Truffle says 81% of the leaked keys it reported still worked six months later
By Lior AharonovFounder, 7IT Solutions ·
What happened
Truffle Security has launched a Secrets Revocation Program, BleepingComputer reported on 5 November. It checks leaked keys with TruffleHog and has 16 issuers, such as Vercel and Twilio, revoke them within 14 days. Of the keys it reported last year, 81% still worked six months later.
Why it matters
A key pushed to a public repo, a Docker image or a package can stay live long after the commit is gone. Telling the owner has not been enough. Now the provider may kill the key on its own, in the middle of your deploy.
What to do
Run TruffleHog over your repos, Git history, images and AI coding tool config folders today. Rotate every live hit, then move keys into a secrets manager.
My take
Lior Aharonov
Founder, 7IT Solutions
A leaked key is not fixed when you delete the commit. It is fixed when the key stops working.
Sources
| BleepingComputer: Truffle Security launches program to revoke leaked secrets | bleepingcomputer.com |
Researched with AI tools; every fact is checked against the linked sources.