Truffle Security has launched the Secrets Revocation Program, a free initiative that lets any company issuing credentials revoke customers' exposed secrets, such as API keys and tokens, as the San Francisco company finds them in public code, packages, container images, and AI datasets. The program starts with 1.4 million verified, live credentials. Notification alone has not worked: of 21,981 live keys that Truffle Security disclosed in a 2025 study, 81% were still valid six months later. Revocation performs better. After Google Cloud began disabling leaked service-account keys in June 2024, 11% of keys committed in the following year still worked, versus 72% before the change. Issuers can receive verified keys through a webhook, or provide an endpoint so Truffle Security can revoke them automatically. The program is open now in early access.

Truffle Security launches Secrets Revocation Program to revoke 1.4 million leaked secrets. Any company that issues credentials can join for free and have its customers' exposed secrets revoked as Truffle Security finds them; 81% of leaked secrets reported last year still worked six months later San Francisco, CA, November 4, 2026 - Truffle Security, the company that makes it easy to find, verify, and remediate secrets, today announced the Secrets Revocation Program, a free initiative through which issuers revoke customer secrets - including API keys, tokens, and other credentials - that Truffle Security finds exposed in public code, packages, container images, and AI datasets. The program launches with 1.4 million verified, live credentials identified by Truffle Security research and is open to any organization that issues credentials. Notification alone has proven insufficient to remediate exposed credentials. In a 2025 study, Truffle Security disclosed 21,981 live keys found on GitLab and Bitbucket to their owners and issuers; six months later, 81% remained valid. A separate analysis of The Stack v3, a public snapshot of GitHub, identified 543,699 credentials that still authenticated in July 2026, half of which had been publicly exposed for more than two years. AI-enabled attackers are collecting on decades of security debt Exposed credentials represent long-standing security debt. In August 2026, Truffle Security research re-verified 64,024 leaked AWS keys and found that 88% remained active. The median live key was approximately five years old, 768 granted full administrative control of a corporate AWS account, and 929 had previously been flagged under AWS's compromised-key quarantine policy, in some cases more than three years earlier, yet were still live. AI has changed the speed at which that debt is discovered and exploited. Google Threat Intelligence Group reported in September that an attacker used AI to plan, build, and execute a mass credential-harvesting campaign in under six hours. In October, OpenCode disclosed that API keys stored in its hosted Console were exposed and linked the breach to a large-scale model distillation attack. Later that month, Northflank advised customers to assume every stored secret had been decrypted after AI API keys held on the platform were used without authorization. "Every live key sitting in public is a bigger liability than it was a year ago. The fastest way to get ahead of that is for issuers to revoke what's already out there, and we built this program so they can do it for free." - Dylan Ayrey, CEO and founder of Truffle Security Revocation, not notification, is the proven path The evidence that revocation outperforms notification is measurable. When Google Cloud switched its default response to leaked service-account keys from notifying customers to disabling the key in June 2024, Truffle Security's July 2026 analysis of The Stack v3 found that 72% of its keys committed in the year before the change still authenticated, compared with 11% of keys committed in the year after. Issuers that revoke on report, including Hugging Face, GitHub, Anthropic, OpenAI, and Slack, had no more than 2.2% of their exposed keys still valid. Those results have been limited to individual issuers acting on the leaks they detect themselves. The Secrets Revocation Program applies the same approach to every issuer and every public source. How the program works Truffle Security's research team scans GitHub, GitLab, Docker Hub, npm, PyPI, Hugging Face, Android apps, and Firefox add-ons - more than 20 petabytes so far this year. TruffleHog tests every key it finds, so program participants are only notified when a finding is live. Issuers can receive verified keys through a webhook and revoke them on their own, or provide a revocation endpoint and let Truffle Security revoke them automatically. Participation is free. "TruffleSec's research in internet-scale secret detection is widely recognized across the industry. We are thrilled to partner with them to further protect our customers." - Mukund Sarma, VP of Security at Vercel Truffle Security intends to lead the cleanup of publicly exposed secrets. The company has already verified 1.4 million live credentials across the public internet; the Secrets Revocation Program is how those keys, and every one found after them, get turned off. Join the Secrets Revocation Program The Secrets Revocation Program is available now in early access to any organization that issues credentials. * Read the blog on the Secrets Revocation Program * Learn more and join at the Secrets Revocation Program About Truffle Security Truffle Security Co. helps organizations reduce the risk of secret sprawl. As the company behind TruffleHog, a leading open-source secrets scanning tool, Truffle Security Co. brings proven detection and verification capabilities to the growing challenge of securing non-human identities and their secrets. Through TruffleHog Enterprise, organizations gain visibility into secret exposure across their environments, understand the access those secrets carry, and confirm when risks have been eliminated.