---
title: Truffle Security launches a free program for API-key issuers to revoke 1.4 million leaked keys it has confirmed still work | ctxsec
url: https://ctxsec.com/items/truffle-security-secrets-revocation-program-1-4m-live-leaked-keys
description: "Truffle says 81% of 21,981 live keys it reported on GitLab and Bitbucket last year still worked six months later, so it now offers issuers either an endpoint where keys die as soon as they're verified, or a webhook feed of verified keys to revoke within 14 days."
status: "official (Truffle Security announcement, Nov 4)"
published: 2026-11-04
---

> Truffle says 81% of 21,981 live keys it reported on GitLab and Bitbucket last year still worked six months later, so it now offers issuers either an endpoint where keys die as soon as they're verified, or a webhook feed of verified keys to revoke within 14 days.

[← Industry News](/industry) · [markdown](/items/truffle-security-secrets-revocation-program-1-4m-live-leaked-keys.md)

official (Truffle Security announcement, Nov 4)

2026-11-04

### Truffle Security launches a free program for API-key issuers to revoke 1.4 million leaked keys it has confirmed still work

The keys were found on GitHub, Docker Hub, npm, Hugging Face and elsewhere. Truffle says it has found 2,655 working keys in AI coding tools' config files since January 2025 (none in 2024), including a GitLab token in a `.claude/settings.local.json` inside a published Docker image. BleepingComputer reports 16 issuers have joined, including Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio.

**For defenders:** if you issue API keys, consider joining. If you use them, expect leaked keys to be revoked without warning, and keep AI-tool config files out of images and repos.

Sources: [Truffle Security: Introducing the Secrets Revocation Program (Nov 4)](https://trufflesecurity.com/blog/launching-the-secrets-revocation-program) · [BleepingComputer: Truffle Security launches program to revoke 1.4 million live secrets (Nov 5)](https://www.bleepingcomputer.com/news/security/truffle-security-launches-program-to-revoke-14-million-live-secrets/)