Truffle Security will get your leaked API keys revoked

If one of your API keys is sitting in a public repo, a Docker image or a dataset, it may stop working soon. Truffle Security, the company behind the open-source TruffleHog scanner, launched a Secrets Revocation Program on November 4. The plan: send leaked API keys straight to the companies that issued them and have those keys turned off. Twilio, Vercel, Resend, Hugging Face and Notion are among the 16 issuers that signed up. That's good security. It's also a surprise outage if a leaked key is the one your checkout emails run on.

What actually happened

Truffle's launch post gives the numbers:

• 1.4 million keys found since 2022 that still worked when tested. They came from GitHub, GitLab, Docker Hub, npm, PyPI, Hugging Face, Android apps and Firefox add-ons.
• Telling developers didn't work. Truffle reported 21,981 live keys found on GitLab and Bitbucket last year. Six months later, 81% still worked.
• Revocation does work. Google started disabling leaked Google Cloud service-account keys by default in June 2024. Of keys leaked before that, 72% still work. Of keys leaked after it, 11%.
• How issuers join. They give Truffle a revocation endpoint, and keys die as soon as they're verified. Or they get verified keys by webhook and agree to revoke them within 14 days.
• Where the keys hide. Three of every four Resend keys Truffle delivered came from Docker images. More than half of the Vercel keys came from Hugging Face datasets. GitHub's own secret scanning doesn't cover either place.

AI coding tools make it worse. Truffle says it has found 2,655 working keys in AI tools' config files since January 2025, including a GitLab token in a .claude/settings.local.json inside a published Docker image. We wrote about that same file two days ago. SC Media also covered the launch.

Why leaked API key revocation matters for your business

A leaked key has two outcomes now. An attacker uses it, or the issuer kills it. Both happen at a time you didn't pick. Our order of work:

1. Scan before they do. Run TruffleHog against your repos, your built Docker images and anything you've pushed to Hugging Face or npm. Check your built images, not just your source.
2. Rotate anything it finds. Assume a key that leaked once is already compromised.
3. Make rotation boring. Keys belong in your host's environment variables or a secret manager, never in code or image layers. Swapping one should take five minutes and one redeploy.
4. Watch the inbox the issuer emails. If Twilio or Resend revokes a key, their notice goes to the account owner. Make sure that's an address someone actually reads.

Sources: Truffle Security, SC Media.