tl;dr Today we’re launching the Secrets Revocation Program to start revoking the 1.4 million API keys we’ve confirmed are live and leaked on GitHub, Docker Hub, npm, Hugging Face and more. Telling developers their keys leaked doesn’t get them turned off: 81% of the keys we reported last year still worked six months later. We’re inviting every company that issues API keys to join the program and revoke the keys, for free.
TruffleSec's research in internet-scale secret detection is widely recognized across the industry. We are thrilled to partner with them to further protect our customers.
with
How the program works
In October alone, our research team scanned 6 petabytes of public code, packages, container images, AI datasets and apps. That’s more than 20 petabytes this year. TruffleHog tests every key it finds, so a key only reaches its issuer if it works right now. Then the company that issued it kills it.
We look everywhere
TruffleHog verifies
Detector Type: HuggingFace
Raw result: hf_••••••••••Qx2
✅ Found verified result 🐷🔑
Detector Type: Vercel
Raw result: ••••••••••7Lm
✅ Found verified result 🐷🔑
Detector Type: Resend
Raw result: re_••••••••••a9F
The issuer kills it
Detector Type: HuggingFace
Raw result:
✕ Revoked by issuer
Detector Type: Vercel
Raw result:
✕ Revoked by issuer
Detector Type: Resend
Raw result:
Three out of every four Resend keys we delivered came from Docker images. More than half of the Vercel keys in our analysis came from Hugging Face datasets. Both sources sit outside GitHub’s secret-scanning partner program, which covers public GitHub repositories and npm.
For issuers already partnered with GitHub, this program adds another route to exposed customer keys.
Issue API keys? Join here.
It's free and takes a two-page agreement. The keys we find for you are already sitting in public, and they work. Let's turn them off.
Not sure it's worth it? Ask us how many of your customers' keys we found this month.
AI is making the problem so much worse
AI agents now write a big share of the code on GitHub. GitHub says more than 40% of pull requests in September started as an agent’s first draft, up from 17% in March. They leak keys the same way people do. Until mid-2025, not one commit that leaked a working key was signed by an AI agent. By May 2026, 6.8% were.
They also leave keys in new places. We found a working GitLab token in .claude/settings.local.json inside a published Docker image. Since January 2025 we’ve found 2,655 working keys in AI coding tools’ config files like that one. In 2024 we found none.
Attackers are using AI too. During OpenAI’s July cyber evaluation, agents found 14 working Hugging Face tokens with write access in a public dataset. Less than a day later, Hugging Face’s production credentials were on their message board.
Stolen keys feed AI in another way: model distillation. An attacker uses someone else’s API key to pay for millions of answers from a frontier model, then trains a model of their own on them. Anthropic has reported distillation proxies running on stolen credentials, and OpenCode said an October breach of its hosted Console was related to a large-scale distillation attack. Google’s threat intelligence team watched another attacker plan, build and run a mass credential-harvesting campaign in under six hours.
AI is creating more leaked keys, and attackers can now find and use them at machine speed. We aren’t ready for that until most of the keys already sitting in public are dead.
Google switched from notifying to automatically revoking. The difference we measured was significant
The usual response to a leaked key is a notification: someone emails the developer, or tells the company that issued the key, which emails the developer.
We’ve measured how that goes. Last year we reported 21,981 live keys we found on GitLab and Bitbucket. Six months later, 81% still worked.
Google has tried both approaches on the same kind of key. When a Google Cloud service-account key leaked to GitHub, Google used to tell the customer. On June 16, 2024, it started disabling leaked keys by default. We sorted every leaked Google Cloud key in The Stack v3, a public snapshot of GitHub, by when it was committed, and checked which ones still worked in July 2026.
It isn’t zero because customers can opt out and Google only disables the leaks it detects. But the drop starts right when the policy changed, and of the 69,041 Google Cloud keys in The Stack that still work, 96% leaked before the switch.
It’s the same everywhere we looked. Hugging Face, GitHub, Anthropic, OpenAI and Slack kill keys reported to them, and at most 2.2% of theirs in The Stack still work. Telegram has no way for anyone else to report a leaked bot token, and 53% of those still work.
Leaked keys don’t die on their own
In July, we tested every key in The Stack v3, a public snapshot of GitHub that closed in August 2025. 543,699 still worked.
Half had been public for more than two years. A leaked key keeps working until the company that issued it turns it off, and for these, nobody did.
The Stack is one snapshot of one site. We also scan Docker Hub, npm, PyPI, GitLab, Hugging Face datasets, Android apps and Firefox add-ons, plus everything new pushed to GitHub.
The pile keeps growing. In October we found a new working key every two and a half minutes.
23 companies issued 80% of the keys
Leaked keys aren’t spread evenly. We traced the working keys from the past year back to the companies that issued them. 459 companies show up. Six issued half of the keys we could trace. Twenty-three issued 80%.
Twilio, one of the 23, is joining. Our pipeline is also holding 43,699 verified keys for issuers that haven’t signed up yet. Here are our partners next to the rest of the 23.
