Trufflehog-PingPwn

About

Trufflehog-PingPwn scans web pages and referenced resources for common secret patterns (API keys, tokens, private keys, webhook URLs) so you can identify accidental exposures quickly. Scanning and detection are performed entirely in your browser; this extension does not send findings to any remote server. Use the popup to review findings, clear them, or download a CSV of results. This extension tries to brings the scanning & Detection capabilities of well known Trufflehog to browser in real time scanning.

Key features:
- Detects generic API keys, specific provider tokens, and common secret formats.
- Optionally checks for `.env` files and `.git` directories (may trigger server protections).
- Shows per-origin findings with a badge count and in-popup listing.
- Local-only storage of findings using the browser's storage; no remote transmission.

Core Detection Features:
- Detects API keys, tokens, private keys, and webhook URLs on web pages
- Scans referenced resources (external scripts, .env files, .git directories)
- Recognizes patterns from 30+ secret providers.
- Supports generic secret patterns (API keys, database credentials, passwords)
- Base64-encoded secret detection with automatic decoding
- Real-time scanning as you browse

UI & User Experience:
- Clean, intuitive popup interface with toggle controls
- Badge count on toolbar showing findings per origin
- Per-origin findings list with detailed match information
- One-click clearing of findings (current origin or all)
- CSV export for audit trails and compliance reporting
- Origin-based filtering and deny list to skip specific domains
- Local notification alerts for critical findings (e.g., .git directories)
- Customizable detection rule toggles (turn on/off specific categories)

Privacy statement:
All scanning and analysis occurs locally inside the browser. No findings, page contents, or extracted secrets are transmitted to external servers. The extension uses `chrome.storage.sync` to store settings and detected findings on your browser; you can clear stored findings via the popup.

Developer contact:
[email protected]

Keywords: secrets, security, trufflehog, scan, credentials, api-keys, bugbounty, security, scanning, bug-bounty, developer-tools, exposure-detection, penetration-testing