Truffle Security launches free program to revoke 1.4 million exposed working secrets
Sixteen issuers have joined so far, and the company argues that issuers acting directly works better than relying on owners to rotate keys.
Truffle Security has opened a free Secrets Revocation Program aimed at about 1.4 million publicly exposed credentials that still work. The company says notifying owners has failed, since 81% of keys it reported last year were still valid six months later. Under the program, issuers can either use a revocation endpoint or receive verified keys via webhook and revoke them within 14 days. Sixteen issuers, including Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio, have already joined. Truffle points to Google's default disabling of exposed service-account keys from June 2024 as evidence that unilateral revocation works, with automatic disabling cutting the share of exposed secrets left active from 72% to 11%.
Why it matters
Notifying key owners has not worked well: Truffle reports that 81% of the keys it flagged last year were still valid six months later. The program shifts the job of cutting off exposed credentials to the companies that issue them, which can revoke keys without waiting for each owner to act. Truffle points to Google's default disabling of exposed service-account keys as evidence this approach can work, since the share of exposed secrets still active fell from 72% to 11% after it began. Whether other issuers follow that pattern will show how far issuer-side revocation can reduce long-lived exposure.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.