trufflehog --exclude-paths and Detector Filters
trufflehog --exclude-paths takes a file of path patterns to skip, and --include-detectors / --exclude-detectors limit which credential types are checked.
Big repos and vendored code make trufflehog slow and noisy. Excluding paths and narrowing the detector set keeps scans fast and the signal high.
What it does
--exclude-paths reads a newline-delimited file of regex path patterns to skip. --include-detectors and --exclude-detectors take a comma-separated list of detector names (or "all") so you can scan only for, say, AWS and GCP keys, or skip a chatty detector.
Common usage
# exclude-paths file (one regex per line)
printf 'node_modules/\nvendor/\n.*_test\.go\n' > th-exclude.txt
trufflehog filesystem . \
--exclude-paths th-exclude.txt \
--exclude-detectors=generic \
--only-verified --failOptions
| Flag | What it does |
|---|---|
| --exclude-paths <file> | File of regex path patterns to skip |
| --include-paths <file> | Only scan paths matching these patterns |
| --include-detectors <list> | Run only these detectors (default "all") |
| --exclude-detectors <list> | Skip these detectors, e.g. generic |
| --only-verified | Combine with filters to keep noise low |
In CI
The "generic" detector is the usual source of false positives; excluding it with --exclude-detectors=generic plus --only-verified gives a quiet, high-confidence gate. Keep the exclude file in the repo so the scan is reproducible across runners.
Common errors in CI
"error parsing exclude paths file" means a bad regex line; each line is a Go regexp, so escape dots. "invalid detector ... not found" on --exclude-detectors means a misspelled name; list names with trufflehog --help or the docs. Excluding too much (a broad pattern) silently hides real findings, so review the exclude file in PRs.