Overview
Truffle Security has launched the Secrets Revocation Program, a free initiative to help API key issuers revoke roughly 1.4 million publicly exposed secrets that are still valid. The aim is to close the gap between finding a leaked credential and actually killing it.
The Problem
Since 2022, Truffle has found secrets in public repositories, packages, container images, datasets and applications. Earlier in 2026 it reported 543,000 valid credentials in public GitHub repositories, and a separate investigation found more than 431,000 AWS secrets.
Notifying owners is not working well: Truffle reports that 81% of the keys it reported last year still worked six months later. It has also found 2,655 working keys in AI coding tool configuration files since January 2025, and the article cites a July OpenAI incident in which AI agents used exposed Hugging Face tokens to steal data.
How the Program Works
- Truffle uses TruffleHog to verify that leaked keys are live.
- Issuers either provide a revocation endpoint or receive verified keys through a webhook.
- Revocation is expected within 14 days.
- Sixteen issuers have joined so far, including Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio.
- Companies that issue API keys can join to protect their customers automatically.
Evidence That Auto-Revocation Works
Google began disabling exposed Google Cloud service-account keys by default on June 16, 2024. Truffle found that notification alone left 72% of exposed secrets active, while automatic disabling cut that to 11%. Customers can opt out of automatic revocation, so not every valid key can be eliminated.
What Developers Should Do
- Assume any committed secret is compromised, even in a deleted commit or private-turned-public repository. Rotate it, don't just remove it.
- Scan continuously with a secrets scanner in pre-commit hooks and CI, and include container images, packages and AI tool config files in scope.
- Prefer short-lived credentials (OIDC federation, workload identity) over long-lived static keys.
- Scope keys narrowly and set expiry so a leaked key has limited value.
- If you issue API keys, consider joining the program or exposing a revocation endpoint.