Use native TruffleHog verification across all built-in detectors

README.md

@@ -7,15 +7,17 @@ app_port: 7860
 
 ## Optional TruffleHog verification
 
-In **Settings → Module inputs**, supply source text and select **Verify found credentials I own or am authorized to test**. Select TruffleHog in the pipeline as usual. Verification is off by default, is not enabled by Full pipeline, and resets after a successful scan submission. No separate provider API key is required: verification authenticates with the detected credential from the HF worker to its provider.
+In **Settings → Module inputs**, supply source text and select **Verify found credentials I own or am authorized to test**. Select TruffleHog in the pipeline as usual. Verification is off by default, is not enabled by Full pipeline, and resets after a successful scan submission. No separate provider API key is required: native detectors use detected credentials to check the relevant service from the HF worker.
 
-All detector types still run in a detection-only first pass. A second pass checks up to 10 distinct candidates within a shared 30-second budget (one worker, up to 12 seconds per candidate). The pinned native verifiers are restricted to AWS access-key pairs, GitHub, Slack, Hugging Face and OpenAI. Each candidate gets its own temporary input to prevent cross-pairing; arbitrary-host/database/private-key verifiers, custom verifier URLs, account/resource analysis and known AWS canaries are excluded. AWS canary verification uses a different upstream operation and remains detection-only. Other types and candidates outside the budget remain visible.
+The adapter runs one native `trufflehog filesystem` scan against the **original source**, with verification enabled by omitting `--no-verification`. All built-in detector types are available: there is no application provider allowlist, per-credential source reconstruction, extra verification pass or 10-candidate cap. TruffleHog handles credential pairing, endpoint/context selection, verification support, caching, overlap decisions and provider requests. This can contact a database or host identified in source, rather than only one of five public providers. The app does not request separate resource/permission analysis or supply custom verifier URLs.
 
-Findings are grouped by detector and result: **Verified** (provider authentication confirmed; high confidence), **Unverified** (TruffleHog did not confirm validity), **Inconclusive** (provider/transport error, missing output or timeout), or **Detection-only** (not attempted). Unverified does not prove a secret is invalid. Inconclusive or exhausted-budget verification marks the stage partial. Job logs include only verification counts and budget diagnostics; detection findings survive verification failures.
+For HF, the process uses one worker and a 120-second overall deadline (40 seconds when verification is off). Deadlines retain parsed partial output and remain timeout results, never clean scans. No source archive extraction or binary scanning is enabled. Native detection/verification does not imply every credential can be verified successfully: detector support, service reachability and provider restrictions still apply.
 
-Secret values, source snippets, identity metadata and provider error text are never returned in results or logs. Source and candidate files are temporary on HF and removed after use. API clients opt in with `options.inputs.trufflehog_verify: true` alongside `source_text`. Only a boolean, source byte count and sanitized result counts are persisted.
+Findings preserve native **Verified**, **Unverified** and **Inconclusive** (verification error) outcomes. Disabled or explicitly skipped verification is **Detection-only**. The pinned native JSON does not always distinguish a skipped/unsupported verifier from an unverified credential, so unverified must never be interpreted as invalid or as proof a request was made. Error results mark an otherwise completed stage partial. Logs report native mode, deadline and result counts; they do not invent a count of network verification attempts.
 
-Implementation follows the [pinned TruffleHog documentation](https://github.com/trufflesecurity/trufflehog/blob/v3.99.7/README.md) and its provider/JSON output implementations. GitHub-hosted tests mock verification responses; the installed-binary smoke remains explicitly `--no-verification` and does not use real credentials.
+Secret values, source snippets, identity metadata and provider error text are never returned in results or logs. Source files are temporary on HF and removed after use. API clients opt in with `options.inputs.trufflehog_verify: true` alongside `source_text`. Only the setting, source byte count and sanitized result counts are persisted.
+
+This uses the [pinned TruffleHog verification behavior](https://github.com/trufflesecurity/trufflehog/blob/v3.99.7/README.md). GitHub-hosted tests mock native verification output; the installed-binary smoke remains explicitly `--no-verification` and does not authenticate real credentials.
 
