Truffle Security said on 4 November 2026 that it is launching the Secrets Revocation Program to start revoking 1.4 million secrets it has confirmed are live and leaked on GitHub, Docker Hub, npm, Hugging Face and more.

Truffle says telling developers their keys leaked does not get them turned off: 81% of the keys it reported last year still worked six months later. It invites every company that issues API keys to join for free, either by pointing Truffle at a revocation endpoint so keys die as soon as TruffleHog verifies them, or by receiving verified keys by webhook and revoking within 14 days.

Truffle says that in October alone its research team scanned 6 petabytes of public code, packages, container images, AI datasets and apps, and that keys only reach an issuer if TruffleHog verifies they work right now. It names Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio among early partners (sixteen issuers have joined, according to BleepingComputer).

Truffle also says that since January 2025 it has found 2,655 working keys in AI coding tools' config files, a pattern it says did not exist the year before. (source: Truffle Security)

BleepingComputer reported the launch on 5 November 2026 and separately noted Truffle's earlier findings of 543,000 valid credentials in public GitHub repositories and more than 431,000 AWS secrets across repositories, histories, datasets, Docker images, registries and CI logs. (source: BleepingComputer)