775
Expose SecretParts in the JSON output by @bradlarsen in #5073
[INS-497] Add Pganalyze Read Key Detector by @MuneebUllahKhan222 in #4993
[INS-197] Add redhatpyxis api key detector by @MuneebUllahKhan222 in #4995
[INS-407] Fixed AWS detector producing non deterministic output by @MuneebUllahKhan222 in #4836

New Contributors

@genisis0x made their first contribution in #5041
@andoniaf made their first contribution in #4690
@julien-c made their first contribution in #5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

`v3.95.6`

Compare Source

What's Changed

Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011
fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022
fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968
Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987
fix: avoid terminal probes before CLI output by @Hackerchen716 in #4994
Update test containers dependency by @trufflesteeeve in #4978
Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in #5023
[INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in #4969
[INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in #5006
[INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in #5008
Updating Klaviyo PK new format by @breetan in #5009
Restructure Klaviyo detector pattern tests by @martinlocklear in #5026
Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in #4992
set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in #5027
GitHub finegrained analyzer was improperly handling errors by @dustin-decker in #4498
[INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in #5005
Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in #4999
[INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in #5007
Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in #5028
fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in #5012
fix: add filetype=sdist param to pypi detector by @lukem-ts in #4988
Handlers - Embed small HTTP test fixtures by @amanfcp in #5001
S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in #5035

New Contributors

@Dawn-Fighter made their first contribution in #4968
@Hackerchen716 made their first contribution in #4994
@breetan made their first contribution in #5009
@lukem-ts made their first contribution in #5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

`v3.95.5`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

`v3.95.4`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-06-02T07:57:56Z

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	`v3.95.3` → `v3.97.2`

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

`v3.97.2`

Compare Source

What's Changed

detectors/github/v2: differentiate token type in ExtraData by @hartsock in #5223
Update dependency trufflesecurity/.github to v1.0.4 by @renovate[bot] in #5228
ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @bryanbeverly in #5231
Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @renovate[bot] in #5172
Update github-actions by @renovate[bot] in #5197
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5173
Update module github.com/aws/smithy-go to v1.27.9 by @renovate[bot] in #5174
[SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @dipto-truffle in #5234
[INS-377] Add V2 for weights and biases detector by @mustansir14 in #4951
Fix PagerDuty detector: treat 403 and 402 as verified credentials by @unsmith in #5230
[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @camgunz in #5248
Implement Enumerate for the Jenkins source by @Ahsan-Sarbaz in #5229
Update link to Truffle Security documentation by @shahzadhaider1 in #5256
Retry git clone on secondary rate limit (bare 403/429) by @kashifkhan0771 in #5260

New Contributors

@hartsock made their first contribution in #5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

`v3.97.1`

Compare Source

What's Changed

Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @renovate[bot] in #5196
Fix GHEC with Data Residency (*.ghe.com) base URL by @shahzadhaider1 in #4777
docs: add generic config-secret custom detector example by @pgmpofu in #5195
fix(detectors/docker): don't greedy match in keyPat by @mariduv in #5214
[SCAN-1020] neon scram pgx by @alafiand in #5217
Raised MongoDB detector timeout value by @jordanTunstill in #5222
preallocate bindings capacity in dockerhub and groq, with unit tests by @jordanTunstill in #5213
[SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @amanfcp in #5224
Refine SECURITY.md by @bradlarsen in #5216
Carry GitHub App installation ID on repo units by @bill-rich in #5215

New Contributors

@pgmpofu made their first contribution in #5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

`v3.97.0`

Compare Source

What's Changed

fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @genisis0x in #5127
Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @renovate[bot] in #5058
Remove url tag from common HTTP client metrics by @mcastorina in #5158
Update github.com/avast/apkparser digest to 7fcaee4 by @renovate[bot] in #5037
[INS-318] Add New Relic License Key Detector by @mustansir14 in #4760
[INS-348] Add New Relic Browser Key detector by @mustansir14 in #4769
[INS-339] Add New Relic User Key detector by @mustansir14 in #4794
[INS-345] Add New Relic Insights Query Key detector by @mustansir14 in #4781
fix(sources): stop UnitHook Close racing in-flight Finish sends by @bill-rich in #5154
There are now 3 CircleCI projects by @trufflesteeeve in #5166
Update github.com/shurcooL/githubv4 digest to 2402fdf by @renovate[bot] in #5038
Update github-actions by @renovate[bot] in #5036
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #4890
[INS-344] Add New Relic Mobile App Token Detector by @mustansir14 in #4810
Give each clone its own directory under --clone-path by @shahzadhaider1 in #5175
feat(output): add SARIF output format for GitHub code scanning by @kashifkhan0771 in #5165
[SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @alafiand in #5177
make cwd-changing normalization tests non-parallel to fix flaky clone failures by @jordanTunstill in #5178
[INS-456] Add Microsoft Teams Webhook V2 detector by @mustansir14 in #4902
surface git clone errors at v(0) by @jordanTunstill in #5162
Add Figma Personal Access Token v3 Detector by @shahzadhaider1 in #4790
fix(github): fallback resource Name to avoid empty-string proto validation failure by @kashifkhan0771 in #5182
[INT-643] Update Protos definition to cater bitbucket Api token authentication by @MuneebUllahKhan222 in #5171
Update regex pattern and 403 handling in the Lob detector to fix false positives by @MachiavelliII in #5188
Deprecate AppOptics detector by @Ahsan-Sarbaz in #5198
Anthropic detector: surface API error detail on non-2xx verification by @Ahsan-Sarbaz in #5180
Deprecated bingsubscriptionkey detector by @Ahsan-Sarbaz in #5179
Add SolarWinds Observability detector by @Ahsan-Sarbaz in #5199
fix(jiratoken): stop 202 reverification retry loop by @Ahsan-Sarbaz in #5200
Add custom endpoint support to the S3 source by @shahzadhaider1 in #5202
fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @unsmith in #5203
fix(huggingface): move unscoped fine-grained models to UnboundedResources by @unsmith in #5204
Add AWS Secrets Manager metadata type by @rosecodym in #5210
fix(detectors/harness): allow underscore in PAT account segment by @mattbrady-1 in #5153

New Contributors

@MachiavelliII made their first contribution in #5188
@Ahsan-Sarbaz made their first contribution in #5198
@unsmith made their first contribution in #5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