 ## Direct URLs and target-list imports
 

app/final_modules.py

@@ -4,7 +4,6 @@ import base64
 import os
 import re
 import tempfile
-import time
 from pathlib import Path
 from urllib.parse import urljoin, urlsplit
 
@@ -44,15 +43,27 @@ def json_rows(rows):
     return found
 
 
-# Audited pinned v3.99.7 provider checks; never enable arbitrary-host/DB verifiers.
-TRUFFLEHOG_VERIFIERS = frozenset({"AWS", "Github", "Slack", "HuggingFace", "OpenAI"})
-TRUFFLEHOG_VERIFY_LIMIT = 10
-TRUFFLEHOG_VERIFY_SECONDS = 30
+# Let the pinned native tool choose and run its built-in detector verifiers.
+TRUFFLEHOG_DETECTION_SECONDS = 40
+TRUFFLEHOG_VERIFY_SECONDS = 120
+
+
+def native_secret_state(row):
+    if row.get("Verified") is True:
+        return "verified"
+    if row.get("VerificationSkipped") is True:
+        return "not_attempted"
+    if row.get("VerificationError") or not isinstance(row.get("Verified"), bool):
+        return "unknown"
+    # Native false includes unsupported/skipped verification in versions whose
+    # JSON does not expose VerificationSkipped. Never describe it as invalid.
+    return "unverified"
 
 
 def trufflehog_candidates(rows):
     # Keys and native metadata remain in memory only, never in returned diagnostics.
     candidates = {}
+    rank = {"verified": 3, "unknown": 2, "unverified": 1, "not_attempted": 0}
     for row in json_rows(rows):
         name = row.get("DetectorName")
         if not isinstance(name, str) or not re.fullmatch(r"[A-Za-z][A-Za-z0-9_]{0,79}", name):
@@ -60,80 +71,29 @@ def trufflehog_candidates(rows):
         raw = row.get("RawV2") or row.get("Raw") or ""
         if not isinstance(raw, str):
             continue
-        candidates.setdefault((name, raw), row)
+        key = (name, raw)
+        previous = candidates.get(key)
+        if previous is None or rank[native_secret_state(row)] > rank[native_secret_state(previous)]:
+            candidates[key] = row
     return candidates
 
 
-def verification_source(name, row):
-    raw = row.get("Raw")
-    if not isinstance(raw, str) or not raw or len(raw) > 8000 or any(c in raw for c in "\r\n\x00"):
-        return None
-    if name == "AWS":
-        # The upstream canary verifier uses SNS Publish. Do not invoke it.
-        extra = row.get("ExtraData")
-        if isinstance(extra, dict) and str(extra.get("is_canary", "")).lower() == "true":
-            return None
-        pair = row.get("RawV2", "")
-        if not isinstance(pair, str) or not re.fullmatch(r"(?:AKIA|ABIA|ACCA)[A-Z0-9]{16}:[A-Za-z0-9/+=]{40}", pair):
-            return None
-        return pair.replace(":", "\n", 1)
-    # Preserve the context needed by GitHub's legacy 40-character token detector.
-    return ("github_token = " if name == "Github" else "") + raw
-
+def trufflehog_states(rows, verification_enabled):
+    return {key: native_secret_state(row) if verification_enabled else "not_attempted"
+            for key, row in trufflehog_candidates(rows).items()}
 
-async def verify_trufflehog(rows, root):
-    candidates = trufflehog_candidates(rows)
-    states = {key: "not_attempted" for key in candidates}
-    attempted = 0
-    started = time.monotonic()
-    directory = root / "verification"
-    directory.mkdir(mode=0o700)
-    for key, row in candidates.items():
-        name, _ = key
-        text = verification_source(name, row) if name in TRUFFLEHOG_VERIFIERS else None
-        remaining = TRUFFLEHOG_VERIFY_SECONDS - (time.monotonic() - started)
-        if text is None or attempted >= TRUFFLEHOG_VERIFY_LIMIT or remaining < 1:
-            continue
-        path = directory / "candidate.txt"
-        path.write_text(text, encoding="utf-8")
-        path.chmod(0o600)
-        args = ["/usr/local/bin/trufflehog", "filesystem", str(path), "--json",
-                "--include-detectors", name, "--results", "verified,unverified,unknown",
-                "--allow-verification-overlap", "--no-verification-cache", "--no-update",
-                "--concurrency", "1", "--force-skip-binaries", "--force-skip-archives",
-                "--fail-on-scan-errors"]
-        attempted += 1
-        try:
-            verified_rows, status = await execute(args, min(12, max(1, int(remaining))))
-        except Exception:
-            # Executor failures must preserve detection results without persisting exception text.
-            verified_rows, status = [], "failed"
-        finally:
-            path.unlink(missing_ok=True)
-        matches = [item for candidate, item in trufflehog_candidates(verified_rows).items() if candidate == key]
-        # Missing output, timeout and transport/provider errors never mean invalid.
-        state = "unknown"
-        if any(item.get("Verified") is True for item in matches):
-            state = "verified"
-        elif status == "completed" and matches and all(
-                item.get("Verified") is False and not item.get("VerificationError") for item in matches):
-            state = "unverified"
-        states[key] = state
-    return states, attempted
 
