Package: tartufo
tartufosearches through git repositories for secrets, digging deep into
commit history and branches. This is effective at finding secrets accidentally
committed.tartufoalso can be used by git pre-commit scripts to screen
changes for secrets before they are committed to the repository.This tool will go through the entire commit history of each branch, and check
each diff from each commit, and check for secrets. This is both by regex and by
entropy. For entropy checks, tartufo will evaluate the shannon entropy for both
the base64 char set and hexidecimal char set for every blob of text greater
than 20 characters comprised of those character sets in each diff. If at any
point a high entropy string > 20 characters is detected, it will print to the
screen.ExampleDocumentationOur main documentation site is hosted by Read The Docs, athttps://tartufo.readthedocs.io.UsageUsage:tartufo[OPTIONS]COMMAND[ARGS]...Findsecretshiddeninthedepthsofgit.Tartufowill,bydefault,scantheentirehistoryofagitrepositoryforanytextwhichlookslikeasecret,password,credential,etc.Itcanalsobemadetoworkinpre-commitmode,forscanningblobsoftextasapre-commithook.

Options:--default-regexes/--no-default-regexesWhethertoincludethedefaultregexlistwhenconfiguringsearchpatterns.Onlyapplicableif--rulesisalsospecified.[default:default-regexes]--entropy/--no-entropyEnableentropychecks.[default:entropy]--regex/--no-regexEnablehighsignalregexeschecks.[default:regex]--scan-filenames/--no-scan-filenamesCheckthenamesoffilesbeingscannedaswellastheircontents.[default:scan-filenames]-of,--output-format[json|compact|text|report]Specifytheformatinwhichtheoutputneedstobegenerated`--output-formatjson/compact/text/report`.Either`json`,`compact`,`text`or`report`canbespecified.Ifnotprovided(default)theoutputwillbegeneratedin`text`format.-od,--output-dirDIRECTORYIfspecified,allissueswillbewrittenoutasindividualJSONfilestoauniquelynameddirectoryunderthisone.Thiswillhelpwithkeepingtheresultsofindividualrunsoftartufoseparated.-td,--temp-dirDIRECTORYIfspecified,temporaryfileswillbewrittentothespecifiedpath--buffer-sizeINTEGERMaximumnumberofissuetobufferinmemorybeforeshiftingtotemporaryfilebuffering[default:10000]--git-rules-repoTEXTAfilepath,orgitURL,pointingtoagitrepositorycontainingregexrulestobeusedforscanning.Bydefault,all.jsonfileswillbeloadedfromtherootofthatrepository.--git-rules-filescanbeusedtooverridethisbehaviorandloadspecificfiles.--git-rules-filesTEXTUsedinconjunctionwith--git-rules-repo,specifyglob-stylepatternsforfilesfromwhichtoloadtheregexrules.Canbespecifiedmultipletimes.--configFILEReadconfigurationfromspecifiedfile.[default:tartufo.toml]--target-config/--no-target-configEnableorDisableprocessingoftheconfigfileintherepositoryorfolderbeingscannedi.e.configfilesliketartufo.tomlorpyproject.toml[default:target-config]-q,--quiet/--no-quietQuietmode.Nooutputsarereportedifthescanissuccessfulanddoesn't find anyissues-v, --verbose                   Display more verbose output. Specifying thisoption multiple times will incrementallyincrease the amount of output.--log-timestamps / --no-log-timestampsEnable or disable timestamps in loggingmessages.  [default: log-timestamps]--entropy-sensitivity INTEGER RANGEModify entropy detection sensitivity. Thisis expressed as on a scale of 0 to 100,where 0 means "totally nonrandom" and 100means "totally random". Decreasing thescanner'ssensitivityincreasesthelikelihoodthatagivenstringwillbeidentifiedassuspicious.[default:75;0<=x<=100]--color/--no-colorEnableordisableterminalcolor.Ifnotprovided(default),enabledifoutputisaterminal(TTY).-V,--versionShowtheversionandexit.-h,--helpShowthismessageandexit.

Commands:pre-commitScanstagedchangesinapre-commithook.scan-remote-repoAutomaticallycloneandscanaremotegitrepository.scan-folderScanafolder.scan-local-repoScanarepositoryalreadyclonedtoyourlocalsystem.ContributingAll contributors and contributions are welcome! Please seeour contributing
docsfor more information.AttributionsThis project was inspired by and built off of the work done by Dylan Ayrey on
thetruffleHogproject.