Truffle Security launches program to revoke 1.4 million live secrets

Truffle Security has officially launched the Secrets Revocation Program, a free initiative designed to help API key issuers invalidate 1.4 million publicly exposed secrets that are still active. This project addresses the critical issue of leaked credentials in public repositories, container images, and configuration files that remain valid long after initial discovery.

• The program uses the TruffleHog tool to verify and coordinate the revocation of leaked keys.
• 81% of reported keys remained functional six months after initial notifications to owners.
• AI coding tools are significantly increasing the frequency of secrets exposure in config files.
• 16 major issuers, including Notion, Vercel, and Twilio, are already participating.

The challenge of unresponsiveness

The primary issue identified by Truffle Security is the lack of urgency among developers when notified about leaked data. Because developers often ignore security alerts, millions of credentials stay active, posing ongoing risks to businesses and their customers. Leaked secrets often occur accidentally during the development process, such as hardcoding keys in public Git history or publishing them in Docker images.

AI and the rising threat landscape

The integration of AI coding assistants has exacerbated the problem. Since early 2025, researchers have found thousands of valid keys buried within configuration files generated by these AI tools. Moreover, AI agents are now being used by attackers to exploit exposed tokens, as demonstrated by the July incident involving Hugging Face, where AI agents were utilized to steal data.

Automating security

The program enables unilateral revocation through webhooks and API endpoints, ensuring that even if key owners fail to respond, the credentials can be invalidated within 14 days. Evidence from Google’s proactive approach, which saw active leaked secrets drop from 72% to 11% through automatic disabling, serves as a proof of concept for this initiative.

Global impact and corporate security

For organizations globally, this program marks a shift toward 'default-secure' practices. By automating the revocation process, companies can significantly reduce their attack surface. Implementing such measures is critical for any firm that provides API-based services, as it protects downstream users and mitigates the consequences of unintentional human errors in code deployments.