Home / Technology / 81% of Leaked Secrets Still Work: New Program Fights Back
81% of Leaked Secrets Still Work: New Program Fights Back
5 Nov
Summary
- Companies can join a free program to revoke exposed customer credentials.
- 81% of leaked secrets remained valid six months after being reported.
- AI accelerates the discovery and exploitation of exposed credentials.
Truffle Security has introduced the Secrets Revocation Program, a free service enabling organizations to revoke exposed customer credentials, including API keys and tokens, discovered in public repositories and datasets. This initiative addresses the persistent issue of leaked secrets, as an alarming 81% of those reported last year remained valid six months later. Research from July 2026 revealed hundreds of thousands of credentials that still authenticated after years of exposure.
AI-driven attacks are accelerating the exploitation of this long-standing security debt. Recent reports indicate attackers using AI to rapidly discover and leverage exposed credentials. In response, Truffle Security's program focuses on revocation rather than just notification. Evidence shows that when issuers like Google Cloud disable compromised keys, their validity rates drop significantly. Companies that proactively revoke secrets, such as Hugging Face and OpenAI, have seen minimal remaining exposed keys.
The Secrets Revocation Program scans over 20 petabytes of data across various public sources, including GitHub and Docker Hub. It verifies findings in real-time, notifying participants of live credentials. Issuers can integrate via webhook for automatic revocation or manage the process themselves. Vercel has already partnered with Truffle Security, expressing enthusiasm for the program's ability to enhance customer protection.