-
-def parse_trufflehog(rows, url, states=None):
+def parse_trufflehog(rows, url, verification_enabled=False):
     # Never return Raw, RawV2, Redacted, ExtraData, errors or source snippets.
     groups = {}
-    for key in trufflehog_candidates(rows):
-        name, _ = key
-        state = (states or {}).get(key, "not_attempted")
+    for (name, _), state in trufflehog_states(rows, verification_enabled).items():
         groups[(name, state)] = groups.get((name, state), 0) + 1
     descriptions = {
-        "verified": "Provider authentication confirmed this credential at scan time.",
-        "unverified": "TruffleHog did not confirm validity. This does not prove the credential is invalid.",
-        "unknown": "Verification was inconclusive, failed or timed out; validity is unknown.",
-        "not_attempted": "Detection only; verification was disabled, unsupported, excluded or outside the verification budget.",
+        "verified": "Native TruffleHog verification confirmed this credential at scan time.",
+        "unverified": ("Native TruffleHog did not confirm validity. The detector may not support "
+                       "verification or may have skipped it; this does not prove the credential is invalid."),
+        "unknown": "Native verification was inconclusive or reported an error; validity is unknown.",
+        "not_attempted": "Detection only; verification was disabled or the native detector reported skipping it.",
     }
     findings = []
     for (name, state), count in groups.items():
@@ -227,10 +187,15 @@ async def run(module, url, host, agent, delay, inputs=None, profile="current"):
             (source / "source.txt").write_text(values.source_text, encoding="utf-8")
             (source / "source.txt").chmod(0o600)
             args = ["/usr/local/bin/trufflehog", "filesystem", str(source), "--json",
-                    "--no-verification", "--no-update", "--concurrency", "1",
+                    "--results", "verified,unverified,unknown", "--no-update", "--concurrency", "1",
                     "--force-skip-binaries", "--force-skip-archives", "--fail-on-scan-errors"]
-            deadline = 40
-            reason = "Supplied source only; secret verification disabled; values and context redacted"
+            if values.trufflehog_verify:
+                deadline = TRUFFLEHOG_VERIFY_SECONDS
+                reason = "Native TruffleHog verification enabled for all detectors; original supplied source; values and context redacted"
+            else:
+                args.append("--no-verification")
+                deadline = TRUFFLEHOG_DETECTION_SECONDS
+                reason = "Supplied source only; secret verification disabled; values and context redacted"
         elif module in ("trivy", "depscan", "osv-scanner"):
             sbom = root / "bom.json"
             sbom.write_text(values.sbom_text, encoding="utf-8")
@@ -292,26 +257,17 @@ async def run(module, url, host, agent, delay, inputs=None, profile="current"):
             raise ValueError("Unsupported module")
         rows, status = await execute(args, deadline)
         if module == "trufflehog":
-            states, attempted = {}, 0
-            if values.trufflehog_verify:
-                states, attempted = await verify_trufflehog(rows, root)
-                deadline += TRUFFLEHOG_VERIFY_SECONDS
-            findings = parse_trufflehog(rows, url, states)
-            candidates = trufflehog_candidates(rows)
-            eligible = sum(name in TRUFFLEHOG_VERIFIERS and verification_source(name, row) is not None
-                           for (name, _), row in candidates.items())
-            verification = {"enabled": values.trufflehog_verify, "attempted": attempted,
-                            "eligible": eligible,
-                            "budget_limited": max(0, eligible - attempted) if values.trufflehog_verify else 0,
-                            "limit": TRUFFLEHOG_VERIFY_LIMIT, "budget_seconds": TRUFFLEHOG_VERIFY_SECONDS,
-                            **{state: sum(states.get(key, "not_attempted") == state for key in candidates)
+            states = trufflehog_states(rows, values.trufflehog_verify)
+            findings = parse_trufflehog(rows, url, values.trufflehog_verify)
+            verification = {"enabled": values.trufflehog_verify, "mode": "native",
+                            "detectors": "all", "deadline_seconds": deadline,
+                            "candidates_reported": len(states),
+                            **{state: sum(value == state for value in states.values())
                                for state in ("verified", "unverified", "unknown", "not_attempted")}}
             if values.trufflehog_verify:
-                reason = ("Provider verification enabled; up to 10 candidates / 30s; " +
-                          ", ".join(f"{verification[state]} {state.replace('_', ' ')}"
-                                    for state in ("verified", "unverified", "unknown", "not_attempted")) +
-                          "; values, identity metadata and provider errors redacted")
-                if (verification["unknown"] or verification["budget_limited"]) and status == "completed":
+                reason += "; " + ", ".join(f"{verification[state]} {state.replace('_', ' ')}"
+                                          for state in ("verified", "unverified", "unknown", "not_attempted"))
+                if verification["unknown"] and status == "completed":
                     status = "partial"
         elif module == "amass":
             path = root / "hosts.txt"