`v3.96.0`

Compare Source

What's Changed

[INS-355] Added Hashicorp vault token detector by @MuneebUllahKhan222 in #4819
Tighten JiraToken v1 verification by @shahzadhaider1 in #5122
[INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @bill-rich in #5123
Fix GitLab project metadata cache and switch to LRU by @kashifkhan0771 in #4727
Log analyze errors for Anthropic Analyzer by @kashifkhan0771 in #5120
Add metrics for chunks and results by @mcastorina in #5128
Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @kashifkhan0771 in #5111
[INS-312] Duo API Secret Key Detector by @MuneebUllahKhan222 in #4771
[Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @nabeelalam in #4739
[INS-255] Updated datadog detector to set verificationError in case of a verification error by @MuneebUllahKhan222 in #4661
Log analyze errors for Postgres analyzer by @kashifkhan0771 in #5131
Log analyze errors for HuggingFace analyzer by @kashifkhan0771 in #5130
Engine - Config.SourceManager doc by @amanfcp in #5002
Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @renovate[bot] in #5034
Retry git clone on transient network errors by @shahzadhaider1 in #5132
Fix scan_all_installations Rejecting Org Member Personal Repos by @shahzadhaider1 in #5142
updated detector to include underscore char by @mattbrady-1 in #5121
[chore] Change job_id in metric to source_type by @mcastorina in #5149
Posthog regex update by @mattbrady-1 in #5133
fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @johannestaas-trufflesec in #5151

New Contributors

@mattbrady-1 made their first contribution in #5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

`v3.95.9`

Compare Source

What's Changed

feat: add OpenRouter detector by @McPatate in #4500
Integrations fully codeowns detectors by @trufflesteeeve in #5104
[INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
[INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
[INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
[INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
[INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
feat: Support archived repo exclusion from GH org scans by @hibare in #4875
[INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
[INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
[INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

@McPatate made their first contribution in #4500
@eightseventhreethree made their first contribution in #4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

`v3.95.8`

Compare Source

What's Changed

removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in #5068
fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in #5043
Add prometheus metrics for engine channels and workers by @mcastorina in #5095
[INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in #5072
[INS-334] Octopus Deploy detector by @MuneebUllahKhan222 in #4787
Fix Syntax error in feature.go by @MuneebUllahKhan222 in #5109
Include encoded resume info instead of clobbering it by @bill-rich in #5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

`v3.95.7`

Compare Source

What's Changed

fix(sources/filesystem): order resume comparison by path component by @genisis0x in #5041
test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in #5053
fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in #5029
Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-decker in #4774
fix: add git worktree support in PrepareRepo by @andoniaf in #4690
[INS-406] Braintrust detector by @MuneebUllahKhan222 in #4826
huggingface: add bucket scanning by @julien-c in #5017
Skip reverification results during deduplication by @mcastorina in #5069
chore(renovate): bump shared config to v1.0.3 by @bryanbeverly in #5044
Add scan_all_installations option for multi-org GitHub App scanning by @dustin-decker in #4775
Expose SecretParts in the JSON output by @bradlarsen in #5073
[INS-497] Add Pganalyze Read Key Detector by @MuneebUllahKhan222 in #4993
[INS-197] Add redhatpyxis api key detector by @MuneebUllahKhan222 in #4995
[INS-407] Fixed AWS detector producing non deterministic output by @MuneebUllahKhan222 in #4836

New Contributors

@genisis0x made their first contribution in #5041
@andoniaf made their first contribution in #4690
@julien-c made their first contribution in #5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

`v3.95.6`

Compare Source

What's Changed

Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011
fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022
fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968
Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987
fix: avoid terminal probes before CLI output by @Hackerchen716 in #4994
Update test containers dependency by @trufflesteeeve in #4978
Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in #5023
[INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in #4969
[INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in #5006
[INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in #5008
Updating Klaviyo PK new format by @breetan in #5009
Restructure Klaviyo detector pattern tests by @martinlocklear in #5026
Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in #4992
set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in #5027
GitHub finegrained analyzer was improperly handling errors by @dustin-decker in #4498
[INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in #5005
Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in #4999
[INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in #5007
Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in #5028
fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in #5012
fix: add filetype=sdist param to pypi detector by @lukem-ts in #4988
Handlers - Embed small HTTP test fixtures by @amanfcp in #5001
S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in #5035

New Contributors

@Dawn-Fighter made their first contribution in #4968
@Hackerchen716 made their first contribution in #4994
@breetan made their first contribution in #5009
@lukem-ts made their first contribution in #5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

`v3.95.5`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

`v3.95.4`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-06-02T07:57:56Z

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	`v3.95.3` → `v3.97.2`

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

`v3.97.2`

Compare Source

What's Changed

detectors/github/v2: differentiate token type in ExtraData by @hartsock in #5223
Update dependency trufflesecurity/.github to v1.0.4 by @renovate[bot] in #5228
ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @bryanbeverly in #5231
Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @renovate[bot] in #5172
Update github-actions by @renovate[bot] in #5197
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5173
Update module github.com/aws/smithy-go to v1.27.9 by @renovate[bot] in #5174
[SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @dipto-truffle in #5234
[INS-377] Add V2 for weights and biases detector by @mustansir14 in #4951
Fix PagerDuty detector: treat 403 and 402 as verified credentials by @unsmith in #5230
[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @camgunz in #5248
Implement Enumerate for the Jenkins source by @Ahsan-Sarbaz in #5229
Update link to Truffle Security documentation by @shahzadhaider1 in #5256
Retry git clone on secondary rate limit (bare 403/429) by @kashifkhan0771 in #5260

New Contributors

@hartsock made their first contribution in #5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

`v3.97.1`

Compare Source

What's Changed

Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @renovate[bot] in #5196
Fix GHEC with Data Residency (*.ghe.com) base URL by @shahzadhaider1 in #4777
docs: add generic config-secret custom detector example by @pgmpofu in #5195
fix(detectors/docker): don't greedy match in keyPat by @mariduv in #5214
[SCAN-1020] neon scram pgx by @alafiand in #5217
Raised MongoDB detector timeout value by @jordanTunstill in #5222
preallocate bindings capacity in dockerhub and groq, with unit tests by @jordanTunstill in #5213
[SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @amanfcp in #5224
Refine SECURITY.md by @bradlarsen in #5216
Carry GitHub App installation ID on repo units by @bill-rich in #5215

New Contributors

@pgmpofu made their first contribution in #5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

