Secrets Revocation Program
Help us clean up the public internet. We find leaked secrets for your service, verify them and send them to you, or revoke them for you.
Participation is free. Every secret is verified with TruffleHog before it reaches you.
How it works
Step 1
Discovery
Our research team continuously scans the public internet for secrets.
Step 2
Verification
Every secret is verified using TruffleHog before we send it.
Step 3
Delivery
We send verified findings to your webhook, or start revocation through an endpoint you provide.
Where we look
GitHub
GitLab
GitLab CI
Docker
npm
PyPI
Hugging Face
Android APKs
APKPure
Firefox Add-ons
Two ways to participate
Your team revokes
Get exposed customer secrets through your webhook as we find them. Your team manages revocation and any customer follow-up.
We revoke for you
Provide a revocation endpoint, and Truffle Security automatically revokes exposed secrets as we find them.
Both options require participants to revoke disclosed secrets within 14 days of disclosure, so every exposed secret gets acted on.
Why join
Protect your users
Stop exposed secrets from being stolen or used without authorization.
Clean up the internet
Reduce the number of live secrets sitting in public sources.
Free to join
There’s no cost to participate.
Help shape the program
Send us feedback any time to help improve onboarding, delivery and revocation.
Request access
Start by verifying your work email. We review every request. Once approved, we reach out to confirm your details.
Setting up delivery or revocation? Read the integration guide