Skip to content
Truffle Security Launches Secrets Revocation Program for 1.4 Million Exposed Keys

Truffle Security Launches Secrets Revocation Program for 1.4 Million Exposed Keys

First seen 5 Nov 2026, 20:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 5, 2026 at 20:48 UTC
  • •Truffle Security's program targets 1.4 million exposed API keys.
  • •81% of previously reported keys remained active after six months.
  • •AI coding tools have increased the exposure of secrets significantly.

Truffle Security has initiated the Secrets Revocation Program to revoke 1.4 million exposed API keys found in public repositories, including GitHub and Docker Hub. The program aims to address the issue of unresponsive key owners, as 81% of reported keys remained active six months after notification. The company identified over 543,000 credentials on GitHub and 431,000 AWS secrets across various code repositories. The rise of AI coding tools has exacerbated the problem, with 2,655 exposed keys found in AI-generated configuration files since January 2025. Sixteen organizations, including Hugging Face and Twilio, have joined the program, which utilizes the TruffleHog tool to verify and revoke keys. The program allows for unilateral revocation, which has proven effective in reducing active exposed keys significantly. Truffle Security encourages API key issuers to participate in this free initiative to enhance security.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 9h ago How this analysis works

Timeline

2026-11-05
Secrets Revocation Program launched
Truffle Security announced the launch of a program to revoke 1.4 million exposed API keys found across various platforms.
BleepingComputer
2026-11-05
AI tools identified as a risk factor
Truffle Security reported that AI coding tools have contributed to the exposure of 2,655 keys in configuration files since January 2025.
trufflesecurity.com

More articles in this cluster (3)

Following this threat?

Track Google in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 2

Common questions

How many keys are being revoked?
The program targets 1.4 million exposed API keys identified across various platforms.
What is the main issue with exposed keys?
The main issue is that 81% of previously reported keys remained active, indicating unresponsiveness from key owners.
How can companies join the program?
Companies can join the program for free by signing a two-page agreement with Truffle Security.