# Install tartufo with Homebrew, Nix Searches through git repositories for high entropy strings and secrets. Version 6.0.0 via Homebrew; verified 2026-05-09. ## Install ```sh sudo av install brew:tartufo ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install tartufo ``` Evidence: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#tartufo ``` Evidence: nixpkgs package indexes: pkgs/by-name/ta/tartufo/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:tartufo - **Package manager:** Homebrew - **Package manager page:** - **Version:** 6.0.0 - **Source summary:** Searches through git repositories for high entropy strings and secrets - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-2.0-only - **Source archive:** - **Last updated:** 2026-05-09T11:00:31Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - tartufo (cli) - tartufo (alias) ## Dependencies - pygit2 - python@3.14 ## Uses from macOS - libffi ## Install behavior - Post-install hook: not defined - Bottle: available on all ## Freshness - Page generated: 2026-07-08 - Package-manager version: 6.0.0 - Package-manager updated: 2026-05-09 - Local data: ok - Upstream repository: https://github.com/godaddy/tartufo - Upstream latest detected: v6.0.0 (current) ## Project history and usage tartufo is a Git secret-scanning CLI from GoDaddy. Its documentation describes scanning repository history and branches for likely secrets using regular expressions and entropy checks, with both local/remote repository scans and pre-commit use. ### Project history The official documentation says tartufo was inspired by and built from Dylan Ayrey's truffleHog project. The public changelog begins with v0.0.1 and v0.0.2 on 2019-10-23, followed by v1.0.x releases in November 2019. The project was substantially reworked for the 2.x line: the changelog describes v2.0.0-era work as a documentation refresh and v2.0.0 alpha as a full restructuring, retesting, rebuilding, and remake that split functionality into subcommands such as pre-commit, scan-local-repo, and scan-remote-repo. ### Adoption history The source facts list tartufo in Homebrew and Nix, while the official quick start documents pip and Docker installation. That combination places it in the common security-tool path of Python package, container image, and package-manager install surfaces. ### How it is used The core CLI use is scanning Git repositories for secrets across history and branches. Official examples show scan-remote-repo, scan-local-repo, and Docker-based scans, and the README notes pre-commit usage for screening changes before commit. Configuration is TOML-based. Official docs show settings under [tool.tartufo], exclusion signatures, include/exclude path patterns, and custom rule patterns. ### Why package nerds care Package maintainers care about tartufo because it operationalizes a common repository hygiene task: finding accidentally committed credentials before publishing or while auditing history. Its truffleHog lineage and pre-commit mode make it part of the broader CLI culture around secret scanning in development workflows. ### Timeline - 2019-10-23: v0.0.1 and v0.0.2 appear in the official project history. - 2019-11-19: v1.0.0/v1.0.2 releases appear in the official project history. - 2020-10-09: v2.0.0 documents a refreshed 2.0 usage model. - 2021-02-04: v2.3.0 switches the primary development branch from master to main. - 2022-01-05: v3.0.0 stable release. - 2023-01-17: v4.0.0 drops deprecated flags and Python 3.6 support while adding Python 3.11 support. ### Related projects - truffleHog is named by the official documentation as the project that inspired tartufo. - BFG appears in tartufo's changelog as a referenced secret-cleanup tool. ### Sources - - - - source_facts.package-manager ## Security Notes No matching local secret-handling manifest was found for tartufo. Nucleus package metadata is still published here so future coverage has a stable package URL. ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: tartufo.toml, pyproject.toml, files specified with --config ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** tartufo - **Version Scheme:** 0 - **Revision:** 2 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - tartufo: normalized package name match | nixpkgs package indexes: pkgs/by-name/ta/tartufo/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Related links - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [python@3.14](https://www.automicvault.com/pkg/brew/python-3-14/) - Runtime dependency declared by Homebrew. - [git-hound](https://www.automicvault.com/pkg/brew/git-hound/) - Shares av.db curated category or tags: cli, git, secret-scanning, security. - [git-secrets](https://www.automicvault.com/pkg/brew/git-secrets/) - Shares av.db curated category or tags: cli, git, secret-scanning, security. - [gitleaks](https://www.automicvault.com/pkg/brew/gitleaks/) - Shares av.db curated category or tags: cli, git, secret-scanning, security. - [squealer](https://www.automicvault.com/pkg/brew/squealer/) - Shares av.db curated category or tags: cli, git, secret-scanning, security. - [detect-secrets](https://www.automicvault.com/pkg/brew/detect-secrets/) - Shares av.db curated category or tags: cli, secret-scanning, security. - [kingfisher](https://www.automicvault.com/pkg/brew/kingfisher/) - Shares av.db curated category or tags: cli, secret-scanning, security. - [mantra](https://www.automicvault.com/pkg/brew/mantra/) - Shares av.db curated category or tags: cli, secret-scanning, security. - [git-crypt](https://www.automicvault.com/pkg/brew/git-crypt/) - Shares av.db curated category or tags: cli, git, secrets, security. ## Combined YAML source View the package source record on GitHub. [combined/tartufo.yml](https://github.com/automic-vault/db/blob/main/combined/tartufo.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph