Truffle Security Opens Free Secrets Revocation Program With 1.4 Million Live Credentials

Truffle Security launched the Secrets Revocation Program, a free initiative through which credential issuers revoke customer API keys, tokens and other secrets that the company finds exposed in public code, packages, container images and AI datasets. The program opens with 1.4 million verified, live credentials identified by Truffle Security research, Business Wire reported on November 4, 2026.

How the Truffle Security Revocation Program Works

Any organization that issues credentials can join the program at no cost. Truffle Security's research team scans GitHub, GitLab, Docker Hub, npm, PyPI, Hugging Face, Android apps and Firefox add-ons, more than 20 petabytes so far this year. TruffleHog tests every key it finds, so participants are notified only when a finding is live.

Issuers can receive verified keys through a webhook and revoke them on their own, or provide a revocation endpoint and let Truffle Security revoke them automatically. The program is available now in early access.

Truffle Security pointed to its own research as the case for revocation over notification. In a 2025 study, it disclosed 21,981 live keys found on GitLab and Bitbucket to their owners and issuers; six months later, 81% remained valid. A separate analysis of The Stack v3, a public snapshot of GitHub, identified 543,699 credentials that still authenticated in July 2026, half of which had been publicly exposed for more than two years.

In August 2026, Truffle Security re-verified 64,024 leaked AWS keys and found that 88% remained active. The median live key was approximately five years old, 768 granted full administrative control of a corporate AWS account, and 929 had previously been flagged under AWS's compromised-key quarantine policy, in some cases more than three years earlier.

"Every live key sitting in public is a bigger liability than it was a year ago. The fastest way to get ahead of that is for issuers to revoke what's already out there, and we built this program so they can do it for free," said Dylan Ayrey, CEO and founder of Truffle Security.

Mukund Sarma, VP of Security at Vercel, said: "TruffleSec's research in internet-scale secret detection is widely recognized across the industry. We are thrilled to partner with them to further protect our customers."

Truffle Security's Funding and Scanning Record

Truffle Security raised a $25 million Series B round co-led by Intel Capital and Andreessen Horowitz in November 2025, with participation from Abstract, Lytical Ventures and SignalRank, according to akta.pro company records. The same records list a $15 million Series A led by Andreessen Horowitz in December 2021 and total funding of $40 million. The records also show more than 250,000 daily runs by developers and security teams using TruffleHog and more than 23,000 GitHub stars.

Early Access Availability

The Secrets Revocation Program is available now in early access to any organization that issues credentials, with details on joining published on Truffle Security's program page.