Truffle Security Launches Free Program to Revoke 1.4 Million Exposed Secrets
Initiative targets publicly leaked API keys and tokens still valid across global services
Key Takeaways
- Truffle Security launched the Secrets Revocation Program on November 5, 2026, as a free initiative to revoke exposed secrets.
- The program targets approximately 1.4 million publicly exposed API keys and tokens that remain valid.
- The initiative assists API key issuers in revoking compromised credentials to reduce misuse risk.
- No independent verification of the 1.4 million figure or issuer participation has been conducted.
- The program represents a mitigation effort rather than a software patch or vulnerability fix.
Quick answers
- What happened?
- Truffle Security has introduced the Secrets Revocation Program, a free service designed to help API key issuers revoke approximately 1.4 million publicly exposed secrets that remain valid. The program aims to reduce the risk of credential misuse by enabling issuers to identify and revoke compromised API keys and tokens at scale.
- What should defenders do?
- API key issuers and developers are encouraged to participate in the Secrets Revocation Program to revoke exposed credentials. Organizations should rotate compromised secrets, rotate API keys regularly, and use secret scanning tools to prevent future exposure.
Truffle Security announced the launch of the Secrets Revocation Program on November 5, 2026. The free initiative assists API key issuers in revoking roughly 1.4 million publicly exposed secrets that are still valid. The program addresses the ongoing risk posed by credentials accidentally committed to version control, code repositories, or other public locations. By providing a structured revocation pathway, the initiative seeks to prevent threat actors from exploiting exposed API keys to gain unauthorized access to systems and services. The company noted that the exact count of 1.4 million secrets and issuer participation remain as reported, with no independent verification of the full scope or effectiveness of the program to date.
Security Details
The Secrets Revocation Program is a free service that helps API key issuers revoke approximately 1.4 million publicly exposed secrets that remain valid. The program addresses the risk of compromised credentials being abused by threat actors. No software vulnerability or CVE is associated with this announcement.
Mitigation
API key issuers and developers are encouraged to participate in the Secrets Revocation Program to revoke exposed credentials. Organizations should rotate compromised secrets, rotate API keys regularly, and use secret scanning tools to prevent future exposure.
Sources
BleepingComputer
Truffle Security launches program to revoke 1.4 million live secrets
Nov 5, 2026 · 20:15
Original link
Related Security News
CISA, NSA, and ASD Release Joint Guidance on Post-Quantum Cryptography Vendor Readiness
CISA, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), and the National Security Agency (NSA) have released joint guidance and a quick-reference list to help organizations evaluate vendor readiness for transitioning to post-quantum cryptography (PQC). The advisory emphasizes that reliance on third-party vendors for managed services, cloud capabilities, and embedded cryptography in devices such as IoT and industrial control systems necessitates early engagement. The vendor-neutral questions aim to determine whether vendors understand quantum-related risks, maintain transparency over cryptographic implementations, and support a secure and timely transition to PQC before cryptographically relevant quantum computers (CRQCs) become available.
