## TL;DR

Trufflehog labels a finding unverified when it looks like a secret but the scanner could not confirm it is live. Treat it as guilty until proven otherwise: check what the value is used for, rotate it if it grants any access, and only then mark it a false positive.

## Error

```text
"trufflehog found unverified secret" in git history
```

## Steps

1. Re-run the scan scoped to the flagged commit with JSON output: `trufflehog git file://[repo path] --json`. Expected: findings with detector name, file, commit, and redacted secret.
2. Identify what the value is: a real credential has a matching service (it appears in app config, CI, or docs for a real integration); a fixture appears only in tests or examples. Expected: a verdict of real or fixture for each finding.
3. If real, revoke and rotate it at the provider now, then remove it from history. Expected: the value in history is dead even if someone reads the old commit.
4. If a fixture, add it to the trufflehog allowlist or mark the detector to skip that path. Expected: future scans stay clean.
5. Re-run the full scan to confirm zero remaining findings. Expected: clean output.

## When to use

- Trufflehog reports secrets in current or historical commits.
- You need a triage workflow for unverified findings specifically.

## When not to use

- Findings trufflehog marks verified (rotate first, ask questions later).
- Real-time pre-commit blocking (use gitleaks protect for that).

## Tool compatibility

- Trufflehog v3; git history scans, filesystem scans, and CI integrations.

## Variant phrasings

### trufflehog found secrets in git history

Same triage; unverified just means unconfirmed, not safe.

### trufflehog verified secret found

Skip triage and rotate immediately.

## Why it happens

Old commits predate secret scanning, so credentials committed years ago surface now. Unverified means the detector pattern matched but the live check failed or was skipped.

## Edge cases

- History rewrites do not purge copies others already cloned; rotation is the real fix, history cleanup is hygiene.
- Detectors improve over time, so a clean scan last year can flag findings this year; that is the scanner getting better, not a new leak.
- Forks keep the old history; rotate even if you clean your own repo.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_QZi47hTZfliUlNHenPef5Q