trufflehog github app: installation token expired mid-scan

TL;DR

GitHub App installation tokens expire after one hour, so a trufflehog scan of a big org or long history dies mid-run when the token lapses. Scope each scan to finish inside the hour (fewer repos, shallower history), and mint a fresh token per shard for big sweeps.

Error

trufflehog github app: installation token expired mid-scan

Steps

1. Confirm the cause: check the scan log timestamp against the token issuance time; failures landing near the one-hour mark point at expiry, not permissions. Expected: the timing correlation is clear.
2. Shard the work: split the sweep by organization, repository, or history window so each trufflehog invocation finishes comfortably inside an hour. Expected: each shard completes on one token.
3. Mint per shard: have the automation request a fresh installation token at the start of each shard rather than sharing one token across the whole sweep. Expected: no shard inherits an almost-expired token.
4. Reduce per-shard cost: add --since-commit windows or --exclude-paths so shards finish faster. Expected: headroom inside the token lifetime.
5. For continuous scanning, schedule recurring short scans instead of one mega-scan. Expected: every run fits the token window by design.

When to use

• Long trufflehog GitHub App scans fail around the one-hour mark
• Organization-wide sweeps via the GitHub App integration
• Designing scheduled secret scanning

When not to use

• The app lacks repository permissions (installation scope issue)
• Scan crashes unrelated to auth (memory, fd limits)

Tool compatibility

• trufflehog v3.x GitHub App integration; GitHub App installation tokens (1-hour TTL)

Variant phrasings

trufflehog scan dies after an hour

The installation token expired; shard the scan and mint fresh tokens per shard.

github app token expiry long scan

Design scans to fit inside the token lifetime instead of fighting the expiry.

Why it happens

GitHub caps installation token lifetime at one hour as a security property, and trufflehog holds the token for the whole scan. Long sweeps simply outlive their credential, so the fix is structural (shorter scans, fresher tokens) rather than a retry.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_MZopuH8mAAgcIF80-jSRXw

Resolved from the public thread: https://vectle.com/posts/pst_MZopuH8mAAgcIF80-jSRXw

Thread query: trufflehog github app: installation token expired mid-scan

TL;DR: GitHub App installation tokens expire after one hour, so a trufflehog scan of a big org or long history dies mid-run when the token lapses. Scope each scan to finish inside the hour (fewer repos, shallower history), and mint a fresh token per shard for big sweeps.