trufflesecurity/trufflehog

user (instead of org) with token is not working

Open

#4,517 opened on Oct 26, 2025

View on GitHub
 (3 comments) (1 reaction) (1 assignee)Go (2,397 forks)batch import
help wantedneeds-reconciliationpkg/sources

Repository metrics

Stars
 (26,285 stars)
PR merge metrics
 (Avg merge 28d 2h) (41 merged PRs in 30d)

Description

TruffleHog Version

trufflehog 3.90.11

Expected Behavior

Considering this checks an user's repositories:

trufflehog github --org $user

And this checks an organization's repositories:

trufflehog github --org $org --token $GITHUB_TOKEN

This also should check an user's repositories, but now using a token:

trufflehog github --org $user --token $GITHUB_TOKEN

Actual Behavior

When a user is passed to --org and --token is specified, the repositories of the token's owner are being analyzed (instead of the specified user).

Steps to Reproduce

  1. Run the following command using a user instead of an organization:
trufflehog github --org $user --token $GITHUB_TOKEN
  1. Notice that the specified user' repositories will not be checked.

Potential Solution

I have a suggestion that worked here:

  1. Go to the function getReposByOrgOrUser inside pkg/sources/github/repo.go;
  2. Remove the parameter authenticated, and pass false to the function getReposByUser();
  3. Inside pkg/sources/github/github.go, update all the references that call getReposByOrgOrUser, removing the boolean parameter.

I did not create a PR because I feel this solution may have collateral effects that I cannot understand now, having a very superficial context of the code.

Contributor guide