Join us

ContentUpdates and recent posts about TruffleHog..
 Activity
@ravikyada started using tool Kubernetes , 2 weeks, 1 day ago.
 Activity
@ravikyada started using tool Jenkins , 2 weeks, 1 day ago.
 Activity
@ravikyada started using tool Grafana , 2 weeks, 1 day ago.
 Activity
@ravikyada started using tool Docker , 2 weeks, 1 day ago.
 Activity
@ravikyada started using tool Amazon Web Services , 2 weeks, 1 day ago.
Link
@varbear shared a link, 2 weeks, 3 days ago
FAUN.dev()

Why are top university websites serving p0rn? It comes down to shoddy housekeeping.

Researcher Alex Shakhov found scammers commandeering staleCNAMErecords. They hijack university subdomains (eg.berkeley.edu,columbia.edu,washu.edu) and serve p0rn and scam pages. Shakhov found hundreds of abused subdomains across at least34universities. He counted thousands of hijacked pages indexed .. read more  

Why are top university websites serving p0rn? It comes down to shoddy housekeeping.
Link
@varbear shared a link, 2 weeks, 3 days ago
FAUN.dev()

PostgreSQL MVCC, Byte by Byte

PostgreSQL's MVCC stores two 32-bit XIDs per tuple -xminandxmax. The transaction snapshot decides visibility per tuple. Updates append new tuples and mark the old withxmax.VACUUMreclaims versions only when no active snapshot can see them. Long-runningREPEATABLE READsnapshots pin versions and cause b.. read more  

PostgreSQL MVCC, Byte by Byte
Link
@varbear shared a link, 2 weeks, 3 days ago
FAUN.dev()

I Decompiled the White House's New App

A React Native app built withExpo SDK 54runsHermes. It talks to a WordPress REST backend and bundles a 5.5MB Hermes bytecode.Its WebView injects JavaScript to strip cookies, GDPR prompts, and paywall dialogs. The build includes OneSignal's fused-location pipeline, polling at 4.5 and 9.5 minutes and.. read more  

I Decompiled the White House's New App
Link
@varbear shared a link, 2 weeks, 3 days ago
FAUN.dev()

The AWS Lambda 'Kiss of Death'

A Galera writer node froze afterInnoDBundo history ballooned. PooledAWS Lambdaconnections left transactions open and pinned MVCC read views. The team killed stalled sessions, enabledinnodb_undo_log_truncate, and cappedinnodb_max_undo_log_size. They also set sessiontransaction_isolation=READ-COMMITTE.. read more  

The AWS Lambda 'Kiss of Death'
Link
@varbear shared a link, 2 weeks, 3 days ago
FAUN.dev()

How The Heck Does Shazam Work? (An Interactive Exploration)

A phone captures audio and runs aFast Fourier Transform (FFT)on short windows. It builds aspectrogramand extractspeaks. Nearby peak pairs form compacthashes(two frequencies + time delta). Aninverted indexmaps those hashes to songs, and timing validates matches. Most services run lookups onserversaga.. read more  

How The Heck Does Shazam Work? (An Interactive Exploration)
TruffleHog is a high-accuracy secret-detection tool designed to uncover exposed credentials such as API keys, tokens, private keys, and cloud secrets across large codebases. Originally created to scan Git commit history, it has evolved into a multi-source scanning engine capable of analyzing GitHub, GitLab, Bitbucket, Docker images, file systems, Terraform states, and cloud environments.

The scanner combines entropy detection, an extensive library of regular expression detectors, and live credential validation to minimize false positives. TruffleHog is widely used in security research, supply chain security, DevSecOps workflows, and bug bounty programs. Its speed, accuracy, and broad ecosystem coverage make it a core tool for identifying and preventing credential leakage in modern software development.