Truffle Security launches program to revoke 1.4 million live secrets
Program helps API key issuers revoke 1.4 million exposed secrets using TruffleHog verification and webhooks.
Truffle Security launched the Secrets Revocation Program to help revoke exposed API keys that remain valid. The company has discovered secrets in public repositories, packages, container images, datasets, and applications since 2022. Sixteen issuers including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio have joined the program. The approach combines revocation endpoints with webhooks for keys verified by TruffleHog.
- 1.4 million publicly exposed secrets
- 81% of keys reported last year still worked six months later
- 2,655 working keys found in AI coding tools config files
- 16 issuers joined the program
Impact: exposed API keys enable unauthorized access
| Product | Affected |
|---|---|
| Truffle Security Secrets Revocation Program | — |
- 1.Companies that issue API keys can join the Secrets Revocation Program
- Vendors
- Truffle Security
- Products
- API keys
From the original article
2 min read at bleepingcomputer.com
Truffle Security has launched the Secrets Revocation Program, a free initiative that helps API key issuers revoke 1. 4 million publicly exposed secrets that remain valid. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.