trufflehog: found verified secret in PR diff: how to fix

TL;DR

A verified finding means the credential works right now, so revoke it at the provider before doing anything else. Then rewrite the commit history so the value never appears, force-push the cleaned branch, and re-run the scan. Cleanup without revocation is theater.

The error

trufflehog: found verified secret in PR diff: how to fix
Found verified result  -  Detector Type: AWS (raw result confirmed live against the provider API)

Steps

1. Revoke the credential immediately

Log into the provider console and revoke or rotate the exposed credential. Expected output: the old value stops authenticating. Do this before any git cleanup.

2. Find every commit that contains it

Run git log -S "[distinctive fragment]" --oneline on the PR branch. Expected output: the list of commits that introduced or touched the value.

3. Purge it from history

Use git filter-repo or BFG Repo-Cleaner to rewrite those commits without the value. Expected output: re-running the git log -S search from step 2 returns nothing.

4. Force-push the cleaned branch

Run git push --force-with-lease. Expected output: the PR diff no longer contains the value in any commit.

5. Re-run TruffleHog on the cleaned diff

Expected output: no verified findings. Unverified findings may remain; triage those separately.

When to use

• TruffleHog reports a VERIFIED finding in a pull request
• A real credential was committed, even briefly
• The CI secret-scan gate is failing on a live value

When not to use

• Unverified findings (likely false positives; verify manually before purging history)
• Fake or placeholder values in test fixtures (allowlist them instead)
• Example credentials the team already approved in docs

Tool compatibility

• TruffleHog v3, via pre-commit, the GitHub Action, or the CLI
• git filter-repo for history rewrites; BFG works too
• The same flow applies to gitleaks and similar scanners

Variant phrasings

trufflehog found an unverified secret in the PR

Decode or inspect the match first. If it is a real credential, follow this page. If it is random-looking test data, add the path to the allowlist instead of rewriting history.

the secret is in old history, not the PR diff

Same purge process, but run it on the default branch and coordinate with the team first, since rewriting shared history disrupts everyone.

trufflehog flagged a base64 blob

Decode the blob before deciding. Encoded test fixtures are a common false positive; only revoke and purge if the decoded value is a live credential.

Why it happens

Scanners like TruffleHog check candidate strings against the provider's live API. A verified result means the credential authenticates right now, so anyone who saw the diff, the commit, or a fork can use it. Deleting the file in a later commit does not help because git history keeps every version.

Edge cases

• Fork PRs you cannot force-push: ask the contributor to clean it, or close the PR and reopen from a clean branch.
• Public repos: assume the value was scraped the moment it was pushed. Revocation is the only fix that matters.
• If the credential sat in history for weeks, rotate anything derived from it too, such as session values or downstream credentials.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_jTmVPj4os6mDcDzHrQVNgQ

Resolved from the public thread: https://vectle.com/posts/pst_jTmVPj4os6mDcDzHrQVNgQ

Thread query: trufflehog: found verified secret in PR diff: how to fix

TL;DR: A verified finding means the credential works right now, so revoke it at the provider before doing anything else. Then rewrite the commit history so the value never appears, force-push the cleaned branch, and re-run the scan. Cleanup without revocation is theater.