`v3.97.0`

Compare Source

What's Changed

fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @genisis0x in #5127
Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @renovate[bot] in #5058
Remove url tag from common HTTP client metrics by @mcastorina in #5158
Update github.com/avast/apkparser digest to 7fcaee4 by @renovate[bot] in #5037
[INS-318] Add New Relic License Key Detector by @mustansir14 in #4760
[INS-348] Add New Relic Browser Key detector by @mustansir14 in #4769
[INS-339] Add New Relic User Key detector by @mustansir14 in #4794
[INS-345] Add New Relic Insights Query Key detector by @mustansir14 in #4781
fix(sources): stop UnitHook Close racing in-flight Finish sends by @bill-rich in #5154
There are now 3 CircleCI projects by @trufflesteeeve in #5166
Update github.com/shurcooL/githubv4 digest to 2402fdf by @renovate[bot] in #5038
Update github-actions by @renovate[bot] in #5036
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #4890
[INS-344] Add New Relic Mobile App Token Detector by @mustansir14 in #4810
Give each clone its own directory under --clone-path by @shahzadhaider1 in #5175
feat(output): add SARIF output format for GitHub code scanning by @kashifkhan0771 in #5165
[SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @alafiand in #5177
make cwd-changing normalization tests non-parallel to fix flaky clone failures by @jordanTunstill in #5178
[INS-456] Add Microsoft Teams Webhook V2 detector by @mustansir14 in #4902
surface git clone errors at v(0) by @jordanTunstill in #5162
Add Figma Personal Access Token v3 Detector by @shahzadhaider1 in #4790
fix(github): fallback resource Name to avoid empty-string proto validation failure by @kashifkhan0771 in #5182
[INT-643] Update Protos definition to cater bitbucket Api token authentication by @MuneebUllahKhan222 in #5171
Update regex pattern and 403 handling in the Lob detector to fix false positives by @MachiavelliII in #5188
Deprecate AppOptics detector by @Ahsan-Sarbaz in #5198
Anthropic detector: surface API error detail on non-2xx verification by @Ahsan-Sarbaz in #5180
Deprecated bingsubscriptionkey detector by @Ahsan-Sarbaz in #5179
Add SolarWinds Observability detector by @Ahsan-Sarbaz in #5199
fix(jiratoken): stop 202 reverification retry loop by @Ahsan-Sarbaz in #5200
Add custom endpoint support to the S3 source by @shahzadhaider1 in #5202
fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @unsmith in #5203
fix(huggingface): move unscoped fine-grained models to UnboundedResources by @unsmith in #5204
Add AWS Secrets Manager metadata type by @rosecodym in #5210
fix(detectors/harness): allow underscore in PAT account segment by @mattbrady-1 in #5153

New Contributors

@MachiavelliII made their first contribution in #5188
@Ahsan-Sarbaz made their first contribution in #5198
@unsmith made their first contribution in #5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

`v3.96.0`

Compare Source

What's Changed

[INS-355] Added Hashicorp vault token detector by @MuneebUllahKhan222 in #4819
Tighten JiraToken v1 verification by @shahzadhaider1 in #5122
[INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @bill-rich in #5123
Fix GitLab project metadata cache and switch to LRU by @kashifkhan0771 in #4727
Log analyze errors for Anthropic Analyzer by @kashifkhan0771 in #5120
Add metrics for chunks and results by @mcastorina in #5128
Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @kashifkhan0771 in #5111
[INS-312] Duo API Secret Key Detector by @MuneebUllahKhan222 in #4771
[Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @nabeelalam in #4739
[INS-255] Updated datadog detector to set verificationError in case of a verification error by @MuneebUllahKhan222 in #4661
Log analyze errors for Postgres analyzer by @kashifkhan0771 in #5131
Log analyze errors for HuggingFace analyzer by @kashifkhan0771 in #5130
Engine - Config.SourceManager doc by @amanfcp in #5002
Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @renovate[bot] in #5034
Retry git clone on transient network errors by @shahzadhaider1 in #5132
Fix scan_all_installations Rejecting Org Member Personal Repos by @shahzadhaider1 in #5142
updated detector to include underscore char by @mattbrady-1 in #5121
[chore] Change job_id in metric to source_type by @mcastorina in #5149
Posthog regex update by @mattbrady-1 in #5133
fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @johannestaas-trufflesec in #5151

New Contributors

@mattbrady-1 made their first contribution in #5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

`v3.95.9`

Compare Source

What's Changed

feat: add OpenRouter detector by @McPatate in #4500
Integrations fully codeowns detectors by @trufflesteeeve in #5104
[INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
[INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
[INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
[INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
[INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
feat: Support archived repo exclusion from GH org scans by @hibare in #4875
[INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
[INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
[INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

@McPatate made their first contribution in #4500
@eightseventhreethree made their first contribution in #4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

`v3.95.8`

Compare Source

What's Changed

removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in #5068
fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in #5043
Add prometheus metrics for engine channels and workers by @mcastorina in #5095
[INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in #5072
[INS-334] Octopus Deploy detector by @MuneebUllahKhan222 in #4787
Fix Syntax error in feature.go by @MuneebUllahKhan222 in #5109
Include encoded resume info instead of clobbering it by @bill-rich in #5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

`v3.95.7`

Compare Source

What's Changed

fix(sources/filesystem): order resume comparison by path component by @genisis0x in #5041
test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in #5053
fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in #5029
Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-decker in #4774
fix: add git worktree support in PrepareRepo by @andoniaf in #4690
[INS-406] Braintrust detector by @MuneebUllahKhan222 in #4826
huggingface: add bucket scanning by @julien-c in #5017
Skip reverification results during deduplication by @mcastorina in #5069
chore(renovate): bump shared config to v1.0.3 by @bryanbeverly in #5044
Add scan_all_installations option for multi-org GitHub App scanning by @dustin-decker in #4775
Expose SecretParts in the JSON output by @bradlarsen in #5073
[INS-497] Add Pganalyze Read Key Detector by @MuneebUllahKhan222 in #4993
[INS-197] Add redhatpyxis api key detector by @MuneebUllahKhan222 in #4995
[INS-407] Fixed AWS detector producing non deterministic output by @MuneebUllahKhan222 in #4836

New Contributors

@genisis0x made their first contribution in #5041
@andoniaf made their first contribution in #4690
@julien-c made their first contribution in #5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

