Hugging Face partners with TruffleHog to Scan for Secrets

We're excited to announce our partnership and integration with Truffle Security, bringing TruffleHog's powerful secret scanning features to our platform as part of our ongoing commitment to security.

TruffleHog is an open-source tool that detects and verifies secret leaks in code. With a wide range of detectors for popular SaaS and cloud providers, it scans files and repositories for sensitive information like credentials, tokens, and encryption keys.

Accidentally committing secrets to code repositories can have serious consequences. By scanning repositories for secrets, TruffleHog helps developers catch and remove this sensitive information before it becomes a problem, protecting data and preventing costly security incidents.

To combat secret leakage in public and private repositories, we worked with the TruffleHog team on two different initiatives: Enhancing our automated scanning pipeline with TruffleHog Creating a native Hugging Face scanner in TruffleHog

Enhancing our automated scanning pipeline with TruffleHog

At Hugging Face, we are committed to protecting our users' sensitive information. This is why we've implemented an automated security scanning pipeline that scans all repos and commits. We have extended our automated scanning pipeline to include TruffleHog, which means there are now three types of scans:

• malware scanning: scans for known malware signatures with ClamAV
• pickle scanning: scans pickle files for malicious executable code with picklescan
• secret scanning: scans for passwords, tokens and API keys with TruffleHog

We run the trufflehog filesystem command on every new or modified file on each push to a repository, scanning for potential secrets. If and when a verified secret is detected, we notify the user via email, empowering them to take corrective action.

We will eventually migrate to the trufflehog huggingface command, the native Hugging Face scanner, once support for LFS lands.