What's Changed Skip GitHub comment errors when issues or PRs are off by @kashifkhan0771 in #5467 [SCAN-180]: Populate SecretParts for custom detector results by @casey-tran in #5470 Clean up S3 source logging for per-source debug by @kashifkhan0771 in #5481 Clean up GitHub source logging for per-source debug by @kashifkhan0771 in #5457 feat(detectors): add Composio API key detector by @groovyBugif…
What's Changed Fix --include-wikis help typo and huggingface README description by @protonnegativo in #5471 fix(detectors/anypointoauth2): stop treating HTTP 422 as verified by @jamesgol in #5386 Add xAI analyzer by @serval-frenchie in #5456 ci(lint): pin the semgrep container image by digest by @Portll in #5245 feat(detectors): add Fireworks AI API key detector by @sudo-a-man in #5447 feat(detect…
v3.99.5 was tagged but never published because its release build failed. v3.99.6 supersedes it and includes all of the changes below. What's Changed Update github-actions by @renovate[bot] in #5414 Prefer nearest client/tenant IDs for Azure SP secrets by @kashifkhan0771 in #5449 Clean up Filesystem source logging for per-source debug by @kashifkhan0771 in #5465 security: bump andybalholm/brotli to…
CVE-2026-111497 is an out-of-bounds write in the brotli decoder when a stream contains an invalid block switch. It was fixed upstream in google/brotli commit 0ed4268a (v1.2.1). The Go port has the same bug and fixes it in github.com/andybalholm/brotli v1.2.7 (commit 33c2a988, "Detect and report invalid stream earlier"). In Go the likely impact is a panic while decoding a crafted brotli stream. Cla…
What's Changed Add per-source debug option and hide sensitive data in debug logs by @kashifkhan0771 in #5446 Mark results whose verification was skipped by @unsmith in #5448 Clean up Git source logging for per-source debug by @kashifkhan0771 in #5451 Add Lambda Cloud API key detector by @lukem-ts in #5435 Update github.com/trufflesecurity/ldap-verify digest to 4a15faf by @renovate[bot] in #5441 Up…
What's Changed Add stdin source documentation by @kashifkhan0771 in #5397 Add syslog source documentation by @kashifkhan0771 in #5398 Add travisci source documentation by @kashifkhan0771 in #5401 Changed GithubOauth2 detector to only rotate on particular error message by @jordanTunstill in #5396 Update dependency golangci/golangci-lint to v2.14.0 by @renovate[bot] in #5408 Update alpine Docker tag…
What's Changed Copy over dedupe cache size into the engine from the config by @camgunz in #5402 Full Changelog: v3.99.1...v3.99.2
What's Changed Update github-actions by @renovate[bot] in #5363 [INT-1084] Make the results deduplication cache size configurable by @camgunz in #5399 Full Changelog: v3.99.0...v3.99.1
What's Changed Fix Sumo Logic detector ignoring configured verifier endpoints by @unsmith in #5395 Add OAuth2 (ROPC) auth for verification requests by @unsmith in #5392 Full Changelog: v3.98.1...v3.99.0
What's Changed Add postman source documentation by @kashifkhan0771 in #5389 Add a TruffleHog dectector for Kong Konnect Platform by @mrwanny in #5305 Add api_timeout_seconds to Gerrit source proto by @kashifkhan0771 in #5394 New Contributors @mrwanny made their first contribution in #5305 Full Changelog: v3.98.0...v3.98.1
What's Changed Int 595 verify asymmetry by @shahzadhaider1 in #5261 return error body for fetchBearerToken by @jordanTunstill in #5301 Update module github.com/charmbracelet/bubbletea to v1.3.10 by @renovate[bot] in #5281 Update github.com/trufflesecurity/ldap-verify digest to 3142cc9 by @renovate[bot] in #5280 [INT-1086] Don't reuse maps; editing them afterwards edits them for all results by @cam…
What's Changed [SCAN-162] Add Err() to JobProgress and JobProgressRef by @dipto-truffle in #5346 ci: scope Smoke timeouts to trufflehog runs, not the build by @bryanbeverly in #5317 Update module github.com/aymanbagabas/go-osc52 to v1.2.2 by @renovate[bot] in #5252 Update module github.com/gabriel-vasile/mimetype to v1.4.15 by @renovate[bot] in #5283 make 401s for Basic auth verified false. by @jo…
What's Changed Add Okta OAuth support in Okta detector by @shreyas-sriram in #5323 Add per detector verification timing to verification cache by @kvnphvm in #5341 Set all verification errors in detectors by @shahzadhaider1 in #5253 Full Changelog: v3.97.7...v3.97.8
What's Changed Recognize a missing Postgres database by SQLSTATE by @gaborbernat in #5312 Improve Github App installation access token caching by @mariduv in #5324 give git the real base..head range for diff scans by @kvnphvm in #5325 Add GCS source documentation by @kashifkhan0771 in #5319 [PERF] Remove \b anchor from escaped-unicode codePointPat by @Ahsan-Sarbaz in #5320 🐛 fix(engine): map decod…
What's Changed Clarify security policy by @bradlarsen in #5295 Add git source documentation by @kashifkhan0771 in #5326 fix(gitparse): cheaper low-memory git scan, stop losing trailing commits by @kashifkhan0771 in #5331 analyzer/github: include is_fine_grained metadata and make gist enumeration non-fatal by @unsmith in #5332 Full Changelog: v3.97.5...v3.97.6
