feat: Enable all phases by default and wire TruffleHog scanner

Enable DAST, fuzzing, runtime security, collaborative reasoning,
AI enrichment, and TruffleHog secret scanning by default. All phases
now run out-of-the-box for complete security coverage.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: devatsecure

scripts/hybrid/cli.py

@@ -62,18 +62,19 @@ def main():
     parser.add_argument("--enable-semgrep", action="store_true", default=True, help="Enable Semgrep SAST")
     parser.add_argument("--enable-trivy", action="store_true", default=True, help="Enable Trivy CVE scanning")
     parser.add_argument("--enable-checkov", action="store_true", default=True, help="Enable Checkov IaC scanning")
+    parser.add_argument("--enable-trufflehog", action="store_true", default=True, help="Enable TruffleHog secret scanning")
     parser.add_argument("--enable-api-security", action="store_true", default=True, help="Enable API Security scanning")
-    parser.add_argument("--enable-dast", action="store_true", default=False, help="Enable DAST scanning")
+    parser.add_argument("--enable-dast", action="store_true", default=True, help="Enable DAST scanning")
     parser.add_argument("--enable-supply-chain", action="store_true", default=True, help="Enable Supply Chain Attack Detection")
-    parser.add_argument("--enable-fuzzing", action="store_true", default=False, help="Enable Intelligent Fuzzing Engine")
+    parser.add_argument("--enable-fuzzing", action="store_true", default=True, help="Enable Intelligent Fuzzing Engine")
     parser.add_argument("--enable-threat-intel", action="store_true", default=True, help="Enable Threat Intelligence Enrichment")
     parser.add_argument("--enable-remediation", action="store_true", default=True, help="Enable Automated Remediation Engine")
-    parser.add_argument("--enable-runtime-security", action="store_true", default=False, help="Enable Container Runtime Security Monitoring")
+    parser.add_argument("--enable-runtime-security", action="store_true", default=True, help="Enable Container Runtime Security Monitoring")
     parser.add_argument("--enable-regression-testing", action="store_true", default=True, help="Enable Security Regression Testing")
     parser.add_argument(
         "--enable-ai-enrichment",
         action="store_true",
-        default=False,
+        default=True,
         help="Enable AI enrichment with Claude/OpenAI",
     )
     parser.add_argument(
@@ -102,8 +103,8 @@ def main():
     parser.add_argument(
         "--enable-collaborative-reasoning",
         action="store_true",
-        default=False,
-        help="Enable collaborative reasoning (multi-agent discussion, adds cost)",
+        default=True,
+        help="Enable collaborative reasoning (multi-agent discussion)",
     )
     parser.add_argument(
         "--enable-disclosure-report",
@@ -139,6 +140,7 @@ def main():
 
     # Read feature flags from environment variables (GitHub Action inputs)
     # These override defaults but are overridden by explicit CLI args
+    enable_trufflehog = get_bool_env("ENABLE_TRUFFLEHOG", args.enable_trufflehog)
     enable_api_security = get_bool_env("ENABLE_API_SECURITY", args.enable_api_security)
     enable_dast = get_bool_env("ENABLE_DAST", args.enable_dast)
     enable_supply_chain = get_bool_env("ENABLE_SUPPLY_CHAIN", args.enable_supply_chain)
@@ -168,6 +170,7 @@ def main():
     # Initialize analyzer
     analyzer = HybridSecurityAnalyzer(
         enable_semgrep=args.enable_semgrep,
+        enable_trufflehog=enable_trufflehog,
         enable_trivy=args.enable_trivy,
         enable_checkov=args.enable_checkov,
         enable_api_security=enable_api_security,

