Nearly 1.5 million exposed secrets targeted in new revocation program
Nearly million disclosed that a credential was leaked, exposing a trust relationship that could have been abused.
Nearly million disclosed that a credential was leaked, exposing a trust relationship that could have been abused.
Truffle Security has launched the Secrets Revocation Program, a free initiative that helps API key issuers revoke 1.4 million publicly exposed secrets that remain valid.
Since 2022, the company has discovered secrets embedded in public repositories, packages, container images, datasets, and applications.
Earlier this year, Truffle Security reported that it had found 543,000 valid credentials leaked in public GitHub repositories.
In a separate investigation, the company identified more than 431,000 AWS secrets across code repositories, Git histories, datasets, Docker images, registries, and CI logs.
Truffle’s new program, which uses the TruffleHog tool to check for the validity of leaked keys, aims to coordinate the revocation of exposed secrets with the entities that issued them.
Anyone connected to Nearly million through the compromised trust relationship is potentially affected, not just Nearly million itself.
The real exposure here isn't the organization that leaked the credential -- it's everyone downstream who trusted the resulting package or update without knowing where it actually came from.
As a result, exposed secrets pose unnecessary security risks that can extend beyond the affected companies to their customers and downstream application users.
There's no patch for a leaked credential the way there is for a code flaw; the only fix is making sure it's actually dead, not just flagged as risky.
These secrets are typically exposed by mistake during the development process, by committing credentials to a public repository, including them in published Docker images or packages, or leaving them in configuration files uploaded with an app or dataset.
The researchers note that the rise of AI coding tools has only worsened the situation, increasing secrets exposure even more.
The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.
AI is also increasing the impact of exposure on the offensive side, as shown by OpenAI’s July incident, where AI agents used exposed Hugging Face tokens to steal data from the platform.
Truffle says it can either use a revocation endpoint provided by those entities, or supply them with the verified keys through a webhook and revoke them within 14 days.
Nearly million says the credential has been revoked, and no exploitation has been confirmed so far.
When Google relied only on notifying key owners, Truffle Security found that many customers failed to respond, leaving 72% of the exposed secrets active.
If you have any integration or dependency involving Nearly million, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Whether you installed any package, image, or update from the affected registry during the exposure window is worth checking, since the compromise travels through the artifact, not just the original leak.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.
What happened
Nearly million disclosed that a credential was leaked, exposing a trust relationship that could have been abused.
Truffle Security has launched the Secrets Revocation Program, a free initiative that helps API key issuers revoke 1.4 million publicly exposed secrets that remain valid.
Since 2022, the company has discovered secrets embedded in public repositories, packages, container images, datasets, and applications.
What changed
Earlier this year, Truffle Security reported that it had found 543,000 valid credentials leaked in public GitHub repositories.
In a separate investigation, the company identified more than 431,000 AWS secrets across code repositories, Git histories, datasets, Docker images, registries, and CI logs.
Truffle’s new program, which uses the TruffleHog tool to check for the validity of leaked keys, aims to coordinate the revocation of exposed secrets with the entities that issued them.
Who is affected
Anyone connected to Nearly million through the compromised trust relationship is potentially affected, not just Nearly million itself.
The real exposure here isn't the organization that leaked the credential -- it's everyone downstream who trusted the resulting package or update without knowing where it actually came from.
As a result, exposed secrets pose unnecessary security risks that can extend beyond the affected companies to their customers and downstream application users.
Why it matters
There's no patch for a leaked credential the way there is for a code flaw; the only fix is making sure it's actually dead, not just flagged as risky.
These secrets are typically exposed by mistake during the development process, by committing credentials to a public repository, including them in published Docker images or packages, or leaving them in configuration files uploaded with an app or dataset.
The researchers note that the rise of AI coding tools has only worsened the situation, increasing secrets exposure even more.
Technical details
The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.
AI is also increasing the impact of exposure on the offensive side, as shown by OpenAI’s July incident, where AI agents used exposed Hugging Face tokens to steal data from the platform.
Truffle says it can either use a revocation endpoint provided by those entities, or supply them with the verified keys through a webhook and revoke them within 14 days.
Response
Nearly million says the credential has been revoked, and no exploitation has been confirmed so far.
When Google relied only on notifying key owners, Truffle Security found that many customers failed to respond, leaving 72% of the exposed secrets active.
What security teams should do
If you have any integration or dependency involving Nearly million, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Whether you installed any package, image, or update from the affected registry during the exposure window is worth checking, since the compromise travels through the artifact, not just the original leak.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.