app/index.html

@@ -73,7 +73,7 @@ https://example.org/,Main app</pre><small>TSV uses tabs. Supported target header
 <label class="module-card" data-module-search="dalfox unverified xss review."><input id="modDalfox" type="checkbox"  onchange="updatePipelinePreview()"/><span><strong>Dalfox</strong><small>Unverified XSS review.</small></span></label>
 <label class="module-card" data-module-search="sqlmap low-risk boolean tests; no data extraction."><input id="modSqlmap" type="checkbox"  onchange="updatePipelinePreview()"/><span><strong>SQLmap</strong><small>Low-risk boolean tests; no data extraction.</small></span></label>
 <label class="module-card" data-module-search="garak two benign output-filter checks; rest llm path required."><input id="modGarak" type="checkbox"  onchange="updatePipelinePreview()"/><span><strong>garak</strong><small>Two benign output-filter checks; REST LLM path required.</small></span></label></div></section>
-<section class="module-group"><h3>Source & dependencies</h3><div class="module-grid"><label class="module-card" data-module-search="trufflehog supplied source text; optional bounded provider verification."><input id="modTrufflehog" type="checkbox"  onchange="updatePipelinePreview()"/><span><strong>TruffleHog</strong><small>Supplied source text; optional bounded provider verification.</small></span></label>
+<section class="module-group"><h3>Source & dependencies</h3><div class="module-grid"><label class="module-card" data-module-search="trufflehog supplied source text; optional native credential verification."><input id="modTrufflehog" type="checkbox"  onchange="updatePipelinePreview()"/><span><strong>TruffleHog</strong><small>Supplied source text; optional native credential verification.</small></span></label>
 <label class="module-card" data-module-search="dep-scan cyclonedx sbom; application-only database, 2024 onward."><input id="modDepscan" type="checkbox"  onchange="updatePipelinePreview()"/><span><strong>dep-scan</strong><small>CycloneDX SBOM; application-only database, 2024 onward.</small></span></label>
 <label class="module-card" data-module-search="trivy cyclonedx sbom; keyless advisory database."><input id="modTrivy" type="checkbox"  onchange="updatePipelinePreview()"/><span><strong>Trivy</strong><small>CycloneDX SBOM; keyless advisory database.</small></span></label>
 <label class="module-card" data-module-search="osv-scanner cyclonedx sbom; public advisory service."><input id="modOsv" type="checkbox"  onchange="updatePipelinePreview()"/><span><strong>OSV-Scanner</strong><small>CycloneDX SBOM; public advisory service.</small></span></label></div></section><p id="moduleSearchEmpty" class="empty" hidden>No matching modules.</p></section>
@@ -88,7 +88,7 @@ https://example.org/,Main app</pre><small>TSV uses tabs. Supported target header
 <div class="settings-group" id="settings-inputs" hidden><section class="card"><span class="eyebrow">Query reference comparisons</span><h2>IDOR-Forge · limited GET profile</h2><p class="muted">Use explicit reference IDs you are authorized to test. This keyless, anonymous profile sends at most four GET requests to one path and never follows redirects. Configure one selected asset at a time. Without these inputs the module skips.</p>
 <div class="toolbar"><div class="field"><label for="moduleIdorPath">Same-origin endpoint path</label><input id="moduleIdorPath" maxlength="250" placeholder="/api/document"/></div><div class="field"><label for="moduleIdorParameter">Query parameter</label><input id="moduleIdorParameter" maxlength="50" value="id"/></div></div>
 <div class="toolbar"><div class="field"><label for="moduleIdorBaseline">Baseline reference ID</label><input id="moduleIdorBaseline" maxlength="100" autocomplete="off" placeholder="1001"/></div><div class="field"><label for="moduleIdorValues">Reference IDs to compare (up to 3, comma-separated)</label><input id="moduleIdorValues" maxlength="302" autocomplete="off" placeholder="1002, 1003"/></div></div>
-<p class="notice">Similarity is a review signal. This profile cannot prove object ownership or missing authorization; verify candidates using two authorized test accounts. Credentials, mutations, broad payload fuzzing and the upstream GUI are outside this profile. Reference values and response bodies are omitted from results and logs.</p></section><section class="card"><h2>Optional module inputs</h2><p class="muted">Optional inputs stay in this job's memory. Source/SBOM content is not included in saved results. Attach artifacts to one selected asset at a time. Full pipeline skips tools whose inputs are absent.</p><div class="field"><label for="moduleSource">Source text for TruffleHog (max 200,000 characters)</label><textarea id="moduleSource" maxlength="200000" rows="4" placeholder="Paste source or configuration text to inspect. Detected values and context are redacted."></textarea></div><p><label><input id="moduleTrufflehogVerify" type="checkbox"/> Verify found credentials I own or am authorized to test</label></p><p class="muted">Optional: sends detected credentials from the HF worker to their provider to check authentication. Supports AWS access-key pairs, GitHub, Slack, Hugging Face and OpenAI; up to 10 candidates within 30 seconds. Other types, known AWS canaries and candidates beyond this budget stay detection-only. Provider errors are inconclusive, never proof of an invalid secret. Values and account details are redacted. Full pipeline does not enable this option.