PApacketized·Aug 6, 2018
Looks nifty, but I'd ask: why use this over Trufflehog?
https://github.com/dxa4481/truffleHog
In CLI tool that finds secrets accidentally committed to a Git repo (2017)trufflesecurity
trufflehog
Go2017–2026
trufflesecurity / trufflehog
trufflehog
Find, verify, and analyze leaked credentials
28Distinct people
29Mentions
0Explicit recommenders
29.3KGitHub stars
What to know before exploring
What it is
Find, verify, and analyze leaked credentials
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- awslabs/git-secrets · linked in 4 of the same discussions
- michenriksen/gitrob · linked in 3 of the same discussions
- eth0izzle/shhgit · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 6:59:22 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year29 dated mentions
Observed mentions: 2017-01-02 14:34:05 UTC to 2026-03-26 20:36:43 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 6 | 1 | 5 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
3 sourcesAgreed ... use a pre-commit hook to scan your repository for high-entropy strings before they are forever enshrined in your history (https://github.com/dxa4481/truffleHog).
In A Hacker Has Wiped a Spyware Company’s ServersNice start. I notice this only scans the HEAD of the repository. Have you considered implementing functionality to go back through previous commits and check for secrets in files there? After all, once something is committed to git, even if you change the file, the old version is still there (by design, obviously).
For a more complex implementation of a solution to this problem, checkout trufflehog [0], which "searches through git repositories for high entropy strings and secrets, digging deep into commit history."
[0] https://github.com/dxa4481/truffleHog
In Show HN: Sniffgit – A Python lib to find sensitive files and information in a repo