VULNpocalypse
InformationalEcosystem changeOngoing

Truffle Security says new program targets 1.4 million live leaked secrets

Truffle Security says its free program will help issuers revoke 1.4 million exposed but valid secrets, so rotate any key you have published by mistake.

Published
Exploitation
No, the source reports no exploitation tied to the keys in this program

What happened

According to BleepingComputer, Truffle Security has launched the Secrets Revocation Program. Truffle Security describes it as a free initiative to help API key issuers revoke 1.4 million publicly exposed secrets that it says are still valid. The headline of the report puts the figure at “nearly 1.5 million”. The figures below come from Truffle Security as reported by one outlet, and no independent verification is cited.

  • Where the keys were found: Truffle Security says that since 2022 it has found secrets in public repositories, packages, container images, datasets and applications (BleepingComputer).
  • Earlier findings: BleepingComputer reports that Truffle Security previously found 543,000 valid credentials in public GitHub repositories. In a separate investigation it found more than 431,000 AWS secrets across code repositories, Git histories, datasets, Docker images, registries and CI logs.
  • Why revocation instead of notification: Truffle Security says owners often do not respond to leak notifications. “81% of the keys we reported last year still worked six months later,” the company said, as quoted by BleepingComputer.
  • AI coding tools: The researchers say they have found 2,655 working keys in AI coding tools’ config files since January 2025.
  • How the program works: BleepingComputer reports that the program uses TruffleHog to check whether leaked keys are still valid. Truffle Security then either calls a revocation endpoint provided by the issuer, or sends the verified keys to the issuer through a webhook for revocation within 14 days.
  • Who has joined: Truffle Security says sixteen issuers are in the program, including Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio. The full list is not confirmed in the source.
  • Precedent: Truffle Security points to Google, which began disabling exposed Google Cloud service-account keys by default on June 16, 2024. According to Truffle Security, 72% of exposed secrets stayed active when Google only notified owners. After automatic disabling started, that figure fell to 11%.

The specific keys covered, the full issuer list and the program’s start date for each issuer are not confirmed.

Am I affected?

  • You may be affected if a key issued by a participating service has appeared in a public repository, package, container image, dataset, app bundle or CI log. Named participants include Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio (BleepingComputer).
  • If such a key is revoked, any service still using it is likely to stop working. The source does not say whether owners are notified before revocation.
  • If you are an API key issuer, the source says you can join the program.

What to do now

  1. Search your public repositories, Git history, published packages, Docker images and CI logs for credentials. The source names TruffleHog as the tool the program uses to check validity.
  2. Rotate any key you find exposed, and update your deployments before an issuer revokes it.
  3. Check config files used by AI coding tools for stored keys. The researchers say they have found working keys in such files (BleepingComputer).
  4. If your company issues API keys, review Truffle Security’s program and decide whether to join, as described by BleepingComputer.

Sources