Security firm will shut off 1.4 million leaked digital keys itself

A security firm is no longer waiting for companies to clean up their own mess. Truffle Security has launched a free program to shut off about 1.4 million leaked digital keys that still work, even when the owners never respond to warnings. Sixteen companies have already signed up, including Notion, Twilio, Vercel and Hugging Face.

What leaked keys are

An API key is a kind of password that lets one piece of software talk to another service. Security people call these keys "secrets." Anyone who finds a working key may be able to use it as if they were the owner. Truffle Security says it has found such keys in public code repositories, packages, container images, datasets and apps since 2022.

Why warnings are not enough

Most leaks are mistakes made during development. A developer might upload a key to a public repository, include it in a published package, or leave it in a configuration file shipped with an app. The firm says telling people does not fix it. In its words, 81% of the keys it reported last year still worked six months later.

AI coding tools are making this worse, according to the researchers. Since January 2025, they found 2,655 working keys in the settings files of those tools. They say that was a non-existent problem the year before.

How the program works

Truffle uses its TruffleHog tool to check whether a leaked key still works. It then coordinates with the company that issued the key. It can use a shutoff tool the company provides, or send the company the verified keys and revoke them within 14 days. The point is that keys get turned off even if the owner stays silent.

Proof the approach works

Google offers an example. On June 16, 2024, it began disabling exposed Google Cloud service-account keys by default. When Google only notified owners, 72% of exposed secrets stayed active. After automatic shutoff, the figure fell to 11%. Not every key can be caught, since customers can opt out of automatic revocation.

Why it matters to you

A leaked key at a company you use can put your data at risk. The researchers point to OpenAI's July incident, where AI agents used exposed Hugging Face tokens to steal data from that platform. Business owners can ask software vendors how fast they shut off leaked keys, and whether they take part in programs like this one.