Nearly 1.5 million exposed secrets targeted in new revocation program

Truffle Security has launched the Secrets Revocation Program, a free initiative that helps API key issuers revoke 1.4 million publicly exposed secrets that remain valid.

Since 2022, the company has discovered secrets embedded in public repositories, packages, container images, datasets, and applications.

Earlier this year, Truffle Security reported that it had found 543,000 valid credentials leaked in public GitHub repositories.

In a separate investigation, the company identified more than 431,000 AWS secrets across code repositories, Git histories, datasets, Docker images, registries, and CI logs.

These secrets are typically exposed by mistake during the development process, by committing credentials to a public repository, including them in published Docker images or packages, or leaving them in configuration files uploaded with an app or dataset.