`v3.95.6`

Compare Source

What's Changed

Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011
fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022
fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968
Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987
fix: avoid terminal probes before CLI output by @Hackerchen716 in #4994
Update test containers dependency by @trufflesteeeve in #4978
Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in #5023
[INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in #4969
[INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in #5006
[INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in #5008
Updating Klaviyo PK new format by @breetan in #5009
Restructure Klaviyo detector pattern tests by @martinlocklear in #5026
Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in #4992
set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in #5027
GitHub finegrained analyzer was improperly handling errors by @dustin-decker in #4498
[INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in #5005
Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in #4999
[INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in #5007
Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in #5028
fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in #5012
fix: add filetype=sdist param to pypi detector by @lukem-ts in #4988
Handlers - Embed small HTTP test fixtures by @amanfcp in #5001
S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in #5035

New Contributors

@Dawn-Fighter made their first contribution in #4968
@Hackerchen716 made their first contribution in #4994
@breetan made their first contribution in #5009
@lukem-ts made their first contribution in #5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

`v3.95.5`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

`v3.95.4`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-06-02T07:57:56Z

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	`v3.95.3` → `v3.97.2`

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

`v3.97.2`

Compare Source

What's Changed

detectors/github/v2: differentiate token type in ExtraData by @hartsock in #5223
Update dependency trufflesecurity/.github to v1.0.4 by @renovate[bot] in #5228
ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @bryanbeverly in #5231
Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @renovate[bot] in #5172
Update github-actions by @renovate[bot] in #5197
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5173
Update module github.com/aws/smithy-go to v1.27.9 by @renovate[bot] in #5174
[SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @dipto-truffle in #5234
[INS-377] Add V2 for weights and biases detector by @mustansir14 in #4951
Fix PagerDuty detector: treat 403 and 402 as verified credentials by @unsmith in #5230
[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @camgunz in #5248
Implement Enumerate for the Jenkins source by @Ahsan-Sarbaz in #5229
Update link to Truffle Security documentation by @shahzadhaider1 in #5256
Retry git clone on secondary rate limit (bare 403/429) by @kashifkhan0771 in #5260

New Contributors

@hartsock made their first contribution in #5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

`v3.97.1`

Compare Source

What's Changed

Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @renovate[bot] in #5196
Fix GHEC with Data Residency (*.ghe.com) base URL by @shahzadhaider1 in #4777
docs: add generic config-secret custom detector example by @pgmpofu in #5195
fix(detectors/docker): don't greedy match in keyPat by @mariduv in #5214
[SCAN-1020] neon scram pgx by @alafiand in #5217
Raised MongoDB detector timeout value by @jordanTunstill in #5222
preallocate bindings capacity in dockerhub and groq, with unit tests by @jordanTunstill in #5213
[SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @amanfcp in #5224
Refine SECURITY.md by @bradlarsen in #5216
Carry GitHub App installation ID on repo units by @bill-rich in #5215

New Contributors

@pgmpofu made their first contribution in #5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

`v3.97.0`

Compare Source

What's Changed

fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @genisis0x in #5127
Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @renovate[bot] in #5058
Remove url tag from common HTTP client metrics by @mcastorina in #5158
Update github.com/avast/apkparser digest to 7fcaee4 by @renovate[bot] in #5037
[INS-318] Add New Relic License Key Detector by @mustansir14 in #4760
[INS-348] Add New Relic Browser Key detector by @mustansir14 in #4769
[INS-339] Add New Relic User Key detector by @mustansir14 in #4794
[INS-345] Add New Relic Insights Query Key detector by @mustansir14 in #4781
fix(sources): stop UnitHook Close racing in-flight Finish sends by @bill-rich in #5154
There are now 3 CircleCI projects by @trufflesteeeve in #5166
Update github.com/shurcooL/githubv4 digest to 2402fdf by @renovate[bot] in #5038
Update github-actions by @renovate[bot] in #5036
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #4890
[INS-344] Add New Relic Mobile App Token Detector by @mustansir14 in #4810
Give each clone its own directory under --clone-path by @shahzadhaider1 in #5175
feat(output): add SARIF output format for GitHub code scanning by @kashifkhan0771 in #5165
[SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @alafiand in #5177
make cwd-changing normalization tests non-parallel to fix flaky clone failures by @jordanTunstill in #5178
[INS-456] Add Microsoft Teams Webhook V2 detector by @mustansir14 in #4902
surface git clone errors at v(0) by @jordanTunstill in #5162
Add Figma Personal Access Token v3 Detector by @shahzadhaider1 in #4790
fix(github): fallback resource Name to avoid empty-string proto validation failure by @kashifkhan0771 in #5182
[INT-643] Update Protos definition to cater bitbucket Api token authentication by @MuneebUllahKhan222 in #5171
Update regex pattern and 403 handling in the Lob detector to fix false positives by @MachiavelliII in #5188
Deprecate AppOptics detector by @Ahsan-Sarbaz in #5198
Anthropic detector: surface API error detail on non-2xx verification by @Ahsan-Sarbaz in #5180
Deprecated bingsubscriptionkey detector by @Ahsan-Sarbaz in #5179
Add SolarWinds Observability detector by @Ahsan-Sarbaz in #5199
fix(jiratoken): stop 202 reverification retry loop by @Ahsan-Sarbaz in #5200
Add custom endpoint support to the S3 source by @shahzadhaider1 in #5202
fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @unsmith in #5203
fix(huggingface): move unscoped fine-grained models to UnboundedResources by @unsmith in #5204
Add AWS Secrets Manager metadata type by @rosecodym in #5210
fix(detectors/harness): allow underscore in PAT account segment by @mattbrady-1 in #5153

New Contributors

@MachiavelliII made their first contribution in #5188
@Ahsan-Sarbaz made their first contribution in #5198
@unsmith made their first contribution in #5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

`v3.96.0`

Compare Source

What's Changed

[INS-355] Added Hashicorp vault token detector by @MuneebUllahKhan222 in #4819
Tighten JiraToken v1 verification by @shahzadhaider1 in #5122
[INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @bill-rich in #5123
Fix GitLab project metadata cache and switch to LRU by @kashifkhan0771 in #4727
Log analyze errors for Anthropic Analyzer by @kashifkhan0771 in #5120
Add metrics for chunks and results by @mcastorina in #5128
Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @kashifkhan0771 in #5111
[INS-312] Duo API Secret Key Detector by @MuneebUllahKhan222 in #4771
[Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @nabeelalam in #4739
[INS-255] Updated datadog detector to set verificationError in case of a verification error by @MuneebUllahKhan222 in #4661
Log analyze errors for Postgres analyzer by @kashifkhan0771 in #5131
Log analyze errors for HuggingFace analyzer by @kashifkhan0771 in #5130
Engine - Config.SourceManager doc by @amanfcp in #5002
Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @renovate[bot] in #5034
Retry git clone on transient network errors by @shahzadhaider1 in #5132
Fix scan_all_installations Rejecting Org Member Personal Repos by @shahzadhaider1 in #5142
updated detector to include underscore char by @mattbrady-1 in #5121
[chore] Change job_id in metric to source_type by @mcastorina in #5149
Posthog regex update by @mattbrady-1 in #5133
fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @johannestaas-trufflesec in #5151

