TruffleHog

TruffleHog finds API keys, passwords and other secrets in Git history,
local files and cloud services. It can verify detected credentials and
report results as text, JSON or SARIF.

Run trufflehog for the interactive terminal interface, or scan a project:

trufflehog filesystem ~/projects/my-project --no-verification

trufflehog git file://$HOME/projects/my-project --no-verification

Files must be in accessible home directories. For removable storage:

sudo snap connect trufflehog:removable-media

Credential verification contacts the corresponding services unless
--no-verification is set. Application updates are managed by snapd.