Truffle Security, the company that makes it easy to find, verify, and remediate secrets, today announced the Secrets Revocation Program, a free initiative through which issuers revoke customer secrets, including API keys, tokens and other credentials, that Truffle Security finds exposed in public code, packages, container images and AI datasets. The program launches with 1.4 million verified, live credentials identified by Truffle Security research and is open to any organization that issues credentials.

Notification alone has proven insufficient to remediate exposed credentials. In a 2025 study, Truffle Security disclosed 21,981 live keys found on GitLab and Bitbucket to their owners and issuers; six months later, 81% remained valid. A separate analysis of The Stack v3, a public snapshot of GitHub, identified 543,699 credentials that still authenticated in July 2026, half of which had been publicly exposed for more than two years.

AI-enabled attackers are collecting on decades of security debt

Exposed credentials represent long-standing security debt. In August 2026, Truffle Security research re-verified 64,024 leaked AWS keys and found that 88% remained active. The median live key was approximately five years old, 768 granted full administrative control of a corporate AWS account, and 929 had previously been flagged under AWS’s compromised-key quarantine policy, in some cases more than three years earlier, yet were still live.

AI has changed the speed at which that debt is discovered and exploited. Google Threat Intelligence Group reported in September that an attacker used AI to plan, build and execute a mass credential-harvesting campaign in under six hours. In October, OpenCode disclosed that API keys stored in its hosted Console were exposed and linked the breach to a large-scale model distillation attack. Later that month, Northflank advised customers to assume every stored secret had been decrypted after AI API keys held on the platform were used without authorization.

“Every live key sitting in public is a bigger liability than it was a year ago. The fastest way to get ahead of that is for issuers to revoke what’s already out there, and we built this program so they can do it for free,” said Dylan Ayrey, CEO and founder of Truffle Security.

Revocation, not notification, is the proven path

The evidence that revocation outperforms notification is measurable. When Google Cloud switched its default response to leaked service-account keys from notifying customers to disabling the key in June 2024, Truffle Security’s July 2026 analysis of The Stack v3 found that 72% of its keys committed in the year before the change still authenticated, compared with 11% of keys committed in the year after. Issuers that revoke on report, including Hugging Face, GitHub, Anthropic, OpenAI and Slack, had no more than 2.2% of their exposed keys still valid.

Those results have been limited to individual issuers acting on the leaks they detect themselves. The Secrets Revocation Program applies the same approach to every issuer and every public source.

How the program works

Truffle Security’s research team scans GitHub, GitLab, Docker Hub, npm, PyPI, Hugging Face, Android apps and Firefox add-ons, more than 20 petabytes so far this year. TruffleHog tests every key it finds, so program participants are only notified in the event the finding is live. Issuers can receive verified keys through a webhook and revoke them on their own, or provide a revocation endpoint and let Truffle Security revoke them automatically. Participation is free.

“TruffleSec’s research in internet-scale secret detection is widely recognized across the industry. We are thrilled to partner with them to further protect our customers.” Mukund Sarma, VP of Security at Vercel.

Truffle Security intends to lead the cleanup of publicly exposed secrets. The company has already verified 1.4 million live credentials across the public internet; the Secrets Revocation Program is how those keys, and every one found after them, get turned off.

Join the Secrets Revocation Program

The Secrets Revocation Program is available now in early access to any organization that issues credentials.

Media gallery

About The Author
Business Wire