Truffle Security has unveiled the Secrets Revocation Program, a no-cost initiative designed to work with credential issuers in revoking approximately 1.4 million publicly exposed secrets that remain active and usable.
Since 2022, the firm has been uncovering secrets scattered across public repositories, software packages, container images, datasets, and applications. The company identified 543,000 valid credentials in public GitHub repositories earlier this year, and discovered more than 431,000 AWS secrets spread across code repositories, Git histories, datasets, Docker images, registries, and continuous integration logs.
Developers typically leak these secrets unintentionally during developmentâby committing credentials to public repositories, embedding them in published Docker images or packages, or leaving them in configuration files that ship with applications or datasets.
The core challenge, according to Truffle Security, is that secret owners frequently ignore researcher notifications about exposed data. "Telling developers their keys leaked doesn't get them turned off: 81% of the keys we reported last year still worked six months later," the company stated. Unrevoked secrets create ongoing security risks that extend beyond the affected organizations to their customers and end users of downstream applications.
The emergence of AI-powered coding assistants has intensified the problem. "Since January 2025 we've found 2,655 working keys in AI coding tools' config files like that one," researchers noted, describing this as a problem that did not exist a year prior. On the attack side, AI has magnified the consequences of exposure, as demonstrated by OpenAI's July incident in which AI agents exploited exposed Hugging Face tokens to access data on the platform.
Revoking exposed keys
The new program leverages the TruffleHog tool to verify the validity of leaked keys and works to coordinate revocation with the organizations that issued them. Truffle can either invoke a revocation endpoint supplied by those organizations or deliver verified keys through a webhook for revocation within 14 days, enabling key invalidation even when owners fail to respond.
Sixteen issuers have already enrolled in the program: Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio, among others.
Truffle points to Google's approach as evidence that unilateral revocation works. Beginning June 16, 2024, Google started automatically disabling exposed Google Cloud service-account keys by default. When Google relied solely on notifying key owners, Truffle Security discovered that many customers did not respond, leaving 72% of exposed secrets active. Automatic disabling of leaked keys brought that figure down to 11%.
While complete elimination of all valid exposed keys remains impossible because customers can choose to opt out of automatic revocation, the strategy has proven substantially effective. API key issuers can join Truffle Security's Secrets Revocation Program to automatically safeguard their customers.