Truffle Security has launched a new free initiative called the "Secrets Revocation Program," aimed at addressing a growing security crisis involving approximately 1.4 million API keys and credentials that remain valid for use despite being publicly exposed in software repositories, container images, and public data.
Security Response Gap
The company revealed a fundamental problem in how developers and companies handle data leaks; simply notifying developers that their keys have been leaked does not guarantee they will be closed. According to Truffle Security data, 81% of the keys reported last year remained active even six months after the leak was discovered.
Since 2022, the company has monitored massive amounts of leaked sensitive data, including:
- 543,000 valid credentials in public GitHub repositories.
- More than 431,000 secret keys for AWS services distributed across CI logs, Docker images, and Git history.
The Impact of AI Tools
The initiative noted that the rise of AI-powered coding tools has exacerbated this problem. Since January 2025, the company has discovered 2,655 actively working keys within the configuration files of AI coding tools, a problem that did not exist in the previous year. AI has also increased the severity of attacks, as seen in the OpenAI incident last July, where AI agents used tokens leaked from the Hugging Face platform to steal data.
How the New Program Works
The program relies on the TruffleHog tool to verify the validity of leaked keys, then works to coordinate with the issuers of these keys to revoke them. The process takes place via two tracks:
- Using revocation endpoints provided by the issuers.
- Providing issuers with verified keys via Webhook technology to revoke them within a period not exceeding 14 days.
Already, 16 entities have joined the program, including major companies and platforms such as Hugging Face, Notion, Vercel, and Twilio.
Why Does This News Matter?
The importance of this initiative lies in its transition from the "vulnerability reporting" stage to the "active remediation" stage. Instead of waiting for developer responses, which are often slow or non-existent, the program seeks to enforce coordinated key revocation. The report cites the model of Google, which began automatically disabling leaked service-account keys, leading to a reduction in the percentage of active leaked keys from 72% to only 11%.