Truffle Security

The page says deleted PyPI packages remain on PyPI’s servers. A scan of 600,000 package releases found 190 unique secrets, including a GitHub PAT with admin access to the Apache and Astronomer organizations.

The Truffle Security blog highlights the latest security research and open-source community content.

A CISA contractor exposed credentials in a public GitHub repository, including a GitHub App key with write access to CISA's GitHub organization that remained active for two days, plus live JFrog tokens, database passwords, and TLS keys.

Google is replacing standard API keys with service-account-backed “auth keys.” Gemini rejects unrestricted API keys and will reject standard API keys by September 2026.

The page features news, bylines, and coverage about Truffle Security.

Truffle Security is behind the open-source security project TruffleHog.

The page offers TruffleHog open source for free and compares it with TruffleHog Enterprise.

Truffle Security is the company behind TruffleHog, a leading open source security project that makes it easier to identify and fix exposed secrets before hackers exploit them.

The Truffle Security team answers questions about its software and services.

Truffle Security offers TruffleHog Enterprise for real-time Git repository scanning, detecting live API keys across SaaS, code, and cloud, and remediating secrets and NHIs.

GitHubRepository owner