diff --git a/.tangled/workflows/trufflehog-scan.yaml b/.tangled/workflows/trufflehog-scan.yaml
new file mode 100644
index 0000000..1d3310a
--- /dev/null
+++ b/.tangled/workflows/trufflehog-scan.yaml
@@ -0,0 +1,15 @@
+when:
+  - event: ["push", "manual"]
+    branch: ["stable", "develop", "bugfix/*", "feature/*", "refactor/*"]
+  - event: ["pull_request"]
+    branch: ["stable"]
+
+engine: "nixery"
+
+dependencies:
+  nixpkgs:
+    - trufflehog
+
+steps:
+  - name: "TruffleHog: scan for exposed secrets"
+    command: "trufflehog git --only-verified file://."