unpatched/intel
Latest briefing
MonitorhighSupply Chain Security

Truffle Security launches program to revoke 1.4 million exposed API keys

By Harith Dilshan2 min read

TL;DR

Truffle Security has launched the Secrets Revocation Program to invalidate 1.4 million publicly exposed secrets. API key issuers and developers must rotate credentials found in public repositories, Docker images, or AI tool configurations to prevent unauthorized access.

What happened

Truffle Security launched a new initiative to coordinate the revocation of 1.4 million valid secrets that have been leaked across public repositories, packages, container images, and datasets. The company's research shows that many developers fail to respond to leak notifications; last year, 81% of reported keys remained active six months later.

Previous investigations by the company found 543,000 valid credentials in public GitHub repositories and over 431,000 AWS secrets hidden in Git histories, Docker images, and CI logs. Since January 2025, researchers have also identified 2,655 working keys within AI coding tool configuration files. To combat this, the new program allows sixteen participating issuers, such as Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio, to work with Truffle to invalidate exposed keys via webhooks or revocation endpoints.

Why it matters

The sheer volume of active, leaked credentials creates a massive attack surface for downstream users and customers. Relying on manual developer intervention is ineffective, as shown by the high percentage of unpatched leaks. The rise of AI coding tools has introduced a new vector for exposure, with thousands of working keys now appearing in tool configurations. Automated revocation, similar to how Google began disabling exposed Google Cloud service-account keys on June 16, 2024, is proving to be a more effective way to reduce the number of active, compromised credentials.

Who is affected

  • API key issuers
  • Developers committing credentials to public repositories, Docker images, or CI logs
  • Users of AI coding tools

What to do now

  1. Rotate any API keys or credentials found in public repositories, Git histories, datasets, or CI logs.
  2. Audit configuration files used in AI coding tools for exposed secrets.
  3. Join the Secrets Revocation Program if you are an API key issuer to automate the protection of your customers.

What we don't know yet

  • The specific number of unique companies represented within the 1.4 million exposed secrets.
  • The full list of the sixteen issuers currently participating in the revocation program.

Sources

  1. bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/truffle-security-launches-program-to-revoke-14-million-live-secrets/

Offensive security engineer, ethical hacker and penetration tester. Writes Unpatched Intel from h4rithd.com.

MonitorhighSupply Chain SecurityNew

GitHub Enterprise Server Signing Key Rotation Follows Internal Repository Breach

GitHub says a poisoned third-party VS Code extension contributed to a compromise of an employee device and exfiltration of GitHub-internal repositories. As a follow-on containment step, GitHub is rotating the GitHub Enterprise Server signing key and says GHES administrators need to update trusted GPG public keys before future upgrades will verify successfully.

6 min
MonitorhighSupply Chain SecurityNew

Red Hat Cloud Services npm Compromise Shows How Trusted Frontend Packages Can Become A Build Pipeline Risk

Red Hat says a supply chain compromise affected multiple packages in the @redhat-cloud-services npm namespace after a compromised GitHub account pushed unauthorized commits into the RedHatInsights GitHub organization. Red Hat removed the compromised versions from npm and says that, based on current findings, no customer action is required, but the incident is a strong reminder that trusted frontend dependencies can still become credential-theft and CI/CD exposure paths.

6 min
MonitorhighSupply Chain SecurityNew

Mini Shai-Hulud Targets 323 npm Packages via @antv

🚨 Active supply chain attack compromises @antv npm packages, deploying credential stealers in a 300+ package wave. 🛠 Patch immediately if running affected versions. 🕵 Mini Shai-Hulud campaign linked to ongoing exploitation.

5 min