Truffle Security launches program to revoke 1.4 million live secrets

Truffle Security has launched the Secrets Revocation Program, a free initiative to help API key issuers revoke 1.4 million publicly exposed secrets that remain valid.

The company says it has found exposed secrets in public repositories, packages, container images, datasets, and applications since 2022. Earlier this year, it reported finding 543,000 valid credentials in public GitHub repositories. In a separate investigation, it identified more than 431,000 AWS secrets across repositories, Git histories, datasets, Docker images, registries, and CI logs.

According to Truffle Security, many exposed keys remain active because their owners do not respond to researchers’ notifications. The company said 81% of the keys it reported last year still worked six months later. It also said researchers have found 2,655 working keys in AI coding tools’ configuration files since January 2025.

The program uses TruffleHog to check whether leaked keys are valid and coordinate revocation with their issuers. Issuers can provide a revocation endpoint or receive verified keys through a webhook; Truffle Security says it will revoke keys within 14 days. Sixteen issuers have joined, including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio.

Truffle Security points to Google’s automatic disabling of exposed Google Cloud service-account keys, which began on June 16, 2024. It said the share of exposed secrets that remained active fell from 72% when Google relied on owner notifications to 11% after automatic disabling. Customers can opt out, so the company says not all valid exposed keys can be eliminated.