#5276·trufflehog

MondoDB Detector silently discards valid secrets

Author: steeve85Created Sep 4, 2026Updated Sep 13, 2026

The placeholderPasswordPat regex might discard valid passwords that start with xX or ends with *

When testing trufflehog on some mongodb credentials, I noticed that some potential secrets were not properly being identified. This was tested on fake data, but real passwords could also be missed.

At mongodb.go:34:

placeholderPasswordPat = regexp.MustCompile(`^[xX]+|\*+$`)

Using ^[xX]+$|^\*+$ should fix the issue.

I did not have the time to create a PR for this but happy to do it if needed

Source: trufflesecurity/trufflehog