TruffleHog 403 from GitHub during verification in CI

By Daniel Zoghalchali·Latchkey

When TruffleHog scans a GitHub org or verifies GitHub-hosted resources, it calls the GitHub API. A missing or under-scoped token returns 403, so the scan cannot enumerate or verify.

What this error means

TruffleHog logs "403 API rate limit exceeded" or "403 Forbidden" from the GitHub API and stops enumerating repos or verifying findings.

error enumerating repos: GET https://api.github.com/orgs/acme/repos:
403 API rate limit exceeded for installation ID ...

Common causes

No token, so the unauthenticated rate limit is hit

Without a token TruffleHog uses the low unauthenticated GitHub rate limit and receives 403 while listing org repos.

A token without the required scope

The provided token cannot read the target org or private repos, so GitHub returns 403 Forbidden.

How to fix it

Pass an authenticated token

1. Provide a token with read access to the target repos or org.
2. Expose it to TruffleHog via the documented flag or env var.
3. Re-run so the authenticated rate limit and scope apply.

- uses: trufflesecurity/trufflehog@main
  with:
    extra_args: --github-token ${{ secrets.GH_READ_TOKEN }}

Reduce API pressure for large orgs

Scan specific repos or narrow the org scope so you stay within the rate limit instead of enumerating everything.

trufflehog github --repo=https://github.com/acme/app --token=$GH_TOKEN

How to prevent it

• Always supply an authenticated GitHub token for org scans.
• Grant only read scope on the repos you scan.
• Scope scans to needed repos to avoid rate limits.

Frequently asked questions

Related guides

References

• GitHub Actions documentation