MondoDB Detector silently discards valid secrets
Author: steeve85Created Sep 4, 2026Updated Sep 13, 2026
The placeholderPasswordPat regex might discard valid passwords that start with xX or ends with *
When testing trufflehog on some mongodb credentials, I noticed that some potential secrets were not properly being identified. This was tested on fake data, but real passwords could also be missed.
At mongodb.go:34:
placeholderPasswordPat = regexp.MustCompile(`^[xX]+|\*+$`)Using ^[xX]+$|^\*+$ should fix the issue.
I did not have the time to create a PR for this but happy to do it if needed
Source: trufflesecurity/trufflehog