Truffle Security Launches Program to Revoke 1.4 Million Exposed Secrets
Summary
Truffle Security launched a program to coordinate revocation of 1.4 million publicly exposed, still-valid secrets. Sixteen issuers have joined; the company says 81% of keys it reported last year remained active six months later.
Key points
- The free Secrets Revocation Program aims to revoke 1.4 million publicly exposed secrets that remain valid.
- TruffleHog checks leaked keys; participating issuers can provide a revocation endpoint or receive verified keys through a webhook for revocation within 14 days.
- Sixteen issuers have joined, including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio.
- Truffle Security says 81% of keys it reported last year still worked six months later.
- The company says automatic disabling reduced the share of exposed Google Cloud service-account keys that remained active from 72% to 11%.
- Truffle Security reported finding 2,655 working keys in AI coding tools’ configuration files since January 2025.
Article Details
- Event Type
- Launch of Truffle Security’s free Secrets Revocation Program to coordinate revocation of publicly exposed, still-valid secrets.
- Impact
- The program targets 1.4 million publicly exposed secrets and can verify leaked keys and coordinate their revocation with issuers, including through issuer-provided endpoints or within 14 days via webhook. Truffle Security reported that 81% of keys it notified owners about remained active six months later. It also reported that Google’s automatic disabling of exposed service-account keys reduced the share of exposed secrets remaining active from 72% to 11%. Exposed credentials can put affected companies, their customers, and downstream application users at risk.
Vendors
Amazon Web ServicesIn a separate investigation, the company identified more than 431,000 AWS secrets across code repositories, Git histories, datasets, Docker images, registries, and CI logs.GoogleTruffle says the unilateral revocation approach can be very effective, as demonstrated by Google when it began disabling exposed Google Cloud service-account keys by default on June 16, 2024.Hugging FaceAI is also increasing the impact of exposure on the offensive side, as shown by OpenAI’s July incident, where AI agents used exposed Hugging Face tokens to steal data from the platform.NotionSixteen issuers have already joined the program, including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio.OpenAIAI is also increasing the impact of exposure on the offensive side, as shown by OpenAI’s July incident, where AI agents used exposed Hugging Face tokens to steal data from the platform.ResendSixteen issuers have already joined the program, including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio.RubyGemsSixteen issuers have already joined the program, including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio.Truffle SecurityTruffle Security has launched the Secrets Revocation Program, a free initiative that helps API key issuers revoke 1.4 million publicly exposed secrets that remain valid.TwilioSixteen issuers have already joined the program, including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio.VercelSixteen issuers have already joined the program, including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio.