Key Takeaways
- • Truffle Security launched the Secrets Revocation Program, a free initiative in which credential issuers revoke customer secrets (API keys, tokens and other credentials) that Truffle Security finds exposed in public code, packages, container images and AI datasets, launching with 1.4 million verified, live credentials.
- • According to Truffle Security, 81% of leaked secrets reported in a 2025 study (21,981 live keys found on GitLab and Bitbucket) still worked six months after owners and issuers were notified.
- • An August 2026 Truffle Security re-verification of 64,024 leaked AWS keys found 88% still active, with 768 granting full administrative control of a corporate AWS account and 929 previously flagged under AWS's compromised-key quarantine policy.
- • Truffle Security cites Google Cloud's June 2024 switch from notification to disabling leaked service-account keys: 72% of keys committed in the prior year still authenticated, versus 11% committed in the year after.
- • Participation is free for any organization that issues credentials; issuers can receive verified keys via webhook or provide a revocation endpoint for automatic revocation, and the program is available now in early access.
Summary
Truffle Security, a company focused on finding, verifying and remediating exposed secrets, announced the Secrets Revocation Program, a free initiative through which credential issuers revoke customer secrets that Truffle Security identifies in public sources. The program launches with 1.4 million verified, live credentials identified through Truffle Security research and is open to any organization that issues credentials. According to the company's release distributed via Business Wire, it is available now in early access.
The company argues that notification alone has failed to remediate exposed credentials. In a 2025 study, Truffle Security disclosed 21,981 live keys found on GitLab and Bitbucket to their owners and issuers; six months later, 81% remained valid. A separate analysis of The Stack v3, a public snapshot of GitHub, identified 543,699 credentials that still authenticated in July 2026, half of which had been publicly exposed for more than two years. In August 2026, Truffle Security re-verified 64,024 leaked AWS keys and found 88% remained active, with a median key age of approximately five years.
Truffle Security links the urgency to AI-enabled attacks. It cites a Google Threat Intelligence Group report from September stating an attacker used AI to plan, build and execute a mass credential-harvesting campaign in under six hours. The release also references OpenCode's October disclosure that API keys in its hosted Console were exposed, and Northflank's advice to customers to assume stored secrets had been decrypted after AI API keys were used without authorization.
The company presents revocation as more effective than notification. It states that after Google Cloud changed its default response to leaked service-account keys from notifying customers to disabling them in June 2024, 72% of keys committed in the prior year still authenticated, compared with 11% committed in the year after, based on its July 2026 analysis of The Stack v3. It also says issuers that revoke on report, including Hugging Face, GitHub, Anthropic, OpenAI and Slack, had no more than 2.2% of exposed keys still valid. The program extends this approach across all issuers and public sources.
Truffle Security's research team scans GitHub, GitLab, Docker Hub, npm, PyPI, Hugging Face, Android apps and Firefox add-ons, having scanned more than 20 petabytes so far this year. Its TruffleHog tool tests each key, so participants are notified only when a finding is live. Issuers may receive verified keys through a webhook and revoke them independently, or supply a revocation endpoint allowing Truffle Security to revoke automatically. Vercel's VP of Security, Mukund Sarma, praised Truffle Security's research and said Vercel is pleased to partner with the company to further protect its customers.
The company argues that notification alone has failed to remediate exposed credentials. In a 2025 study, Truffle Security disclosed 21,981 live keys found on GitLab and Bitbucket to their owners and issuers; six months later, 81% remained valid. A separate analysis of The Stack v3, a public snapshot of GitHub, identified 543,699 credentials that still authenticated in July 2026, half of which had been publicly exposed for more than two years. In August 2026, Truffle Security re-verified 64,024 leaked AWS keys and found 88% remained active, with a median key age of approximately five years.
Truffle Security links the urgency to AI-enabled attacks. It cites a Google Threat Intelligence Group report from September stating an attacker used AI to plan, build and execute a mass credential-harvesting campaign in under six hours. The release also references OpenCode's October disclosure that API keys in its hosted Console were exposed, and Northflank's advice to customers to assume stored secrets had been decrypted after AI API keys were used without authorization.
The company presents revocation as more effective than notification. It states that after Google Cloud changed its default response to leaked service-account keys from notifying customers to disabling them in June 2024, 72% of keys committed in the prior year still authenticated, compared with 11% committed in the year after, based on its July 2026 analysis of The Stack v3. It also says issuers that revoke on report, including Hugging Face, GitHub, Anthropic, OpenAI and Slack, had no more than 2.2% of exposed keys still valid. The program extends this approach across all issuers and public sources.
Truffle Security's research team scans GitHub, GitLab, Docker Hub, npm, PyPI, Hugging Face, Android apps and Firefox add-ons, having scanned more than 20 petabytes so far this year. Its TruffleHog tool tests each key, so participants are notified only when a finding is live. Issuers may receive verified keys through a webhook and revoke them independently, or supply a revocation endpoint allowing Truffle Security to revoke automatically. Vercel's VP of Security, Mukund Sarma, praised Truffle Security's research and said Vercel is pleased to partner with the company to further protect its customers.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.