</p><div class="field"><label for="moduleSbom">CycloneDX SBOM JSON for dep-scan, Trivy and OSV-Scanner (max 300 components)</label><textarea id="moduleSbom" maxlength="1000000" rows="4" placeholder='{"bomFormat":"CycloneDX","components":[{"name":"package","version":"1.0.0","purl":"pkg:npm/package@1.0.0"}]}'></textarea></div><p class="muted">These tools inspect supplied package metadata. OSV sends package names/versions to its public advisory service. Trivy and dep-scan fetch public databases on their first applicable run; database availability is shown in logs. dep-scan uses a smaller application-only database covering 2024 onward.</p><p><label><input id="moduleApiTarget" type="checkbox"/> This asset is an API target; allow Kiterunner's eight-route GET sample.</label></p><p class="muted">Amass uses standalone 4.2.0 passive discovery. Returned hostnames are inventory only and are not added to scan scope. Nettacker runs one HTTP-status check.</p><div class="toolbar"><div class="field"><label for="moduleLlmPath">Optional same-origin REST LLM path for garak</label><input id="moduleLlmPath" placeholder="/api/generate" maxlength="250"/></div><div class="field"><label>Top-level request prompt field</label><input id="modulePromptField" value="prompt" maxlength="50"/></div><div class="field"><label>Top-level response text field</label><input id="moduleResponseField" value="response" maxlength="50"/></div></div><p class="muted">garak runs two benign antivirus-signature output-filter checks. Use this only for an LLM expected to filter those signatures. No local model, API key, browser or GPU is required.</p></section></div>
+<p class="notice">Similarity is a review signal. This profile cannot prove object ownership or missing authorization; verify candidates using two authorized test accounts. Credentials, mutations, broad payload fuzzing and the upstream GUI are outside this profile. Reference values and response bodies are omitted from results and logs.</p></section><section class="card"><h2>Optional module inputs</h2><p class="muted">Optional inputs stay in this job's memory. Source/SBOM content is not included in saved results. Attach artifacts to one selected asset at a time. Full pipeline skips tools whose inputs are absent.</p><div class="field"><label for="moduleSource">Source text for TruffleHog (max 200,000 characters)</label><textarea id="moduleSource" maxlength="200000" rows="4" placeholder="Paste source or configuration text to inspect. Detected values and context are redacted."></textarea></div><p><label><input id="moduleTrufflehogVerify" type="checkbox"/> Verify found credentials I own or am authorized to test</label></p><p class="muted">Optional: runs TruffleHog’s built-in verification for all detector types against the original supplied source. Native detectors use the credential and its source context to check the relevant service, which can include a database or another host. No five-provider restriction or 10-candidate cap. One worker, with a 120-second overall process limit on HF. Some detectors may be unable to verify, skip verification or encounter network errors; an unverified result never proves a secret is invalid. Values, account details and provider errors are redacted. Full pipeline does not enable this option.</p><div class="field"><label for="moduleSbom">CycloneDX SBOM JSON for dep-scan, Trivy and OSV-Scanner (max 300 components)</label><textarea id="moduleSbom" maxlength="1000000" rows="4" placeholder='{"bomFormat":"CycloneDX","components":[{"name":"package","version":"1.0.0","purl":"pkg:npm/package@1.0.0"}]}'></textarea></div><p class="muted">These tools inspect supplied package metadata. OSV sends package names/versions to its public advisory service. Trivy and dep-scan fetch public databases on their first applicable run; database availability is shown in logs. dep-scan uses a smaller application-only database covering 2024 onward.</p><p><label><input id="moduleApiTarget" type="checkbox"/> This asset is an API target; allow Kiterunner's eight-route GET sample.</label></p><p class="muted">Amass uses standalone 4.2.0 passive discovery. Returned hostnames are inventory only and are not added to scan scope. Nettacker runs one HTTP-status check.</p><div class="toolbar"><div class="field"><label for="moduleLlmPath">Optional same-origin REST LLM path for garak</label><input id="moduleLlmPath" placeholder="/api/generate" maxlength="250"/></div><div class="field"><label>Top-level request prompt field</label><input id="modulePromptField" value="prompt" maxlength="50"/></div><div class="field"><label>Top-level response text field</label><input id="moduleResponseField" value="response" maxlength="50"/></div></div><p class="muted">garak runs two benign antivirus-signature output-filter checks. Use this only for an LLM expected to filter those signatures. No local model, API key, browser or GPU is required.</p></section></div>
 <div class="settings-group" id="settings-nuclei" hidden><section class="card" id="nucleiSettings"><h2>Nuclei · Template selection</h2>
 <p class="muted">Combine any bundled profiles, compatible community templates, and custom YAML. This selection applies to new scans only. Community and custom templates must pass the server's GET/HEAD-only validation; dynamic DSL, POST requests, remote interactions, and unsafe paths are blocked.</p>
 <div class="grid">