scripts/hybrid_analyzer.py

@@ -148,19 +148,20 @@ def __init__(
         enable_trivy: bool = True,
         enable_checkov: bool = True,
         enable_api_security: bool = True,
-        enable_dast: bool = False,
+        enable_dast: bool = True,
         enable_supply_chain: bool = True,
-        enable_fuzzing: bool = False,
+        enable_fuzzing: bool = True,
         enable_threat_intel: bool = True,
         enable_remediation: bool = True,
-        enable_runtime_security: bool = False,
+        enable_runtime_security: bool = True,
         enable_regression_testing: bool = True,
         enable_ai_enrichment: bool = True,
         enable_argus: bool = False,  # Use existing argus if needed
         enable_sandbox: bool = True,  # Validate exploits in Docker sandbox
         enable_multi_agent: bool = True,  # Use specialized agent personas
         enable_spontaneous_discovery: bool = True,  # Discover issues beyond scanner rules
-        enable_collaborative_reasoning: bool = False,  # Multi-agent discussion (opt-in, more expensive)
+        enable_collaborative_reasoning: bool = True,  # Multi-agent discussion
+        enable_trufflehog: bool = True,  # TruffleHog verified secret detection
         enable_iris: bool = True,  # IRIS-style semantic analysis (arXiv 2405.17238)
         ai_provider: Optional[str] = None,
         dast_target_url: Optional[str] = None,
@@ -213,6 +214,7 @@ def __init__(
         self.enable_multi_agent = enable_multi_agent
         self.enable_spontaneous_discovery = enable_spontaneous_discovery
         self.enable_collaborative_reasoning = enable_collaborative_reasoning
+        self.enable_trufflehog = enable_trufflehog
         self.enable_iris = enable_iris
         self.ai_provider = ai_provider
         self.dast_target_url = dast_target_url
@@ -232,6 +234,7 @@ def __init__(
         self.remediation_engine = None
         self.runtime_security_monitor = None
         self.regression_tester = None
+        self.trufflehog_scanner = None
         self.sandbox_validator = None
         self.ai_client = None
 
@@ -332,6 +335,16 @@ def __init__(
                 logger.warning(f"⚠️  Semgrep scanner not available: {e}")
                 self.enable_semgrep = False
 
+        if self.enable_trufflehog:
+            try:
+                from trufflehog_scanner import TruffleHogScanner
+
+                self.trufflehog_scanner = TruffleHogScanner()
+                logger.info("✅ TruffleHog scanner initialized")
+            except (ImportError, RuntimeError) as e:
+                logger.warning(f"⚠️  TruffleHog scanner not available: {e}")
+                self.enable_trufflehog = False
+
         if self.enable_trivy:
             try:
                 from trivy_scanner import TrivyScanner
@@ -539,6 +552,30 @@ def analyze(
                 logger.error(f"   ❌ Semgrep scan failed: {e}")
                 logger.info("   💡 Continuing with other scanners...")
 
+        # Run TruffleHog
+        if self.enable_trufflehog and self.trufflehog_scanner:
+            try:
+                logger.info("   🔍 Running TruffleHog secret scanner...")
+                th_result = self.trufflehog_scanner.scan(str(target_path), scan_type="filesystem")
+                th_findings_raw = th_result.get("findings", [])
+                trufflehog_findings = []
+                for f in th_findings_raw:
+                    trufflehog_findings.append(HybridFinding(
+                        finding_id=f"trufflehog-{f.get('detector_type', 'unknown')}-{len(trufflehog_findings)}",
+                        source_tool="trufflehog",
+                        severity="critical" if f.get("verified") else "high",
+                        category="secrets",
+                        title=f"Secret detected: {f.get('detector_type', 'Unknown')}",
+                        description=f"TruffleHog detected a {'verified' if f.get('verified') else 'potential'} {f.get('detector_name', 'secret')} in {f.get('file_path', 'unknown')}",
+                        file_path=f.get("file_path", ""),
+                        line_number=f.get("line"),
+                    ))
+                all_findings.extend(trufflehog_findings)
+                logger.info(f"   ✅ TruffleHog: {len(trufflehog_findings)} secrets detected")
+            except Exception as e:
+                logger.error(f"   ❌ TruffleHog scan failed: {e}")
+                logger.info("   💡 Continuing with other scanners...")
+
         # Run Trivy
         if self.enable_trivy and self.trivy_scanner:
             try: