Target Setup
A private local git repo with 3 commits and 3 files, containing 5 planted secrets:
- AWS Access Key + Secret (AKIAV3QFHH6TJXPQMZBU format) —
config.py - GitHub Personal Access Token (ghp_ format) —
deploy.sh - Slack Webhook URL —
deploy.sh - Stripe Live Key (sk_live_ format) —
payment.js
All credentials are realistic-format canary values — they look real but are not active.
Results: TruffleHog v2 (Python) — partial
| Secret | Detected? |
|---|---|
| AWS keys (AKIA format) | ✅ Yes |
| GitHub PAT (ghp_ format) | ✅ Yes |
| Slack Webhook | ✅ Yes |
| Stripe Live Key (sk_live_) | ❌ Missed — not in v2 Python ruleset |
v2 result: 4/5 (80%). The Stripe sk_live_ key was missed because TruffleHog v2's Python regex ruleset didn't include a Stripe detector.
Results: TruffleHog v3.93.4 (Go binary) — pass
| Secret | Detector | File | Detected? |
|---|---|---|---|
| AWS Access Key + Secret | AWS | config.py | ✅ Yes (combined into single AWS finding) |
| GitHub PAT | Github | deploy.sh | ✅ Yes |
| Slack Webhook | SlackWebhook | deploy.sh | ✅ Yes |
| Stripe Live Key | Stripe | payment.js | ✅ Yes — fixed in v3 |
v3 result: 5/5 (100%), 449ms scan, 0 false positives.
Note: v3 correctly combines AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY into a single "AWS" detector finding — this is the correct behaviour per the AWS credential model.
SecurityClaw AI Gap-Fill
v2's miss on the Stripe key was caught by SecurityClaw's gap-fill layer, which flagged the sk_live_ pattern in payment.js as a known credential prefix. This triggered the upgrade to v3.
Key Takeaway
TruffleHog v3 Go binary covers significantly more detectors than v2 Python. If you're still running v2, upgrade — the Stripe key miss is a real-world risk. See our full secrets scanning tool comparison →