tests/test_final_modules.py

@@ -201,143 +201,131 @@ def test_draft_endpoint_validates_but_never_launches_scan():
     assert response.json()["executed"] is False
 
 
-# Verification responses are mocked. No test authenticates a real credential.
-def run_secret_fixture(rows, reply=None, enabled=True):
-    calls = []
-    paths = []
+# Native process output is mocked. No test authenticates a real credential.
+def native_secret(name="Github", raw="fixture-private-key", **fields):
+    return json.dumps({"DetectorName": name, "Raw": raw, "Redacted": raw,
+                       "ExtraData": {"account": "fixture-private-identity"},
+                       "SourceMetadata": {"source": "fixture-private-source"},
+                       "SecretParts": {"key": raw}, **fields})
+
+
+def run_secret_fixture(rows, enabled=True, native_status="completed"):
+    calls, paths = [], []
+    source = "database=https://fixture-private-host/\npassword=fixture-private-key\noriginal context"
     async def execute(args, timeout):
         calls.append((args, timeout))
         assert "--no-update" in args and "--force-skip-archives" in args
-        path = Path(args[args.index("filesystem") + 1])
-        if "--no-verification" in args:
-            return rows, "completed"
-        assert "--include-detectors" in args and "--allow-verification-overlap" in args
-        assert "--no-verification-cache" in args
+        assert "--force-skip-binaries" in args
         assert args[args.index("--results") + 1] == "verified,unverified,unknown"
-        assert timeout <= 12 and (path.stat().st_mode & 0o777) == 0o600
+        assert args[args.index("--concurrency") + 1] == "1"
+        # No allowlist, source reconstruction or replacement of built-in policy.
+        assert not {"--include-detectors", "--exclude-detectors", "--verifier", "--config",
+                    "--allow-verification-overlap", "--no-verification-cache"} & set(args)
+        assert ("--no-verification" in args) is (not enabled)
+        assert timeout == (120 if enabled else 40)
+        root = Path(args[args.index("filesystem") + 1])
+        path = root / "source.txt"
+        assert path.read_text() == source
+        assert (path.stat().st_mode & 0o777) == 0o600
+        assert sorted(p.name for p in root.iterdir()) == ["source.txt"]
         assert "fixture-private" not in " ".join(args)
         paths.append(path)
-        return reply(args, path) if reply else ([], "completed")
+        return rows, native_status
     with patch.object(modules, "execute", execute):
         result = asyncio.run(modules.run("trufflehog", "https://example.org/", "example.org", "Test", 1.5,
-                            ModuleInputs(source_text="fixture-private-source", trufflehog_verify=enabled)))
+                            ModuleInputs(source_text=source, trufflehog_verify=enabled)))
     assert all(not path.exists() for path in paths)
+    assert len(calls) == 1
     assert "fixture-private" not in json.dumps(result)
-    return result, calls
-
-
-def native_secret(name="Github", raw="fixture-private-key", **fields):
-    return json.dumps({"DetectorName": name, "Raw": raw, "Redacted": raw,
-                       "ExtraData": {"account": "fixture-private-identity"}, **fields})
+    assert "attempted" not in result["verification"]
+    assert "limit" not in result["verification"]
+    return result
 
