Truffle Security cloned every public dataset on Hugging Face — 7.6 petabytes across 186.9 million files — and ran it through TruffleHog. They came back with 221,303 live, working credentials sitting in 6,003 datasets. Scanning Hugging Face datasets for secrets doesn't require their infrastructure, though; the same open-source tool they used is free, and pointing it at your own account takes a few minutes.
Short answer: Scanning Hugging Face datasets for secrets means running TruffleHog, the open-source tool Truffle Security used to find 221,303 live credentials across 7.6 petabytes of public data, against your own account with
trufflehog huggingface --user <name>. It's free, checks models, datasets, and Spaces, and flags only credentials it verifies as still live.
Last updated August 2, 2026.
The numbers in Truffle Security’s June 2026 report are what make this worth doing rather than skipping: 349 live GitHub tokens, 8,557 live GCP service-account keys, 8,594 working database logins, and 11,496 AI provider keys from OpenAI, Anthropic, Gemini, and others, all sitting in public datasets that anyone could clone. One credential alone exposed 393 GB of personal data covering roughly 3.7% of the world's population. Hugging Face's CTO worked directly with Truffle Security on the disclosure and contributed native storage-bucket scanning support to the tool. In my testing, the same trufflehog huggingface command they used for that entire crawl works just as well aimed at a single account, dataset, or model — this guide walks through running it yourself.
What you'll need
A terminal on macOS, Linux, or WSL on Windows. TruffleHog itself, which installs via Homebrew, a shell script, Docker, or a Go build — I used the Homebrew route and had a working binary in under a minute. A free Hugging Face account is enough to scan any public repo; grab an access token from your account settings only if you want to scan your own private datasets and models or avoid rate limits on a big account. Budget a little patience for large repos: TruffleHog has to pull and read actual file contents, so a multi-gigabyte Parquet file takes real minutes, not seconds.
Step-by-step: scanning Hugging Face datasets for secrets
1. Install TruffleHog
On macOS or Linux with Homebrew, brew install trufflehog is the fastest path. If you'd rather skip a local install, Docker works the same way: docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest huggingface --user <username>. When I ran the Homebrew install, there was no separate database to configure and no extra setup step before the first scan.
2. Grab a Hugging Face token (optional)
Public repos scan without one. A token from your Hugging Face settings page lets TruffleHog authenticate as you, which raises your API rate limit and reaches your own private repos. Pass it with --token <hf_token>, or export it once as HUGGINGFACE_TOKEN so you don't retype it every run.
3. Scan your own account first
Run trufflehog huggingface --user <your-username> to check every model, dataset, and Space you've published. Add --org <org-name> if you publish under an organization too. This is the command closest to what actually created most of the 221,303 credentials Truffle Security found — someone hard-coding a key into a notebook or config file, then pushing it.
4. Scan one dataset, model, or Space before you trust it
Vetting something before importing it for a fine-tuning job or a demo? Point TruffleHog at it directly: trufflehog huggingface --dataset <owner/dataset-name>, swapping in --model or --space for the other repo types. This is the closer match to what Truffle Security ran at scale, just aimed at one repo instead of roughly 815,000.
5. Read verified versus unverified in the output
TruffleHog tags every hit as verified or unverified. Verified means it made a live authentication call against the actual provider — GitHub, AWS, OpenAI, whichever — and the credential worked at scan time; that's the number behind Truffle Security's 221,303 figure. Unverified means the string matches a known secret pattern, but the live check failed or wasn't possible. Treat unverified as "check by hand," not "ignore."
6. Rotate anything that comes back verified
A verified result is live right now. Revoke or rotate it at the source — your GitHub token settings, your cloud console, your AI provider's key page — before you do anything else, including finishing the rest of a long scan output.
Example commands you can copy
These cover the situations that come up most:
- Your whole account:
trufflehog huggingface --user yourname - Account plus an org:
trufflehog huggingface --user yourname --org yourcompany - One dataset, before you import it:
trufflehog huggingface --dataset someorg/some-dataset - Datasets only, skip models and Spaces:
trufflehog huggingface --user yourname --skip-all-models --skip-all-spaces - Include discussion threads and PR comments — people sometimes paste a key into a support thread by accident:
trufflehog huggingface --user yourname --include-discussions --include-prs - No local install, via Docker:
docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest huggingface --user yourname
Start with command 1. It's the one that would have caught most of what Truffle Security found in other people's repos, applied to your own.
Common mistakes to avoid
Treating "unverified" as "safe" is the one I'd flag first — it just means the live check didn't run or didn't succeed, not that the string isn't a real key. Scanning once and assuming you're covered is another: Hugging Face’s own scanning pipeline runs trufflehog filesystem on every new push and emails you for verified hits, but that only covers commits going forward, not a dataset you imported once years ago and forgot about. Forgetting Git LFS is a real gap, not a minor one — TruffleHog's Hugging Face scanner can't currently reach files stored in Git LFS, which is exactly how most large Parquet and Arrow training shards are stored, so a clean scan of your metadata doesn't mean the large binaries are clean too. Assuming a leaked key is a one-repo problem is the mistake with the biggest blast radius: Truffle Security's report found 44% of the unique live secrets they identified showed up in more than one dataset, and a single AWS key was mirrored into 1,131 different datasets because scraped corpora carry copies of whatever was in the source. Last, not rotating immediately: a verified secret is live now, and every hour you wait is an hour someone else could be using it, which is also the logic behind Truffle Security's estimate of $76,800 a month in potential stolen inference from exposed OpenAI and Anthropic keys alone.
Tools that make this easier
If you're already relying on an AI coding assistant that reads from and writes to your repos, the same token hygiene applies to whatever credentials it authenticates with — my best AI tool for code roundup covers how Cursor, GitHub Copilot, and Claude Code each handle access. If a scan turns up an OpenAI or Anthropic key you don't recognize, it's worth reading how to use Claude AI so you understand what a properly scoped, rotated key should look like instead of one copied out of an old notebook, and my Claude vs. ChatGPT comparison is a reasonable next stop if you're deciding which provider to consolidate on. TruffleHog itself is one of a growing list of no-cost security options — see my free AI tools roundup for others worth trying before you pay for anything. And if a scan surfaces a GitHub token with more access than a coding tool actually needs, my ChatGPT alternatives for coding guide covers tools that scope repo access more tightly by default.
How the scanning options compare
| Option | What it scans | Cost | Who runs it |
|---|---|---|---|
| TruffleHog CLI (open source) | Any Hugging Face user, org, dataset, model, or Space you point it at | Free, AGPL-3.0 license | You, on demand |
| Hugging Face's built-in scan | Every commit pushed to your own repos | Free, included | Automatic — runs trufflehog filesystem on push, emails on verified hits |
| TruffleHog Enterprise | Git, Jira, Slack, Confluence, Microsoft Teams, SharePoint, continuously | Custom pricing, contact sales | Ongoing, managed dashboard |
For a solo account or a small team checking datasets before importing them, the free CLI covers everything in this guide. Hugging Face's built-in scan is worth leaving on regardless, since it's passive and free, but it only watches your own future pushes — it won't retroactively check a dataset you uploaded last year or one you're about to download from someone else.
Frequently Asked Questions
Is scanning Hugging Face datasets for secrets free?
Yes. TruffleHog is open source under an AGPL-3.0 license, and the huggingface command works the same whether you're checking one dataset or your entire account. Hugging Face's own push-time scan is also free and already running on every repo you own.
How long does a scan take?
Scanning your own account with a normal handful of repos finished in well under a minute when I tested it, since most files are small text and config. A single large dataset takes longer, because TruffleHog reads actual file contents rather than metadata — a multi-gigabyte Parquet file adds real minutes.
What's the easiest way to check just my own account?
Run trufflehog huggingface --user <your-username>, adding --org <name> if you publish under one too. That's the single command from this guide worth memorizing.
Does TruffleHog catch secrets inside Git LFS files?
Not yet. That's a real gap Truffle Security worked around for their own crawl, and it means a dataset's large binary shards — most Parquet and Arrow files included — aren't covered by a standard scan even though its small metadata and config files are.
What should I do if a scan finds a live secret?
Rotate or revoke it immediately at the source — GitHub's token settings, your cloud console, or your AI provider's key page — before doing anything else. A verified result means the credential authenticated successfully at scan time, so it stays live until you kill it.