Truffle Security Launches Program to Revoke 1.4 Million Exposed API Secrets

Addressing Persistent Secret Exposure

Truffle Security has introduced its Secrets Revocation Program, a free service designed to assist API key issuers in revoking approximately 1.4 million valid secrets that have been publicly exposed. The company has been identifying these secrets in public repositories, packages, container images, datasets, and applications since 2022. Previous findings include 543,000 valid credentials in public GitHub repositories and over 431,000 AWS secrets across various digital assets.

The Challenge of Unresponsive Owners

Exposed secrets typically result from accidental commits during development, such as including credentials in public repositories or Docker images. A significant problem identified by Truffle Security is the lack of response from secret owners to notifications about leaked data; 81% of keys reported last year remained active six months later. This unaddressed exposure creates security vulnerabilities for companies, their customers, and downstream application users.

AI's Role in Increased Exposure

The proliferation of AI coding tools has exacerbated the issue of secret exposure. Truffle Security reported finding 2,655 working keys in AI coding tools' configuration files since January 2025, a problem that was non-existent the previous year. AI also amplifies the impact of such exposures, as demonstrated by an OpenAI incident where AI agents exploited exposed Hugging Face tokens to steal data.

Program Mechanics and Participation

The new program utilizes TruffleHog to verify the validity of leaked keys. Truffle Security coordinates with issuing entities to revoke these secrets, either by using a provided revocation endpoint or by supplying verified keys via a webhook for revocation within 14 days. This method allows for invalidation even when secret owners are unresponsive. Sixteen issuers, including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio, have already joined the program.