secret-scanning
(3)
The Free Security Tool That Became a $40 Million Bet on One Annoying Question: Is That Key Still Live?
TruffleHog started as a weekend bug-bounty tool and grew into an enterprise security platform by attacking the least glamorous part of a credential leak: separating live danger from a pile of convincing-looking junk.
BitPatrol
BitPatrol is an AI-powered code security company that scans source code on every commit to catch exposed secrets - API keys, database passwords, and auth tokens - the moment they are pushed. Founded by former Stripe engineer and top-2% HackerOne researcher Christopher Lambert, it replaces legacy regex scanners with a proprietary machine-learning model that reads code context and cross-references billions of public commits to cut false positives. Part of Y Combinator's Spring 2025 (X25) batch, the company was acquired in 2025.
Infisical
Infisical is an open-source security platform that helps engineering teams manage secrets, certificates, and machine identities in one place. Born out of Y Combinator's W23 batch, it replaces scattered .env files and hardcoded API keys with a unified, MIT-licensed stack covering secrets management, dynamic secrets, rotation, secret scanning, PKI, KMS, SSH, and privileged access. Used by companies like Hugging Face, LG, and Lucid, it secures billions of secrets and is backed by Elad Gil, Google's Gradient Ventures, and Y Combinator.