New Contributors

@mattbrady-1 made their first contribution in #5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

`v3.95.9`

Compare Source

What's Changed

feat: add OpenRouter detector by @McPatate in #4500
Integrations fully codeowns detectors by @trufflesteeeve in #5104
[INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
[INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
[INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
[INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
[INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
feat: Support archived repo exclusion from GH org scans by @hibare in #4875
[INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
[INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
[INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

@McPatate made their first contribution in #4500
@eightseventhreethree made their first contribution in #4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

`v3.95.8`

Compare Source

What's Changed

removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in #5068
fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in #5043
Add prometheus metrics for engine channels and workers by @mcastorina in #5095
[INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in #5072
[INS-334] Octopus Deploy detector by @MuneebUllahKhan222 in #4787
Fix Syntax error in feature.go by @MuneebUllahKhan222 in #5109
Include encoded resume info instead of clobbering it by @bill-rich in #5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

`v3.95.7`

Compare Source

What's Changed

fix(sources/filesystem): order resume comparison by path component by @genisis0x in #5041
test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in #5053
fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in #5029
Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-decker in #4774
fix: add git worktree support in PrepareRepo by @andoniaf in #4690
[INS-406] Braintrust detector by @MuneebUllahKhan222 in #4826
huggingface: add bucket scanning by @julien-c in #5017
Skip reverification results during deduplication by @mcastorina in #5069
chore(renovate): bump shared config to v1.0.3 by @bryanbeverly in #5044
Add scan_all_installations option for multi-org GitHub App scanning by @dustin-decker in #4775
Expose SecretParts in the JSON output by @bradlarsen in #5073
[INS-497] Add Pganalyze Read Key Detector by @MuneebUllahKhan222 in #4993
[INS-197] Add redhatpyxis api key detector by @MuneebUllahKhan222 in #4995
[INS-407] Fixed AWS detector producing non deterministic output by @MuneebUllahKhan222 in #4836

New Contributors

@genisis0x made their first contribution in #5041
@andoniaf made their first contribution in #4690
@julien-c made their first contribution in #5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

`v3.95.6`

Compare Source

What's Changed

Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011
fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022
fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968
Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987
fix: avoid terminal probes before CLI output by @Hackerchen716 in #4994
Update test containers dependency by @trufflesteeeve in #4978
Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in #5023
[INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in #4969
[INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in #5006
[INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in #5008
Updating Klaviyo PK new format by @breetan in #5009
Restructure Klaviyo detector pattern tests by @martinlocklear in #5026
Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in #4992
set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in #5027
GitHub finegrained analyzer was improperly handling errors by @dustin-decker in #4498
[INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in #5005
Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in #4999
[INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in #5007
Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in #5028
fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in #5012
fix: add filetype=sdist param to pypi detector by @lukem-ts in #4988
Handlers - Embed small HTTP test fixtures by @amanfcp in #5001
S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in #5035

New Contributors

@Dawn-Fighter made their first contribution in #4968
@Hackerchen716 made their first contribution in #4994
@breetan made their first contribution in #5009
@lukem-ts made their first contribution in #5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

`v3.95.5`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

`v3.95.4`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-06-02T07:57:56Z

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	`v3.95.3` → `v3.97.2`

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

`v3.97.2`

Compare Source

What's Changed

detectors/github/v2: differentiate token type in ExtraData by @hartsock in #5223
Update dependency trufflesecurity/.github to v1.0.4 by @renovate[bot] in #5228
ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @bryanbeverly in #5231
Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @renovate[bot] in #5172
Update github-actions by @renovate[bot] in #5197
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5173
Update module github.com/aws/smithy-go to v1.27.9 by @renovate[bot] in #5174
[SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @dipto-truffle in #5234
[INS-377] Add V2 for weights and biases detector by @mustansir14 in #4951
Fix PagerDuty detector: treat 403 and 402 as verified credentials by @unsmith in #5230
[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @camgunz in #5248
Implement Enumerate for the Jenkins source by @Ahsan-Sarbaz in #5229
Update link to Truffle Security documentation by @shahzadhaider1 in #5256
Retry git clone on secondary rate limit (bare 403/429) by @kashifkhan0771 in #5260

New Contributors

@hartsock made their first contribution in #5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

`v3.97.1`

Compare Source

What's Changed

Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @renovate[bot] in #5196
Fix GHEC with Data Residency (*.ghe.com) base URL by @shahzadhaider1 in #4777
docs: add generic config-secret custom detector example by @pgmpofu in #5195
fix(detectors/docker): don't greedy match in keyPat by @mariduv in #5214
[SCAN-1020] neon scram pgx by @alafiand in #5217
Raised MongoDB detector timeout value by @jordanTunstill in #5222
preallocate bindings capacity in dockerhub and groq, with unit tests by @jordanTunstill in #5213
[SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @amanfcp in #5224
Refine SECURITY.md by @bradlarsen in #5216
Carry GitHub App installation ID on repo units by @bill-rich in #5215

New Contributors

@pgmpofu made their first contribution in #5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