 
 @pytest.mark.parametrize("fields,status,expected", [
     ({"Verified": True}, "completed", "verified"),
     ({"Verified": False}, "completed", "unverified"),
     ({"Verified": False, "VerificationError": "fixture-private-provider-error"}, "completed", "unknown"),
-    ({"Verified": False}, "timeout", "unknown"),
+    ({"Verified": False}, "timeout", "unverified"),
     ({"Verified": True}, "timeout", "verified"),
+    ({"Verified": False, "VerificationSkipped": True}, "completed", "not_attempted"),
     ({}, "completed", "unknown"),
 ])
-def test_trufflehog_verification_labels_and_redaction(fields, status, expected):
-    def reply(args, path):
-        assert path.read_text() == "github_token = fixture-private-key"
-        assert args[args.index("--include-detectors") + 1] == "Github"
-        return [native_secret(**fields)], status
-    result, calls = run_secret_fixture([native_secret()], reply)
+def test_native_verification_labels_and_redaction(fields, status, expected):
+    result = run_secret_fixture([native_secret(**fields)], native_status=status)
     finding = result["alerts"][0]
-    assert len(calls) == 2 and result["verification"]["attempted"] == 1
     assert finding["verification_status"] == expected
     assert finding["confidence"] == ("High" if expected == "verified" else "Low")
     assert finding["risk"] == ("High" if expected == "verified" else "Medium")
-    assert result["status"] == ("partial" if expected == "unknown" else "findings")
+    assert result["verification"][expected] == 1
+    assert result["verification"]["mode"] == "native"
+    assert result["verification"]["detectors"] == "all"
+    assert result["status"] == (status if status != "completed" else
+                                "partial" if expected == "unknown" else "findings")
 
 
-def test_detection_default_never_contacts_a_provider_even_if_native_claims_verified():
-    result, calls = run_secret_fixture([native_secret(Verified=True)], enabled=False)
-    assert len(calls) == 1
+def test_detection_default_disables_native_verification_even_if_output_claims_verified():
+    result = run_secret_fixture([native_secret(Verified=True)], enabled=False)
     assert result["alerts"][0]["verification_status"] == "not_attempted"
     assert result["verification"]["enabled"] is False
 
 
-def test_unsupported_detectors_and_known_aws_canaries_stay_detection_only():
-    aws = native_secret("AWS", raw="AKIAABCDEFGHIJKLMNOP",
-                        RawV2="AKIAABCDEFGHIJKLMNOP:" + "a" * 40,
-                        ExtraData={"is_canary": "true"})
-    result, calls = run_secret_fixture([native_secret("PrivateKey"), native_secret("Postgres"), aws])
-    assert len(calls) == 1 and result["verification"]["attempted"] == 0
-    assert result["verification"]["not_attempted"] == 3
+@pytest.mark.parametrize("name", ["AWS", "Github", "Slack", "HuggingFace", "OpenAI",
+                                  "Stripe", "Postgres", "Azure", "PrivateKey"])
+def test_native_verification_accepts_all_detector_results_without_application_allowlist(name):
+    result = run_secret_fixture([native_secret(name, Verified=True)])
+    assert result["verification"]["verified"] == 1
+    assert result["alerts"][0]["name"] == "Verified " + name + " secret"
 
 
-def test_missing_or_mismatched_verifier_output_is_inconclusive():
-    result, _ = run_secret_fixture([native_secret()], lambda *args: (
-        [native_secret(raw="fixture-private-other-key", Verified=True)], "completed"))
-    assert result["verification"]["unknown"] == 1
-    assert result["verification"]["verified"] == 0
+def test_more_than_ten_credentials_remain_in_single_native_scan():
+    rows = [native_secret(raw="fixture-private-" + str(i), Verified=True) for i in range(15)]
+    result = run_secret_fixture(rows)
+    assert result["verification"]["verified"] == 15
+    assert result["verification"]["candidates_reported"] == 15
+    assert result["alerts"][0]["candidate_count"] == 15
 
 
-def test_verifier_exception_keeps_detection_without_leaking_exception():
-    def reply(*args):
-        raise RuntimeError("fixture-private-native-error")
-    result, _ = run_secret_fixture([native_secret()], reply)
-    assert result["status"] == "partial" and len(result["alerts"]) == 1
-    assert result["verification"]["unknown"] == 1
+def test_partial_native_output_retains_findings_and_timeout_status():
+    result = run_secret_fixture([native_secret(Verified=True),
+                                "[diagnostic] Deadline exceeded; fixture-private-error"],
+                                native_status="timeout")
+    assert result["status"] == "timeout"
+    assert result["verification"]["verified"] == 1
+    assert result["alerts"][0]["verification_status"] == "verified"
 
 
-def test_verification_is_deduplicated_and_capped_without_hiding_remaining_detections():
-    rows = [native_secret(raw="fixture-private-" + str(i)) for i in range(12)]
-    result, calls = run_secret_fixture(rows + rows[:1])
-    assert len(calls) == 11
-    assert result["verification"]["attempted"] == 10
-    assert result["verification"]["unknown"] == 10
-    assert result["verification"]["not_attempted"] == 2
-    assert result["verification"]["budget_limited"] == 2
-    assert sum(item["candidate_count"] for item in result["alerts"]) == 12
+def test_empty_timeout_cannot_claim_clean_scan_or_completed_verification():
+    result = run_secret_fixture(["[diagnostic] Deadline exceeded"], native_status="timeout")
+    assert result["status"] == "timeout" and result["alerts"] == []
+    assert result["verification"]["candidates_reported"] == 0
 
