$ show trufflesecurity/trufflehog
TruffleHog is a comprehensive, actively maintained secret scanning tool written in Go. It detects exposed credentials, API keys, tokens, and other sensitive information across a wide range of sources including Git repositories, cloud storage (S3, GCS), Docker images, CI/CD systems (Jenkins, Travis CI, CircleCI), and many third-party services. The architecture is modular: a core engine orchestrates scanning from various sources, a large library of over 700 detectors (each implementing a standard interface) identifies secrets using regex patterns and Aho-Corasick pre-filtering, and optional HTTP-based verification confirms whether discovered secrets are still valid. The tool also includes a terminal UI (Bubble Tea), a permissions analyzer for deeper credential assessment, and output formats like JSON, SARIF, and GitHub Actions annotations. External dependencies include cloud SDKs, database drivers, and numerous third-party API clients, but the core scanning logic is self-contained and well-structured.
The LLM identified 5 files worth highlighting for reuse:
A generic, thread-safe LRU cache implementation with configurable capacity and eviction callbacks. It is self-contained (only imports standard library) and demonstrates clean separation of concerns, making it reusable in any Go project requiring bounded caching with least-recently-used eviction.
A buffer pool that wraps sync.Pool with a shrink-on-put strategy to reduce memory waste when buffers grow large. It includes metrics for monitoring pool usage. This pattern is valuable for high-throughput systems that frequently allocate and release byte slices, and can be extracted with minimal changes.
Part of a composable decoder chain that handles base64, UTF16, escaped Unicode, and HTML entity decoding. The decoder interface and chaining mechanism allow flexible preprocessing of input data. This pattern is reusable for any pipeline that needs to normalize or transform text before analysis.
An efficient Aho-Corasick string matching engine used for keyword pre-filtering across all detectors. It is implemented as a standalone package with a clean API (build trie, find matches) and demonstrates non-obvious algorithmic skill. Could be extracted as a general-purpose multi-pattern search library.
A simple, self-contained glob pattern matcher supporting wildcards and character classes. It is used internally for path filtering but is generic enough to be reused in any Go project requiring file pattern matching without external dependencies.