Verification · Static analysis · Secret scanning
Live verification
Test whether a found credential is still valid to prioritise rotation.
How to build it
- Run trufflehog with verification enabled on the findings from a history scan.
- Mark each finding as live or inactive in the triage record.
- Rotate live credentials first and close inactive findings with a note.
Signals in a repository
- A trufflehog CI step that runs with verification enabled.
- A triage log that marks each finding live or inactive.
- Rotation tickets ordered by verified status.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.