Credential exposure scanner

A small wrapper around TruffleHog that answers one question fast, during an investigation: is this credential I just found still active?

Analysts run into API keys, tokens, and service account files embedded in config files, log dumps, memory captures, or email attachments. A revoked key is noise. An active key is an open door — and knowing which one you have changes what you do next. This tool gets you that answer in under 60 seconds instead of manually testing the credential by hand.

What it checks

Prefix / type	Credential	Extra input needed
AKIA...	AWS permanent IAM key	Access key ID + secret
ASIA...	AWS temporary STS credential	Access key ID + secret + session token
ghp_...	GitHub personal access token	Token only
.json	GCP service account key	Path to the key file

How it works

1. You tell the script which credential type you have.
2. It reads the secret (hidden input — nothing is echoed to the terminal).
3. It hands the credential to TruffleHog's verifier and checks whether the provider confirms it's live.
4. It prints a clean, human-readable result instead of raw JSON — including the account identity behind the key, so you know exactly what to revoke.

Reading the result

Credential is active (Verified: true)

1. Screenshot or save the output for evidence.
2. Note the account identifier (username / client email / ARN).
3. Escalate and begin containment — revoke the key in the relevant console.
4. Record the finding in your incident ticket.

Credential is dead (Verified: false / no output) Already revoked or expired — document it and move on. No containment action needed.

Setup

# Install TruffleHog
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin

# AWS CLI is only needed if you're verifying AWS keys
curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
sudo installer -pkg AWSCLIV2.pkg -target /

chmod +x verify-key.sh

Usage

./verify-key.sh

[*] Key type? [aws / github / gcp]

Follow the prompts for the credential type you have. Secret input is never echoed to the terminal.

A note on handling live secrets

• Verified GCP service account keys can print sensitive key material to the terminal — the script clears the working temp file immediately after use, and you should clear your terminal history (history -c) afterward too.
• Never paste raw verification output into chat or email. Only the account identifier and verification status belong in a ticket.
• ASIA (temporary) credentials are short-lived, typically 1–12 hours — a "no output" result on one of these often just means the session already expired, not that the key is safe.

Disclaimer

This is a personal project built to demonstrate a credential-triage workflow used during incident response. It is not affiliated with, and contains no code, data, or configuration from, any employer.