Truffle Security has introduced the Secrets Revocation Program to address the widespread issue of publicly exposed API keys, as first reported by Bleeping Computer.
The initiative aims to invalidate 1.4 million active secrets discovered across public repositories, container images, and datasets. Since 2022, researchers have identified hundreds of thousands of valid credentials, including Amazon Web Services keys, often leaked by developers during the coding process. Despite notifications, 81% of these keys remained active six months later. The rise of AI coding tools has exacerbated the problem, with thousands of working keys appearing in configuration files since January 2025.
To mitigate these risks, the program coordinates with 16 service providers, such as Hugging Face and Twilio, to automate the revocation of exposed credentials. This approach mirrors successful efforts by Google, which reduced the number of active leaked service-account keys from 72% to 11% by implementing automatic disabling. By utilizing the TruffleHog tool, the program allows issuers to invalidate compromised keys via webhooks or dedicated endpoints within 14 days. This proactive strategy protects downstream users and companies from unauthorized access, even when the original owners fail to respond to security alerts.
Source: Bleeping Computer
