Secrets Revocation Program Targets 1.4M Live Leaked Keys

Telling developers that their API keys leaked has never been enough to get those keys switched off. Truffle Security, the company behind the open-source TruffleHog scanner, says 81% of the keys it reported last year still worked six months later. Its new Secrets Revocation Program, launched on November 4, takes a more direct route: it works with the companies that issue keys so they can revoke exposed ones themselves.

• The program targets 1.4 million publicly exposed secrets that Truffle has verified are still valid
• It is free for API key issuers to join
• Sixteen issuers have signed up, including Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio
• Issuers can revoke keys through an endpoint, or receive verified keys by webhook and revoke within 14 days

How Does the Secrets Revocation Program Work?

Truffle has been collecting leaked credentials since 2022 from public repositories, packages, container images, datasets and apps. TruffleHog checks whether each one still works. The program then sends those verified, live keys to the company that issued them.

There are two ways in. An issuer can expose a revocation endpoint that Truffle calls directly, or it can take the verified keys through a webhook and revoke them itself within 14 days. Either way, the key dies even if its owner never reads the warning email. That is the important shift. Revocation no longer depends on a busy developer noticing a notification.

Does Automatic Key Revocation Actually Work?

There is good evidence that it does. Truffle points to Google's decision to start disabling exposed Google Cloud service-account keys by default on June 16, 2024. When Google relied only on notifying owners, Truffle found that 72% of exposed secrets stayed active. After automatic disabling, that figure fell to 11%, according to the company. Customers can still opt out, so no program reaches zero, but the drop is large.

The same idea sits behind efforts like the ORKS standard for revocable API keys, which aims to make revocation a built-in feature rather than an afterthought.

Why AI Coding Tools Raise the Stakes

Truffle says AI coding assistants have created a new leak path. Since January 2025 it has found 2,655 working keys in AI coding tools' config files, a category that barely existed the year before. Truffle has also reported 543,000 valid credentials in public GitHub repositories and more than 431,000 AWS secrets across code, images and CI logs.

What Developers and API Providers Can Do

For API providers, the message is simple: joining costs nothing and protects your customers even when they miss an alert. For developers, prevention is still the best fix. Keep keys in a secrets manager, add pre-commit scanning, and turn on push protection, as covered in our piece on GitHub's AI secret detection. More defensive tools are in our AI security coverage.

Sources: Truffle Security — November 4, 2026; BleepingComputer — November 5, 2026.