Catch-up: this programme was announced on 4 November by the security firm behind it — a vendor initiative, not an attack or a breach. Truffle Security has launched a free programme to switch off 1.4 million API keys, tokens and other credentials that its researchers found exposed in public code — and that still work.

The programme aims to coordinate revocation of exposed secrets with the companies that issued them. Truffle Security says it will either use a revocation endpoint supplied by the issuer or hand over the verified keys through a webhook, with revocation within 14 days.

Most leaked keys are never switched off

Truffle Security's research team scans GitHub, GitLab, Docker Hub, npm, PyPI, Hugging Face, Android apps and Firefox add-ons — more than 20 petabytes of data so far this year — and says it has verified 1.4 million live credentials across the public internet.

Its own studies show how rarely leaked keys are dealt with. In a 2025 study it disclosed 21,981 live keys found on GitLab and Bitbucket; six months later, 81% were still valid. An analysis of The Stack v3, a public GitHub snapshot, found 543,699 credentials still authenticating in July 2026, half publicly exposed for more than two years. In August 2026, 64,024 leaked AWS keys were re-verified and 88% were still active.

Sixteen issuers have already joined the programme, including Hugging Face, Notion, Vercel, Resend, RubyGems and Twilio. Any organisation that issues credentials can join, and the programme is available now in early access.

The announcement does not establish that the exposed credentials were exploited — but a live key in a public repository is an open door, and the figures suggest most are never closed.

Sources: BleepingComputer, Truffle Security launches program to revoke 1.4 million live secrets, 5 November 2026; BusinessWire, Truffle Security launches Secrets Revocation Program, 4 November 2026; VentureBeat, Truffle Security launches secrets revocation program, 4–5 November 2026.