What's Changed Update module github.com/rabbitmq/amqp091-go to v1.13.0 [SECURITY] by @renovate[bot] in #5274 Update github-actions by @renovate[bot] in #5250 Update dependency golangci/golangci-lint to v2.13.2 by @renovate[bot] in #5251 Make GitHub App installationId optional when scanning all installations by @kashifkhan0771 in #5275 [INT-942] Add HumioAPIToken detector by @unsmith in #5258 Objec…
What's Changed Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @jordanTunstill in #5267 Improve the json-enumerator source by @bradlarsen in #5265 added tests for twilio detector fixes by @jordanTunstill in #5271 Full Changelog: v3.97.3...v3.97.4
What's Changed fix(s3): cut a child context per object so key/size log values don't pile up by @mariduv in #5236 Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @trufflesteeeve in #5269 Full Changelog: v3.97.2...v3.97.3
What's Changed detectors/github/v2: differentiate token type in ExtraData by @hartsock in #5223 Update dependency trufflesecurity/.github to v1.0.4 by @renovate[bot] in #5228 ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @bryanbeverly in #5231 Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @renovate[bot] in #5172 Update github-actions by @renovate[bot] in #5…
What's Changed Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @renovate[bot] in #5196 Fix GHEC with Data Residency (*.ghe.com) base URL by @shahzadhaider1 in #4777 docs: add generic config-secret custom detector example by @pgmpofu in #5195 fix(detectors/docker): don't greedy match in keyPat by @mariduv in #5214 [SCAN-1020] neon scram pgx by @alafiand in #5217 Raised MongoDB de…
What's Changed fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @genisis0x in #5127 Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @renovate[bot] in #5058 Remove url tag from common HTTP client metrics by @mcastorina in #5158 Update github.com/avast/apkparser digest to 7fcaee4 by @renovate[bot] in #5037 [INS-318] Add New Relic License Key Detecto…
What's Changed [INS-355] Added Hashicorp vault token detector by @MuneebUllahKhan222 in #4819 Tighten JiraToken v1 verification by @shahzadhaider1 in #5122 [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @bill-rich in #5123 Fix GitLab project metadata cache and switch to LRU by @kashifkhan0771 in #4727 Log analyze errors for Anthropic Analyzer by @kashifkhan0…
What's Changed feat: add OpenRouter detector by @McPatate in #4500 Integrations fully codeowns detectors by @trufflesteeeve in #5104 [INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778 [INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795 [INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820 [INS-467] Add IPinfo detector to default detectors list…
What's Changed removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in #5068 fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in #5043 Add prometheus metrics for engine channels and workers by @mcastorina in #5095 [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in #5072 [INS-334] Octop…
What's Changed fix(sources/filesystem): order resume comparison by path component by @genisis0x in #5041 test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in #5053 fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in #5029 Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-deck…
What's Changed Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011 fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022 fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968 Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987 fix: avoid termina…
What's Changed [INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915 [INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907 fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958 Added GitLab OAuth Detector by @shahzadhaider1 in #4729 Box Detector: Extract Subject ID for Analyzer Integrat…
What's Changed [INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915 [INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907 fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958 Added GitLab OAuth Detector by @shahzadhaider1 in #4729 Box Detector: Extract Subject ID for Analyzer Integrat…
What's Changed Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it consistent with its Analyzer by @MuneebUllahKhan222 in #4906 Rename AnalysisInfo field to SecretParts on detectors.Result by @mcastorina in #4911 Document SecretParts contract in detector-authoring docs by @mcastorina in #4912 Add a static check for detectors that don't set SecretParts by @mcastorina in #4913 Populate Se…
What's Changed Revert "[INS-397] Fix git version parser panic on non-numeric patch versions" by @trufflesteeeve in #4903 Full Changelog: v3.95.1...v3.95.2