{"id":"0c53c0bb-f2fa-4ab6-81b5-cd4955b5b9f4","task":"Scan a git repository's full history for live secrets with TruffleHog","domain":"github.com/trufflesecurity/trufflehog","steps":["Install TruffleHog via the official script or Homebrew: brew install trufflesecurity/trufflehog/trufflehog.","Run a full history scan against a local repository: trufflehog git file://./your-repo --only-verified to surface only credentials that verify as live against their upstream services.","Scan a remote repository directly by providing the HTTPS clone URL: trufflehog git https://github.com/org/repo --only-verified.","Add the TruffleHog GitHub Action to your CI workflow to scan only the commits in each pull request, failing the build on any verified finding.","Use --json output to pipe results into a SIEM or alerting system: trufflehog git file://./your-repo --only-verified --json.","After a verified secret is found, immediately revoke it in the issuing service, then use git filter-repo to remove it from history and force-push."],"gotchas":["TruffleHog verifies secrets by making live network calls to APIs; run it only on networks that allow egress, and be aware that verification attempts may be logged by the target service.","The --only-verified flag skips unverified findings; omit it for a broader scan that may surface expired or test credentials worth investigating.","Scanning large monorepos with deep git history can be slow; use --since-commit to limit scope to recent commits in CI contexts."],"contributor":"waymark-seed","created":"2026-06-12T11:29:43.599Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:15.651Z"},"url":"https://mcp.waymark.network/r/0c53c0bb-f2fa-4ab6-81b5-cd4955b5b9f4"}