Truffle Security Launches Secrets Revocation Program to Revoke 1.4 Million Live Exposed Credentials
Truffle Security, maker of the TruffleHog secret-scanning tool, has launched a free Secrets Revocation Program aimed at revoking roughly 1.4 million live, publicly exposed API keys, tokens and other credentials found across public code repositories, packages, container images, datasets and applications. The initiative addresses a long-standing gap in secrets security: simply notifying affected organizations rarely results in revocation, since Truffle Security found that 81% of keys it reported as leaked last year still worked six months later. The company also noted that AI coding tools have worsened the problem, having uncovered 2,655 working keys in AI coding tools' configuration files since January 2025, a category of exposure that essentially did not exist the year before, and it pointed to incidents such as OpenAI's July exposure of Hugging Face tokens used by AI agents to exfiltrate data as evidence of the growing offensive impact of such leaks. Sixteen credential issuers, including Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio, have already joined the program.
Detalhes técnicos
The program relies on TruffleHog to verify the validity of discovered secrets before notifying issuers, ensuring participants are only alerted to keys that are actually live. Issuers can either provide a revocation endpoint that lets Truffle Security automatically disable exposed keys, or receive verified keys through a webhook and revoke them within 14 days themselves. Truffle Security cited Google's unilateral revocation of exposed Google Cloud service-account keys, begun on June 16, 2024, as evidence this approach works: when Google only notified customers, 72% of exposed secrets remained active, but automatic revocation cut that figure to 11%. The company acknowledges that eliminating all exposed valid keys remains impossible since customers can opt out of automatic revocation.
Remediação
Organizations that issue API keys, tokens, or other credentials are encouraged to join Truffle Security's Secrets Revocation Program to automatically detect and revoke customer secrets exposed in public code, packages, container images, and datasets, reducing the window during which leaked credentials remain exploitable.
Linha do tempo
-
Truffle Security Launches Secrets Revocation Program to Revoke 1.4 Million Live Exposed Credentials
ler a análise desta fonte ocultar
Truffle Security, maker of the TruffleHog secret-scanning tool, has launched a free Secrets Revocation Program aimed at revoking roughly 1.4 million live, publicly exposed API keys, tokens and other credentials found across public code repositories, packages, container images, datasets and applications. The initiative addresses a long-standing gap in secrets security: simply notifying affected organizations rarely results in revocation, since Truffle Security found that 81% of keys it reported as leaked last year still worked six months later. The company also noted that AI coding tools have worsened the problem, having uncovered 2,655 working keys in AI coding tools' configuration files since January 2025, a category of exposure that essentially did not exist the year before, and it pointed to incidents such as OpenAI's July exposure of Hugging Face tokens used by AI agents to exfiltrate data as evidence of the growing offensive impact of such leaks. Sixteen credential issuers, including Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio, have already joined the program.
Technical Details
The program relies on TruffleHog to verify the validity of discovered secrets before notifying issuers, ensuring participants are only alerted to keys that are actually live. Issuers can either provide a revocation endpoint that lets Truffle Security automatically disable exposed keys, or receive verified keys through a webhook and revoke them within 14 days themselves. Truffle Security cited Google's unilateral revocation of exposed Google Cloud service-account keys, begun on June 16, 2024, as evidence this approach works: when Google only notified customers, 72% of exposed secrets remained active, but automatic revocation cut that figure to 11%. The company acknowledges that eliminating all exposed valid keys remains impossible since customers can opt out of automatic revocation.
Remediation
Organizations that issue API keys, tokens, or other credentials are encouraged to join Truffle Security's Secrets Revocation Program to automatically detect and revoke customer secrets exposed in public code, packages, container images, and datasets, reducing the window during which leaked credentials remain exploitable.