`v3.97.0`

Compare Source

What's Changed

fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @genisis0x in #5127
Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @renovate[bot] in #5058
Remove url tag from common HTTP client metrics by @mcastorina in #5158
Update github.com/avast/apkparser digest to 7fcaee4 by @renovate[bot] in #5037
[INS-318] Add New Relic License Key Detector by @mustansir14 in #4760
[INS-348] Add New Relic Browser Key detector by @mustansir14 in #4769
[INS-339] Add New Relic User Key detector by @mustansir14 in #4794
[INS-345] Add New Relic Insights Query Key detector by @mustansir14 in #4781
fix(sources): stop UnitHook Close racing in-flight Finish sends by @bill-rich in #5154
There are now 3 CircleCI projects by @trufflesteeeve in #5166
Update github.com/shurcooL/githubv4 digest to 2402fdf by @renovate[bot] in #5038
Update github-actions by @renovate[bot] in #5036
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #4890
[INS-344] Add New Relic Mobile App Token Detector by @mustansir14 in #4810
Give each clone its own directory under --clone-path by @shahzadhaider1 in #5175
feat(output): add SARIF output format for GitHub code scanning by @kashifkhan0771 in #5165
[SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @alafiand in #5177
make cwd-changing normalization tests non-parallel to fix flaky clone failures by @jordanTunstill in #5178
[INS-456] Add Microsoft Teams Webhook V2 detector by @mustansir14 in #4902
surface git clone errors at v(0) by @jordanTunstill in #5162
Add Figma Personal Access Token v3 Detector by @shahzadhaider1 in #4790
fix(github): fallback resource Name to avoid empty-string proto validation failure by @kashifkhan0771 in #5182
[INT-643] Update Protos definition to cater bitbucket Api token authentication by @MuneebUllahKhan222 in #5171
Update regex pattern and 403 handling in the Lob detector to fix false positives by @MachiavelliII in #5188
Deprecate AppOptics detector by @Ahsan-Sarbaz in #5198
Anthropic detector: surface API error detail on non-2xx verification by @Ahsan-Sarbaz in #5180
Deprecated bingsubscriptionkey detector by @Ahsan-Sarbaz in #5179
Add SolarWinds Observability detector by @Ahsan-Sarbaz in #5199
fix(jiratoken): stop 202 reverification retry loop by @Ahsan-Sarbaz in #5200
Add custom endpoint support to the S3 source by @shahzadhaider1 in #5202
fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @unsmith in #5203
fix(huggingface): move unscoped fine-grained models to UnboundedResources by @unsmith in #5204
Add AWS Secrets Manager metadata type by @rosecodym in #5210
fix(detectors/harness): allow underscore in PAT account segment by @mattbrady-1 in #5153

New Contributors

@MachiavelliII made their first contribution in #5188
@Ahsan-Sarbaz made their first contribution in #5198
@unsmith made their first contribution in #5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

`v3.96.0`

Compare Source

What's Changed

[INS-355] Added Hashicorp vault token detector by @MuneebUllahKhan222 in #4819
Tighten JiraToken v1 verification by @shahzadhaider1 in #5122
[INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @bill-rich in #5123
Fix GitLab project metadata cache and switch to LRU by @kashifkhan0771 in #4727
Log analyze errors for Anthropic Analyzer by @kashifkhan0771 in #5120
Add metrics for chunks and results by @mcastorina in #5128
Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @kashifkhan0771 in #5111
[INS-312] Duo API Secret Key Detector by @MuneebUllahKhan222 in #4771
[Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @nabeelalam in #4739
[INS-255] Updated datadog detector to set verificationError in case of a verification error by @MuneebUllahKhan222 in #4661
Log analyze errors for Postgres analyzer by @kashifkhan0771 in #5131
Log analyze errors for HuggingFace analyzer by @kashifkhan0771 in #5130
Engine - Config.SourceManager doc by @amanfcp in #5002
Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @renovate[bot] in #5034
Retry git clone on transient network errors by @shahzadhaider1 in #5132
Fix scan_all_installations Rejecting Org Member Personal Repos by @shahzadhaider1 in #5142
updated detector to include underscore char by @mattbrady-1 in #5121
[chore] Change job_id in metric to source_type by @mcastorina in #5149
Posthog regex update by @mattbrady-1 in #5133
fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @johannestaas-trufflesec in #5151

New Contributors

@mattbrady-1 made their first contribution in #5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

`v3.95.9`

Compare Source

What's Changed

feat: add OpenRouter detector by @McPatate in #4500
Integrations fully codeowns detectors by @trufflesteeeve in #5104
[INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
[INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
[INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
[INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
[INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
feat: Support archived repo exclusion from GH org scans by @hibare in #4875
[INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
[INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
[INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

@McPatate made their first contribution in #4500
@eightseventhreethree made their first contribution in #4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

`v3.95.8`

Compare Source

What's Changed

removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in #5068
fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in #5043
Add prometheus metrics for engine channels and workers by @mcastorina in #5095
[INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in #5072
[INS-334] Octopus Deploy detector by @MuneebUllahKhan222 in #4787
Fix Syntax error in feature.go by @MuneebUllahKhan222 in #5109
Include encoded resume info instead of clobbering it by @bill-rich in #5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

`v3.95.7`

Compare Source

What's Changed

fix(sources/filesystem): order resume comparison by path component by @genisis0x in #5041
test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in #5053
fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in #5029
Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-decker in #4774
fix: add git worktree support in PrepareRepo by @andoniaf in #4690
[INS-406] Braintrust detector by @MuneebUllahKhan222 in #4826
huggingface: add bucket scanning by @julien-c in #5017
Skip reverification results during deduplication by @mcastorina in #5069
chore(renovate): bump shared config to v1.0.3 by @bryanbeverly in #5044
Add scan_all_installations option for multi-org GitHub App scanning by @dustin-decker in #4775
Expose SecretParts in the JSON output by @bradlarsen in #5073
[INS-497] Add Pganalyze Read Key Detector by @MuneebUllahKhan222 in #4993
[INS-197] Add redhatpyxis api key detector by @MuneebUllahKhan222 in #4995
[INS-407] Fixed AWS detector producing non deterministic output by @MuneebUllahKhan222 in #4836

New Contributors

@genisis0x made their first contribution in #5041
@andoniaf made their first contribution in #4690
@julien-c made their first contribution in #5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

`v3.95.6`

Compare Source

What's Changed

Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011
fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022
fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968
Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987
fix: avoid terminal probes before CLI output by @Hackerchen716 in #4994
Update test containers dependency by @trufflesteeeve in #4978
Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in #5023
[INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in #4969
[INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in #5006
[INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in #5008
Updating Klaviyo PK new format by @breetan in #5009
Restructure Klaviyo detector pattern tests by @martinlocklear in #5026
Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in #4992
set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in #5027
GitHub finegrained analyzer was improperly handling errors by @dustin-decker in #4498
[INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in #5005
Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in #4999
[INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in #5007
Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in #5028
fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in #5012
fix: add filetype=sdist param to pypi detector by @lukem-ts in #4988
Handlers - Embed small HTTP test fixtures by @amanfcp in #5001
S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in #5035

New Contributors

@Dawn-Fighter made their first contribution in #4968
@Hackerchen716 made their first contribution in #4994
@breetan made their first contribution in #5009
@lukem-ts made their first contribution in #5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

`v3.95.5`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

`v3.95.4`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-06-02T07:57:56Z

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	`v3.95.3` → `v3.97.2`

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

`v3.97.2`

Compare Source

What's Changed

detectors/github/v2: differentiate token type in ExtraData by @hartsock in #5223
Update dependency trufflesecurity/.github to v1.0.4 by @renovate[bot] in #5228
ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @bryanbeverly in #5231
Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @renovate[bot] in #5172
Update github-actions by @renovate[bot] in #5197
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5173
Update module github.com/aws/smithy-go to v1.27.9 by @renovate[bot] in #5174
[SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @dipto-truffle in #5234
[INS-377] Add V2 for weights and biases detector by @mustansir14 in #4951
Fix PagerDuty detector: treat 403 and 402 as verified credentials by @unsmith in #5230
[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @camgunz in #5248
Implement Enumerate for the Jenkins source by @Ahsan-Sarbaz in #5229
Update link to Truffle Security documentation by @shahzadhaider1 in #5256
Retry git clone on secondary rate limit (bare 403/429) by @kashifkhan0771 in #5260

New Contributors

@hartsock made their first contribution in #5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

`v3.97.1`

Compare Source

What's Changed

Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @renovate[bot] in #5196
Fix GHEC with Data Residency (*.ghe.com) base URL by @shahzadhaider1 in #4777
docs: add generic config-secret custom detector example by @pgmpofu in #5195
fix(detectors/docker): don't greedy match in keyPat by @mariduv in #5214
[SCAN-1020] neon scram pgx by @alafiand in #5217
Raised MongoDB detector timeout value by @jordanTunstill in #5222
preallocate bindings capacity in dockerhub and groq, with unit tests by @jordanTunstill in #5213
[SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @amanfcp in #5224
Refine SECURITY.md by @bradlarsen in #5216
Carry GitHub App installation ID on repo units by @bill-rich in #5215

New Contributors

@pgmpofu made their first contribution in #5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

`v3.97.0`

Compare Source

What's Changed

fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @genisis0x in #5127
Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @renovate[bot] in #5058
Remove url tag from common HTTP client metrics by @mcastorina in #5158
Update github.com/avast/apkparser digest to 7fcaee4 by @renovate[bot] in #5037
[INS-318] Add New Relic License Key Detector by @mustansir14 in #4760
[INS-348] Add New Relic Browser Key detector by @mustansir14 in #4769
[INS-339] Add New Relic User Key detector by @mustansir14 in #4794
[INS-345] Add New Relic Insights Query Key detector by @mustansir14 in #4781
fix(sources): stop UnitHook Close racing in-flight Finish sends by @bill-rich in #5154
There are now 3 CircleCI projects by @trufflesteeeve in #5166
Update github.com/shurcooL/githubv4 digest to 2402fdf by @renovate[bot] in #5038
Update github-actions by @renovate[bot] in #5036
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #4890
[INS-344] Add New Relic Mobile App Token Detector by @mustansir14 in #4810
Give each clone its own directory under --clone-path by @shahzadhaider1 in #5175
feat(output): add SARIF output format for GitHub code scanning by @kashifkhan0771 in #5165
[SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @alafiand in #5177
make cwd-changing normalization tests non-parallel to fix flaky clone failures by @jordanTunstill in #5178
[INS-456] Add Microsoft Teams Webhook V2 detector by @mustansir14 in #4902
surface git clone errors at v(0) by @jordanTunstill in #5162
Add Figma Personal Access Token v3 Detector by @shahzadhaider1 in #4790
fix(github): fallback resource Name to avoid empty-string proto validation failure by @kashifkhan0771 in #5182
[INT-643] Update Protos definition to cater bitbucket Api token authentication by @MuneebUllahKhan222 in #5171
Update regex pattern and 403 handling in the Lob detector to fix false positives by @MachiavelliII in #5188
Deprecate AppOptics detector by @Ahsan-Sarbaz in #5198
Anthropic detector: surface API error detail on non-2xx verification by @Ahsan-Sarbaz in #5180
Deprecated bingsubscriptionkey detector by @Ahsan-Sarbaz in #5179
Add SolarWinds Observability detector by @Ahsan-Sarbaz in #5199
fix(jiratoken): stop 202 reverification retry loop by @Ahsan-Sarbaz in #5200
Add custom endpoint support to the S3 source by @shahzadhaider1 in #5202
fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @unsmith in #5203
fix(huggingface): move unscoped fine-grained models to UnboundedResources by @unsmith in #5204
Add AWS Secrets Manager metadata type by @rosecodym in #5210
fix(detectors/harness): allow underscore in PAT account segment by @mattbrady-1 in #5153

New Contributors

@MachiavelliII made their first contribution in #5188
@Ahsan-Sarbaz made their first contribution in #5198
@unsmith made their first contribution in #5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

`v3.96.0`

Compare Source

What's Changed

[INS-355] Added Hashicorp vault token detector by @MuneebUllahKhan222 in #4819
Tighten JiraToken v1 verification by @shahzadhaider1 in #5122
[INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @bill-rich in #5123
Fix GitLab project metadata cache and switch to LRU by @kashifkhan0771 in #4727
Log analyze errors for Anthropic Analyzer by @kashifkhan0771 in #5120
Add metrics for chunks and results by @mcastorina in #5128
Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @kashifkhan0771 in #5111
[INS-312] Duo API Secret Key Detector by @MuneebUllahKhan222 in #4771
[Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @nabeelalam in #4739
[INS-255] Updated datadog detector to set verificationError in case of a verification error by @MuneebUllahKhan222 in #4661
Log analyze errors for Postgres analyzer by @kashifkhan0771 in #5131
Log analyze errors for HuggingFace analyzer by @kashifkhan0771 in #5130
Engine - Config.SourceManager doc by @amanfcp in #5002
Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @renovate[bot] in #5034
Retry git clone on transient network errors by @shahzadhaider1 in #5132
Fix scan_all_installations Rejecting Org Member Personal Repos by @shahzadhaider1 in #5142
updated detector to include underscore char by @mattbrady-1 in #5121
[chore] Change job_id in metric to source_type by @mcastorina in #5149
Posthog regex update by @mattbrady-1 in #5133
fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @johannestaas-trufflesec in #5151

New Contributors

@mattbrady-1 made their first contribution in #5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

