GitHub Release: trufflesecurity/trufflehog v3.98.0 (05.10.2026)

What's Changed

• Int 595 verify asymmetry by @shahzadhaider1 in #5261


• return error body for fetchBearerToken by @jordanTunstill in #5301


• Update module github.com/charmbracelet/bubbletea to v1.3.10 by @renovate[bot] in #5281


• Update github.com/trufflesecurity/ldap-verify digest to 3142cc9 by @renovate[bot] in #5280


• [INT-1086] Don't reuse maps; editing them afterwards edits them for all results by @camgunz in #5351


• [INT-1091] Treat Square 403 as verified on INSUFFICIENT_SCOPES by @MuneebUllahKhan222 in #5367


• feat: add --no-ignore-tag to report secrets on trufflehog:ignore lines by @thiswillnevermatch in #5293


• Fix failing TestGHCRListImages test in CI by @MuneebUllahKhan222 in #5368


• Revert duplicate --no-ignore-tag changes from #5293 by @shahzadhaider1 in #5369


• Show progress inside S3 buckets by @shahzadhaider1 in #5330


• fix(output): escape special characters in --github-actions output by @kenanyararbas in #5353


• fix(detectors): remove stray fmt.Printf in portainertoken by @Gracy769 in #5334


• resolve race condition in result deduplication cache by @kvnphvm in #5359


• added entropy filter and improved verification for gitlab v2/v3 by @jordanTunstill in #5358


• Update Okta domain pat to account for mil and fedramp by @kvnphvm in #5355


• Corpora bench reports clean when a detector produces zero matches on both sides by @kvnphvm in #5357


• Add huggingface source documentation by @kashifkhan0771 in #5373


• Add Gitlab source documentation by @kashifkhan0771 in #5371


• Add Github source documentation by @kashifkhan0771 in #5370


• fix(detectors/auth0oauth): match Auth0 Private Cloud auth0app.com domains by @saghaulor in #5354


• List only the include prefixes in S3 scans by @shahzadhaider1 in #5377


• fix(github): switch back to fetching access token through apiClient, by @mariduv in #5380


• Fix NetSuite detector running out of memory on dense input by @shahzadhaider1 in #5383


• Add Jenkins source documentation by @kashifkhan0771 in #5388


• docs: point five internal links at files that exist by @CalvinTjoaquinn in #5375


• Add pkg/ssrf shared egress guard; use it for WithNoLocalIP and analyzer clients by @bill-rich in #5288

New Contributors

• @thiswillnevermatch made their first contribution in #5293


• @kenanyararbas made their first contribution in #5353


• @Gracy769 made their first contribution in #5334


• @CalvinTjoaquinn made their first contribution in #5375

Full Changelog: v3.97.9...v3.98.0