Truffle Security has launched a free Secrets Revocation Program to help API key issuers disable 1.4 million secrets that remain active and publicly accessible. The company says exposed credentials continue to create risks for organizations, their customers, and downstream application users because many key owners do not respond to notifications about leaked data.
Since 2022, Truffle Security has found secrets embedded in public repositories, packages, container images, datasets, and applications. Earlier this year, the company reported discovering 543,000 valid credentials compromised in a public GitHub repository.
In a separate investigation, Truffle Security identified more than 431,000 AWS secrets across code repositories, Git history, datasets, Docker images, registries, and continuous integration logs.
These secrets are often exposed accidentally during development. Examples include publishing credentials inside a Docker image or package, committing them to a public repository, or leaving them in a configuration file uploaded with an application or dataset.
Truffle Security says that notifying developers about compromised keys is not enough to protect them. “Telling a developer that a key has been compromised doesn’t turn it off. 81% of the keys we reported last year were still working six months later,” the company explained.
Active compromised secrets can therefore expose not only the affected organization, but also its customers and users of downstream applications.
Source: Truffle Security
AI coding tools add to secret exposure
Researchers say the growing use of AI coding tools is worsening the problem by creating additional opportunities for secrets to be exposed.
“Since January 2025, we found 2,655 such keys in the configuration files of AI coding tools,” the researchers said, noting that they had not found this issue during the previous year.
AI can also increase the potential impact of exposed credentials. The risk was demonstrated by OpenAI’s July incident, in which data was stolen from the platform using exposed Hugging Face tokens.
Revoking a published key
Truffle Security’s program uses the TruffleHog tool to check whether leaked keys are valid and coordinate their revocation with the organizations that issued them.
Issuers can use the revocation endpoints provided by participating entities or submit a verified key through a webhook for revocation within 14 days. This allows a key to be disabled even when its owner does not respond to notification.
Source: Truffle Security
Sixteen publishers have joined the program, including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio.
Truffle Security says unilateral revocation can be effective, pointing to Google’s decision to disable published Google Cloud service account keys by default on June 16, 2024.
When Google relied solely on notifying key owners, Truffle Security found that many customers did not respond and 72% of exposed sensitive information remained active. Automatically disabling compromised keys reduced that figure to 11%.
Customers can opt out of automatic revocation, and it remains impossible to remove every valid public key. However, Truffle Security says the approach has proven effective.
Companies that issue API keys can participate in Truffle Security’s Secret Revocation Program to help protect their customers automatically.
Source: www.bleepingcomputer.com