secrets/trufflehog-pushed
Verifies candidate secrets in the pushed commits against the service that issued them.
Part of the secrets configuration, at the recommended level. It runs at the push stage, once for pushed history. It runs trufflehog. It needs network access.
A verified secret still works, so fix that finding first.
What to do
Section titled “What to do”Rotate the secret at its provider, then rewrite the commit that holds it.
Example
Section titled “Example”A committed credential that its provider confirms as active reports a verified secret. Rotate it at the provider, and remove it from history.
Turn it off
Section titled “Turn it off”Turn it off for some files, with a reason:
gspot ignore secrets/trufflehog-pushed --paths "<glob>" --reason "<why>"