`v3.95.9`

Compare Source

What's Changed

feat: add OpenRouter detector by @McPatate in #4500
Integrations fully codeowns detectors by @trufflesteeeve in #5104
[INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
[INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
[INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
[INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
[INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
feat: Support archived repo exclusion from GH org scans by @hibare in #4875
[INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
[INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
[INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

@McPatate made their first contribution in #4500
@eightseventhreethree made their first contribution in #4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

`v3.95.8`

Compare Source

What's Changed

removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in #5068
fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in #5043
Add prometheus metrics for engine channels and workers by @mcastorina in #5095
[INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in #5072
[INS-334] Octopus Deploy detector by @MuneebUllahKhan222 in #4787
Fix Syntax error in feature.go by @MuneebUllahKhan222 in #5109
Include encoded resume info instead of clobbering it by @bill-rich in #5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

`v3.95.7`

Compare Source

What's Changed

fix(sources/filesystem): order resume comparison by path component by @genisis0x in #5041
test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in #5053
fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in #5029
Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-decker in #4774
fix: add git worktree support in PrepareRepo by @andoniaf in #4690
[INS-406] Braintrust detector by @MuneebUllahKhan222 in #4826
huggingface: add bucket scanning by @julien-c in #5017
Skip reverification results during deduplication by @mcastorina in #5069
chore(renovate): bump shared config to v1.0.3 by @bryanbeverly in #5044
Add scan_all_installations option for multi-org GitHub App scanning by @dustin-decker in #4775
Expose SecretParts in the JSON output by @bradlarsen in #5073
[INS-497] Add Pganalyze Read Key Detector by @MuneebUllahKhan222 in #4993
[INS-197] Add redhatpyxis api key detector by @MuneebUllahKhan222 in #4995
[INS-407] Fixed AWS detector producing non deterministic output by @MuneebUllahKhan222 in #4836

New Contributors

@genisis0x made their first contribution in #5041
@andoniaf made their first contribution in #4690
@julien-c made their first contribution in #5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

`v3.95.6`

Compare Source

What's Changed

Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011
fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022
fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968
Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987
fix: avoid terminal probes before CLI output by @Hackerchen716 in #4994
Update test containers dependency by @trufflesteeeve in #4978
Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in #5023
[INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in #4969
[INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in #5006
[INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in #5008
Updating Klaviyo PK new format by @breetan in #5009
Restructure Klaviyo detector pattern tests by @martinlocklear in #5026
Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in #4992
set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in #5027
GitHub finegrained analyzer was improperly handling errors by @dustin-decker in #4498
[INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in #5005
Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in #4999
[INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in #5007
Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in #5028
fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in #5012
fix: add filetype=sdist param to pypi detector by @lukem-ts in #4988
Handlers - Embed small HTTP test fixtures by @amanfcp in #5001
S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in #5035

New Contributors

@Dawn-Fighter made their first contribution in #4968
@Hackerchen716 made their first contribution in #4994
@breetan made their first contribution in #5009
@lukem-ts made their first contribution in #5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

`v3.95.5`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

`v3.95.4`

Compare Source

What's Changed

[INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
[INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
Added GitLab OAuth Detector by @shahzadhaider1 in #4729
Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
[INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
[INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
Automate corpora testing in CI by @mustansir14 in #4927
Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
Update Go security dependencies by @cursor[bot] in #4986
Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

@mariocj89 made their first contribution in #4849
@cursor[bot] made their first contribution in #4986
@johannestaas-trufflesec made their first contribution in #4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovateBot changed the title ~~Update trufflesecurity/trufflehog action to v3.95.4~~Update trufflesecurity/trufflehog action to v3.95.5Jun 2, 2026

renovateBotforce-pushed the renovate/trufflesecurity-trufflehog-3.x branch from deb9523 to d7b51baCompare June 2, 2026 20:35

renovateBot changed the title ~~Update trufflesecurity/trufflehog action to v3.95.5~~Update trufflesecurity/trufflehog action to v3.95.6Jun 18, 2026

renovateBotforce-pushed the renovate/trufflesecurity-trufflehog-3.x branch from d7b51ba to bc6ace5Compare June 18, 2026 17:41

renovateBot changed the title ~~Update trufflesecurity/trufflehog action to v3.95.6~~Update trufflesecurity/trufflehog action to v3.95.7Jun 29, 2026

renovateBotforce-pushed the renovate/trufflesecurity-trufflehog-3.x branch 2 times, most recently from b2257b4 to d288330Compare July 2, 2026 20:53

renovateBot changed the title ~~Update trufflesecurity/trufflehog action to v3.95.7~~Update trufflesecurity/trufflehog action to v3.95.8Jul 2, 2026

renovateBot changed the title ~~Update trufflesecurity/trufflehog action to v3.95.8~~Update trufflesecurity/trufflehog action to v3.95.9Jul 10, 2026

renovateBotforce-pushed the renovate/trufflesecurity-trufflehog-3.x branch from d288330 to 87009f8Compare July 10, 2026 00:15

renovateBotforce-pushed the renovate/trufflesecurity-trufflehog-3.x branch from 87009f8 to 3e5fce9Compare July 24, 2026 22:43

renovateBot changed the title ~~Update trufflesecurity/trufflehog action to v3.95.9~~Update trufflesecurity/trufflehog action to v3.96.0Jul 24, 2026

renovateBotforce-pushed the renovate/trufflesecurity-trufflehog-3.x branch from 3e5fce9 to 0516ea9Compare August 14, 2026 21:52

renovateBot changed the title ~~Update trufflesecurity/trufflehog action to v3.96.0~~Update trufflesecurity/trufflehog action to v3.97.0Aug 14, 2026

renovateBotforce-pushed the renovate/trufflesecurity-trufflehog-3.x branch from 0516ea9 to 9bd711dCompare August 25, 2026 18:48

renovateBot changed the title ~~Update trufflesecurity/trufflehog action to v3.97.0~~Update trufflesecurity/trufflehog action to v3.97.1Aug 25, 2026

Update trufflesecurity/trufflehog action to v3.97.2
cb36da4

renovateBotforce-pushed the renovate/trufflesecurity-trufflehog-3.x branch from 9bd711d to cb36da4Compare September 3, 2026 00:31

renovateBot changed the title ~~Update trufflesecurity/trufflehog action to v3.97.1~~Update trufflesecurity/trufflehog action to v3.97.2Sep 3, 2026