[Feature Request] Option to quietly ignore broken symlinks

[kennu]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

When scanning deep hierarchies of project files, TruffleHog outputs many warnings about broken symlinks where the target does not exist. They are usually not useful information and only add noise to the output.

2023-03-05T10:56:38+02:00 info-0 trufflehog unable to stat file {"source_type": "SOURCE_TYPE_FILESYSTEM", "source_name": "filesystem", "path": "/usr/src/node-red/node_modules/.bin/prebuild", "error": "stat /usr/src/node-red/node_modules/.bin/prebuild: no such file or directory"}

Problem to be Addressed

The warning about broken symlinks could be optional. The option could just quietly ignore all "no such file or directory" errors from Stat() using something like if errors.Is(err, os.ErrNotExist) { ... }. If necessary, a more advanced solution could use os.Lstat() to check if the problematic file really was a symlink.

Description of the Preferred Solution

Add a command line switch to ignore broken symlinks (don't print the warning about each file).

References

• https://github.com/trufflesecurity/trufflehog/blob/main/pkg/sources/filesystem/filesystem.go

[dustin-decker]

Thanks for reporting @kennu. Would you like to make a PR for this?

[shahzadhaider1]

Hi @kennu,

Thanks for raising this feature request!

We tested the behavior in the 2023 version of TruffleHog and confirmed that the issue was reproducible there, specifically, TruffleHog attempted to follow symlinks using os.Stat(), and when encountering broken symlinks (i.e., where the target doesn't exist), it logged noisy warnings like:

unable to stat file {"path": "...", "error": "stat ...: no such file or directory"}

However, in the latest version, this behavior has been improved:

• TruffleHog now uses os.Lstat() instead of os.Stat(), which allows it to inspect symlinks without following them.
• Symlinks (including broken ones) are detected and gracefully skipped during scanning.
• As a result, the warnings for broken symlinks are no longer printed, and the output remains clean even in deep file hierarchies (e.g., node_modules).

This effectively resolves the original issue. If you are still seeing warnings related to broken symlinks in recent versions, feel free to share a minimal reproducible example, and we’ll gladly take another look.

Thanks again for helping improve TruffleHog!