Photo: FlyD / Unsplash
Security firm Truffle Security said Wednesday it has confirmed 1.4 million leaked API keys and other credentials are still live and usable on platforms including GitHub, Docker Hub, npm and Hugging Face, and launched a free program to help companies shut them down.
In a blog post, the company said most of the keys had been public for more than two years and keep working until the issuer revokes them. Its new Secrets Revocation Program lets any company that issues API keys have Truffle-reported leaks revoked directly, under a two-page agreement.
The figures are the company’s own findings. Truffle said Google’s automatic-revocation policy has sharply cut working Google Cloud keys: of 69,041 such keys in its dataset that still function, 96% leaked before the policy took effect. Hugging Face, GitHub, Anthropic, OpenAI and Slack revoke keys reported to them, and at most 2.2% of theirs in the dataset still work. Telegram, which the company said has no channel for reporting leaked bot tokens, had 53% still working.
The launch comes as AI coding tools multiply the number of credentials committed to public repositories. Truffle argues notification alone has failed: developers receive an email, and the key stays live.
JBizNews Desk | New York
© JBizNews.com. All rights reserved. Unauthorized reproduction or redistribution is strictly prohibited.
