Truffle Security launched a free Secrets Revocation Program to help API key issuers turn off about 1.4 million publicly exposed secrets that are still valid, BleepingComputer reports. (That’s the number in the article; don’t go by the “14 million” in some URL text.)
Why it exists
- 81% of keys Truffle reported last year still worked six months later
- Since January 2025 they’ve found 2,655 working keys in AI coding tools’ config files, basically a new problem
- Sixteen issuers have joined so far, including Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio
- Issuers can expose a revocation endpoint, or get verified keys by webhook and revoke within 14 days
My take
Revoking at the issuer beats hoping a developer answers email. If you issue tokens, join. If you consume them, scan your repos and rotate anything that’s ever been near a public tree. See my Git history how-to.
God Bless, and May the Source Be with You!
