Company
Security company known for TruffleHog, an open-source tool for scanning code repositories to detect and verify exposed secrets like API keys and credentials.
Truffle Security retested 10,616 publicly leaked AWS credentials and 88 percent still authenticated. The median key was about five years old and had no successor.
Perspective Coverage
4 publishersReality
Truffle Security found 543,699 credentials in public GitHub code that still authenticated in July 2026, in files a median 784 days old. GitHub's push-time blocking cannot reach keys already published, and those keys stay live until an owner or issuer revokes them.
Reality
Truffle Security scanned 224 million public GitHub repositories and found 543,699 credentials still working in July, exposed for a median 784 days. Push Protection screens only new pushes in known formats, so owners have to rotate the backlog themselves.
Reality
More than 100 spam gems pushed to RubyGems.org in May ran code on RubyDoc.info's docs workers, a September 11 report says. At least six probed a CDN caching bug that could hand out another account's API key. RubyGems fixed that bug in July and revoked every legacy key.
Reality
The Apache team confirmed code execution is reachable under specific conditions, said the issue was already triaged, and told the community its volunteers have better uses for their time. Teams that scrambled were tracking circulating reports, not upstream guidance.
Reality
A sweep of public code, datasets and CI logs found 768 AWS keys with full account control. The containment policy AWS applies to detected leaks still permits deleting the audit trail.
Reality