# secrets/trufflehog-pushed

> Verifies candidate secrets in the pushed commits against the service that issued them.

Verifies candidate secrets in the pushed commits against the service that issued them.

Part of the [`secrets`](/reference/configurations/secrets/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `push` [stage](/start/concepts/#stage), once for pushed history. It runs trufflehog. It needs network access.

## Why

A verified secret still works, so fix that finding first.

## What to do

Rotate the secret at its provider, then rewrite the commit that holds it.

## Example

A committed credential that its provider confirms as active reports a verified secret. Rotate it at the provider, and remove it from history.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore secrets/trufflehog-pushed --paths "<glob>" --reason "<why>"
```