Hugging Face and TruffleHog Partnership for Secret Scanning

Hugging Face has partnered with Truffle Security to integrate TruffleHog, an open-source secret scanning tool, into its platform. This partnership aims to prevent the accidental leakage of sensitive information such as credentials, tokens, and encryption keys in public and private repositories.

Automated Security Scanning Pipeline

Hugging Face has extended its automated security scanning pipeline to include TruffleHog for secret scanning. The platform now employs three distinct types of scans on all repositories and commits:

  • Malware Scanning: Utilizes ClamAV to detect known malware signatures.
  • Pickle Scanning: Uses picklescan to identify malicious executable code within pickle files.
  • Pickle Scanning: Uses picklescan to identify malicious executable code within pickle files.
  • Secret Scanning: Employs TruffleHog to run the trufflehog filesystem command on every new or modified file upon each push to a repository.

When a verified secret—defined as a secret confirmed to work for authentication against its provider—is detected, Hugging Face notifies the user via email. The company notes that unverified secrets may still pose a threat, as verification can fail due to technical reasons like provider downtime.

Native Hugging Face Scanner in TruffleHog

TruffleHog now includes a native integration for Hugging Face, allowing users and security teams to proactively scan their own account data. This integration can scan models, datasets, and Spaces, as well as relevant Pull Requests (PRs) and Discussions.

Scanning Capabilities and Limitations

While the native scanner can target specific users, organizations, or individual models, datasets, and Spaces, it currently does not scan files stored in Large File Storage (LFS). Support for LFS is being developed by the TruffleHog team.

Usage Commands

Users can scan their account data using the following commands:

  • User-level scan: trufflehog huggingface --user <username>
  • Organization-level scan: trufflehog huggingface --org <orgname>
  • Organization and User scan: trufflehog huggingface --user <username> --org <orgname>
  • Targeted scans: Specific flags such as --model <model_id>, --dataset <dataset_id>, or --space <space_id> can be used for scan specific assets.

Optional flags --include-discussions and --include-prs can be included to scan Hugging Face discussion and PR comments.

Authentication can be handled via the --token flag or by setting the HUGGINGFACE_TOKEN environment variable.

Sources