What signals and metrics do you track to operate TruffleHog well?

Operating a scanner is not "turn it on" — it needs the same observability as any production system. For TruffleHog, the signals that matter are verified vs unverified findings, and the verified-secret count trending toward zero over time.

Trend them. Rising Critical counts on a stable codebase usually means a base image or dependency has aged, not that developers got careless. A rising false-positive rate is an early warning that the gate is about to lose the team's trust. Scan duration matters because a slow gate is a gate people route around.

Feed these into a dashboard alongside remediation SLAs so security posture is visible to the people who own it, not buried in a tool nobody logs into.