Truffle Security launches free programme to revoke 1.4 million live leaked secrets

TLDR

• Truffle Security says its programme starts with 1.4 million verified, live leaked credentials, and issuers can join free.²⁴
• Issuers either give Truffle a revocation endpoint or get verified keys by webhook and revoke within 14 days.²
• Truffle says 81 per cent of live keys it reported last year still worked six months later.²⁴

BleepingComputer reports that Truffle Security has launched the Secrets Revocation Program, a free initiative that helps API key issuers revoke 1.4 million publicly exposed secrets that remain valid.¹ In its launch post of 4 November 2026, Truffle says the secrets are confirmed live and leaked on GitHub, Docker Hub, npm, Hugging Face and more.² The programme is in early access to any organisation that issues credentials.⁴ Sixteen issuers have joined, including Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio, and Truffle says its pipeline is holding a further 43,699 verified keys for issuers that have not yet joined.¹²

On where the secrets were found, Truffle says its researchers scanned 6 petabytes of public code, packages, container images, AI datasets and apps in October alone, and more than 20 petabytes so far this year.² The sources it lists are GitHub, GitLab, Docker Hub, npm, PyPI, Hugging Face, Android apps and Firefox add-ons.² Truffle says more than one million leaked keys passed its tests in the past year, 1.4 million since 2022, and that in October it found a new working key every two and a half minutes.² It says three out of every four Resend keys it delivered came from Docker images and more than half of the Vercel keys in its analysis came from Hugging Face datasets, both sources that sit outside GitHub's secret-scanning partner programme, which covers public GitHub repositories and npm.² Since January 2025 it has also found 2,655 working keys in the configuration files of AI coding tools, and none in 2024.²

Revocation works in one of two ways. TruffleHog tests every key it finds, so an issuer only hears about keys that work at that moment.² In the first option the issuer points Truffle at a revocation endpoint and keys are revoked as soon as they are verified; in the second Truffle sends verified keys by webhook, with where they were found, and the issuer revokes within 14 days or explains why it cannot.² Resend, a launch partner, says it disables a reported key as soon as the report arrives, emails all account admins with a link to where the key was found, and applies this by default to every account.³ Resend already revoked keys exposed on public GitHub after becoming a GitHub secret scanning partner in July.³ Truffle's case for revoking rather than notifying rests on Google Cloud, which began disabling leaked service-account keys by default on 16 June 2024: in Truffle's July 2026 check of The Stack v3, a public snapshot of GitHub, 72 per cent of keys leaked while Google only notified customers still worked, against 11 per cent after the change.²⁴ BleepingComputer notes that customers can opt out of automatic revocation, so not every valid exposed key can be eliminated.¹

All of the headline figures are Truffle Security's own measurements, published in its launch post and press release.²⁴ The sources differ on some details. BleepingComputer's headline says nearly 1.5 million secrets while its text and Truffle say 1.4 million.¹² BleepingComputer cites 543,000 valid credentials found in public GitHub repositories earlier this year and a separate finding of more than 431,000 AWS secrets, whereas Truffle's materials describe 543,699 keys that still authenticated in July 2026 from The Stack v3, which closed in August 2025, and an August 2026 re-verification of 64,024 leaked AWS keys, 88 per cent of them still active.¹²⁴ BleepingComputer describes OpenAI's July incident as AI agents using exposed Hugging Face tokens to steal data from the platform, while Truffle describes agents in OpenAI's July cyber evaluation finding 14 working Hugging Face tokens with write access in a public dataset and, less than a day later, holding Hugging Face's production secrets.¹²

Why it matters: Truffle says notification left 81 per cent of reported keys working six months on, while issuers that revoke on report had at most 2.2 per cent of their exposed keys still valid.²