Truffle Security launches a free program for API-key issuers to revoke 1.4 million leaked keys it has confirmed still work
The keys were found on GitHub, Docker Hub, npm, Hugging Face and elsewhere. Truffle says it has found 2,655 working keys in AI coding tools' config files since January 2025 (none in 2024), including a GitLab token in a .claude/settings.local.json inside a published Docker image. BleepingComputer reports 16 issuers have joined, including Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio.
For defenders: if you issue API keys, consider joining. If you use them, expect leaked keys to be revoked without warning, and keep AI-tool config files out of images and repos.
Sources: Truffle Security: Introducing the Secrets Revocation Program (Nov 4) · BleepingComputer: Truffle Security launches program to revoke 1.4 million live secrets (Nov 5)