1.4 million: the number of publicly exposed, still-valid secrets that Truffle Security says its new program will help revoke.
Truffle Security's Secrets Revocation Program
Truffle Security has launched the Secrets Revocation Program, a free initiative designed to coordinate the invalidation of live API keys and other secrets discovered in public artifacts. The company says the program will either call a revocation endpoint provided by key issuers or supply verified keys via a webhook and revoke them within 14 days when issuers do not respond. Truffle Security uses its TruffleHog tool to test and validate leaked keys before attempting revocation.
Scale of exposed secrets found since 2022
Since 2022, Truffle Security reports it has found secrets embedded in public repositories, packages, container images, datasets, and applications. The company earlier reported finding 543,000 valid credentials leaked in public GitHub repositories, and in a separate investigation it identified more than 431,000 AWS secrets across code repositories, Git histories, datasets, Docker images, registries, and CI logs. Those discoveries underpin the claim that 1.4 million publicly exposed secrets remain valid and accessible.
Truffle Security frames the exposure as a development-time problem: credentials are typically exposed by mistake—committed into public repositories, included in published Docker images or packages, or left in configuration files uploaded with an app or dataset.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAI coding tools and OpenAI's July incident
The researchers note that the rise of AI coding tools has increased both the frequency and the impact of secret exposures. “Since January 2025 we’ve found 2,655 working keys in AI coding tools’ config files like that one,” the researchers said, adding that the problem was non-existent the year before. Truffle Security also cites OpenAI’s July incident as an example of how exposed tokens can be abused: the company reported AI agents used exposed Hugging Face tokens to steal data from the platform.
Revocation mechanics, TruffleHog, and participating issuers
Truffle Security says its program validates leaked keys with TruffleHog and then coordinates revocation steps with the entities that issued the keys. When an issuer supplies a revocation endpoint, Truffle will use it; where no endpoint exists, Truffle can supply the verified keys by webhook and revoke them within 14 days. Sixteen issuers have already joined the program, the company says, including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio.
Truffle points to Google’s prior action as an example of how unilateral revocation can change outcomes. The company notes that when Google began disabling exposed Google Cloud service-account keys by default on June 16, 2024, the share of exposed secrets that remained active fell: Truffle Security found that when Google relied only on notifying key owners, 72% of exposed secrets remained active; after automatically disabling leaked keys the figure was reduced to 11%. Truffle concedes that complete elimination of valid exposed keys is impossible because customers can opt out of automatic revocation, but it presents the Google numbers as proof the approach can be effective.
What this means for API key issuers, developers, and downstream users
- API key issuers: Companies that issue API keys can join Truffle Security’s program to automatically protect customers’ keys by providing revocation endpoints or accepting webhook-supplied verified keys. Early participation by 16 issuers suggests some providers are willing to enable automated revocation.
- Developers and development teams: The report underscores persistent unresponsiveness to notifications: “Telling developers their keys leaked doesn’t get them turned off: 81% of the keys we reported last year still worked six months later,” the company explained. That pattern is central to Truffle’s rationale for automated revocation.
- Downstream application users and customers: Truffle warns exposed secrets pose risks that can extend beyond affected companies to their customers and downstream application users. The OpenAI example is cited to show how exposed tokens can be exploited by AI agents to extract data from third-party platforms.
Truffle Security’s program packages detection, validation, and a route to unilateral or coordinated revocation into a single offering. The company presents numerical evidence that notification alone often fails to neutralize live secrets, and that automated disabling—where issuers enable it—can significantly reduce the number of active leaked keys. Whether the approach will materially narrow the 1.4 million figure depends on how many issuers adopt revocation endpoints or accept webhook-supplied keys and on how many customers opt out of automatic disabling.
