Truffle Security

This account is verified. Learn more

@trufflesec

The TruffleHog company

We find credentials, with open source

tiktok.com/@trufflesecuri…
youtube.com/c/TruffleSecur…

trufflesecurity.com Joined January 2019

1 Following 5.1K Followers 494 Posts

Latest posts 5

Truffle Security @trufflesec 5d

🤝 Hugging Face, Vercel, Notion, Resend, Twilio and 11 more are now revoking the leaked secrets we find in public.

Why? 81% of the keys we disclosed last year still worked 6 months later.

Issue API keys? Join the Secrets Revocation Program, free.

👉 trufflesecurity.com/blog/launching…

Truffle Security @trufflesec 6d

🤔 “What will break if we revoke this?”
That question keeps leaked secrets live. It has an answer:
🔍 Check last-used data
🔁 Issue the new key first
⏸️ Disable, don’t delete
✅ Retest the old one
👉 trufflesecurity.com/blog/revoking-…

Truffle Security @trufflesec Oct 29

🔍 Search your Slack for “AKIA”.

Your AWS keys live in a vault with rotation, policy, and an audit trail. The copy pasted into a thread during an 11pm build fix has none of that. It works just as well. 🔑

Deleting the message isn’t revoking the secret.
👉 trufflesecurity.com/blog/the-vault…

Truffle Security @trufflesec Oct 28

Truffle Security is collaborating with Google Cloud to make exposed secrets easier to act on.

TruffleHog Enterprise finds and verifies them. GCP Analyze maps the identity, permissions, and resources behind them, then re-verifies after rotation.

trufflesecurity.com/blog/truffle-s…

Truffle Security @trufflesec Oct 23

There's going to be a lot more secrets revoked in the coming months.

Socket @SocketSecurity Oct 23

🚨 New investigation: Socket found malicious LiteLLM workflows running 11 days before the attack, targeting 20 secrets including GitHub, cloud, and AI credentials.

After our disclosure, LiteLLM linked a stolen token to approval of the malicious release.

socket.dev/blog/litellm-a…
View quoted post on X