Exposed API Keys: Truffle Security Says 1.4 Million Leaked Secrets Still Work and Starts Revoking Them, and How to Check Yours

Truffle Security says it has found about 1.4 million leaked secrets, mostly API keys and tokens, that still work. It has started a free program that lets the companies who issued those keys revoke them. If your business has ever put a key in code, a container image or an AI tool's settings file, that key could be switched off without warning, or it could already be in someone else's hands.

This post covers what the program does, which parts are confirmed and which are only claimed, and what to check this week.

What happened

On Wednesday, November 4, 2026, Truffle Security published "Introducing the Secrets Revocation Program: revoking 1.4 million live secrets." Truffle makes TruffleHog, a tool that finds leaked keys. Its scanning covers public code, packages, container images, AI datasets and apps. The post names GitHub, GitLab, Docker Hub, npm, PyPI, Hugging Face, Android apps and Firefox add-ons. Truffle tests every key it finds and passes a key to its issuer only if it works at that moment.

Issuers who join pick one of two options:

• "We revoke for you": the issuer provides a revocation endpoint. Truffle revokes each key as soon as it is verified, and the issuer tells its customer.
• "Your team revokes": Truffle sends verified keys by webhook, along with where each was found. The issuer revokes them within 14 days or explains why it can't.

Truffle says sixteen issuers have joined. It names six: Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio. Joining is free and takes a two-page agreement.

One news report put 1.5 million in its headline. Truffle's own post says 1.4 million, so that is the figure used here.

What is confirmed and what is only claimed

Confirmed by the primary sources:

• The program exists and works as described above, according to Truffle's announcement.
• Google Cloud has disabled leaked service account keys by default since June 16, 2024, and Google has published how that works.

Claimed by Truffle Security, not independently verified:

• 1.4 million live, leaked secrets found since 2022.
• 81% of the 21,981 live keys it reported to owners last year on GitLab and Bitbucket still worked six months later.
• While Google only notified customers, about 72% of leaked Google Cloud keys still worked. After Google began disabling them, only 11% did.
• 543,699 keys in The Stack v3, a large public collection of source code, still worked when tested in July 2026. The oldest was committed in November 2009.
• Since January 2025, 2,655 working keys were found in the config files of AI coding tools.

Not known:

• The other ten issuers in the program.
• Whether attackers have used any of these keys.
• Whether your keys are in the set. Truffle offers no lookup for key owners. Its post is aimed at issuers.

Why exposed API keys matter for a business

An API key gives access to a paid service you use. With your Twilio key, someone can send texts on your bill. With a Vercel token, they may be able to change your website. A Hugging Face token with write access can let them alter your models or datasets. Truffle gives one example: during OpenAI's July cyber evaluation, AI agents found 14 working Hugging Face tokens with write access and reached production secrets less than a day later.

Revocation cuts the other way too. If an issuer revokes a key your business still relies on, whatever uses it stops working. That could be the contact form that sends email, the system that texts appointment reminders, or the process that deploys your website. Revoking a leaked key is the right outcome, but you want a replacement ready before it happens.

The leaks were not only in code repositories. Truffle says three of every four leaked Resend keys came from Docker images, and more than half of the Vercel keys came from Hugging Face datasets. It says GitHub's secret-scanning partner program covers neither source. If your developers only watch GitHub, they may be missing where your keys actually leaked.

How to check if your API keys are exposed

There is no public list to search, so you have to check for exposure yourself:

1. Make an inventory. List every service your business connects to with a key: email sending, SMS, payments, hosting, AI tools, cloud storage. Note who owns each key and where it is used.
2. Search where keys leak. Check code repositories, including old commits. Then check container images, published packages, shared datasets, build logs and AI coding tool config files.
3. Read provider security emails. Under Truffle's first option, the issuer tells you when your key has been revoked. Make sure those emails go to a monitored inbox, not to a developer who left.
4. Rotate anything that was ever public. A key that showed up in public, even briefly, should be treated as known.

What to do this week

If you run your own servers or deploy pipelines, add secret checks to the steps that build and publish your code, so a key is caught before it goes out.

Exposed API key questions people are asking

Can I look up whether my key is in the 1.4 million?

No. Truffle Security has not published a lookup. Its program reports keys to the issuers, not to the people who own them.

Will my API key be revoked without warning?

Possibly. Under the first option, Truffle revokes the key as soon as it is verified and the issuer then tells you. Under the second, the issuer has up to 14 days to act.

Which companies are taking part?

Truffle names Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio. It says ten more have joined but does not name them.

Is deleting the file from GitHub enough?

No. The key stays in the repository's history and in any copies already taken. Rotate the key at the provider.

What should I do if my API key was leaked?

Create a replacement key, put it into service, revoke the old one, then check the provider's usage logs and billing for activity you don't recognise.

Does Google Cloud already revoke leaked keys?

For service account keys, yes. Since June 16, 2024, Google disables exposed keys by default unless an organization chose WAIT_FOR_ABUSE.

The bigger lesson

Truffle's numbers point the same way: telling owners about leaked keys mostly did not get them fixed, and automatic revocation did. Your business shouldn't wait for an issuer to step in. Every key needs an owner, a place it is recorded and a plan for replacing it. That work never really finishes, especially as AI tools write more of the code, which is the point of AI Can Build Your App. Who Is Going to Keep It Running?

Want help finding and locking down your keys? See security hardening or request a quote.

Get security alerts by email, along with our free checklist, at /security-alerts.

Sources: Truffle Security: Introducing the Secrets Revocation Program; Google Cloud: Automatically disabling leaked service account keys; GitHub Docs: About push protection.