Rooting For Secrets with TruffleHog

This document is a practical guide to using TruffleHog for detecting exposed secrets across source control, CI, cloud assets, and filesystems, detailing installation options, key sub-commands and flags (notably `--json` and `--only-verified`), and how to parse results with `jq` for actionable output; it also demonstrates a real-world example of a web application leaking CI/CD tokens (e.g., GitHub and AWS) via a JavaScript file and recommends remediation including removing secrets, rewriting history to purge them, and integrating routine secret scanning into CI/CD.