 
-def test_verification_budget_does_not_start_more_processes_after_expiry():
-    # Patch only the module-local clock object, leaving asyncio's clock intact.
-    from types import SimpleNamespace
-    times = iter([0, 0, 31])
-    async def execute(args, timeout):
-        return [native_secret()], "completed"
-    with patch.object(modules, "time", SimpleNamespace(monotonic=lambda: next(times))), \
-         patch.object(modules, "execute", execute):
-        import tempfile
-        with tempfile.TemporaryDirectory() as tmp:
-            states, count = asyncio.run(modules.verify_trufflehog(
-                [native_secret(), native_secret(raw="fixture-private-second")], Path(tmp)))
-    assert count == 1
-    assert list(states.values()) == ["unknown", "not_attempted"]
-
-
-@pytest.mark.parametrize("name", ["AWS", "Github", "Slack", "HuggingFace", "OpenAI"])
-def test_provider_detector_is_explicit_and_never_uses_supplied_custom_endpoints(name):
-    key = "AKIAABCDEFGHIJKLMNOP"
-    pair = key + ":" + "a" * 40
-    row = native_secret(name, raw=key if name == "AWS" else "fixture-private-key",
-                        **({"RawV2": pair} if name == "AWS" else {}))
-    def reply(args, path):
-        assert args[args.index("--include-detectors") + 1] == name
-        assert "--verifier" not in args and "--config" not in args
-        if name == "AWS":
-            assert path.read_text() == pair.replace(":", "\n")
-        return [], "completed"
-    result, calls = run_secret_fixture([row], reply)
-    assert len(calls) == 2 and result["verification"]["unknown"] == 1
+def test_unverified_does_not_claim_invalid_or_known_verification_attempt():
+    result = run_secret_fixture([native_secret("UnsupportedExample", Verified=False)])
+    assert result["alerts"][0]["verification_status"] == "unverified"
+    assert "may not support" in result["alerts"][0]["description"]
+    assert "does not prove" in result["alerts"][0]["description"]
+
+
+def test_native_verification_deduplicates_candidates_and_keeps_strongest_evidence():
+    rows = [native_secret(raw="fixture-private-good", Verified=False),
+            native_secret(raw="fixture-private-good", Verified=True),
+            native_secret(raw="fixture-private-bad", Verified=False)]
+    result = run_secret_fixture(rows)
+    assert result["verification"]["verified"] == result["verification"]["unverified"] == 1
+    assert result["verification"]["candidates_reported"] == 2
+    assert {a["verification_status"] for a in result["alerts"]} == {"verified", "unverified"}
+
+
+def test_native_verification_summary_counts_all_candidates_beyond_alert_group_cap():
+    rows = [native_secret("Detector" + str(i), Verified=True) for i in range(101)]
+    result = run_secret_fixture(rows)
+    assert result["verification"]["verified"] == 101
+    assert len(result["alerts"]) == 100
 
 
 def test_verification_flag_is_visible_but_source_stays_private_in_job_options():
     summary = ModuleInputs(source_text="fixture-private-source", trufflehog_verify=True).public_summary()
     assert summary["trufflehog_verify"] is True
     assert "fixture-private" not in json.dumps(summary)
-
-
-def test_multiple_candidates_of_one_detector_keep_separate_verification_results():
-    rows = [native_secret(raw="fixture-private-good"), native_secret(raw="fixture-private-bad")]
-    def reply(args, path):
-        raw = path.read_text().split(" = ", 1)[1]
-        return [native_secret(raw=raw, Verified=raw.endswith("good"))], "completed"
-    result, _ = run_secret_fixture(rows, reply)
-    assert result["verification"]["verified"] == result["verification"]["unverified"] == 1
-    assert {a["verification_status"] for a in result["alerts"]} == {"verified", "unverified"}

tests/trufflehog_offline_smoke.py

@@ -10,9 +10,7 @@ with tempfile.TemporaryDirectory() as tmp:
                     "-out", str(key)], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
     result = subprocess.run(["/usr/local/bin/trufflehog", "filesystem", tmp, "--json",
                              "--no-verification", "--no-update", "--concurrency", "1",
-                             "--include-detectors", "PrivateKey,AWS,Github,Slack,HuggingFace,OpenAI",
-                             "--results", "verified,unverified,unknown", "--allow-verification-overlap",
-                             "--no-verification-cache"], capture_output=True, text=True, timeout=30)
+                             "--results", "verified,unverified,unknown"], capture_output=True, text=True, timeout=30)
     assert result.returncode == 0
     findings = [json.loads(line) for line in result.stdout.splitlines() if line.startswith("{")]
     assert any("private" in str(item.get("DetectorName", "")).lower() for item in findings)