Project
Open-source secret-scanning tool that detects exposed API keys, credentials, and tokens across code repositories, git history, and other text sources.
Truffle Security retested 10,616 publicly leaked AWS credentials and 88 percent still authenticated. The median key was about five years old and had no successor.
Perspective Coverage
4 publishersReality
Anthropic says an alleged ShinyHunters member decompiled apps pulled from multiple stores and routed verified TruffleHog hits into a Telegram channel sorted by service, and those credentials opened most of his confirmed breaches.
Perspective Coverage
6 publishersReality
September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.
Reality
A dev.to design essay argues CI was sized for human review speed and proposes tiering checks by cost and failure probability. Its figures are examples, so the case rests on the failure modes it names.
Reality
The credential was in history[].created_by, expanded there by a RUN command that took a build argument, inside a Harbor project anyone could pull anonymously. Baseten rotated it about 17 hours after the disclosure email.
Reality
Okta's read of one Telegram stealer dump shows commodity malware now hoovering up AI session tokens and API keys, and a replayed token walks past MFA because the second factor was spent when the token was minted.
Reality
The keys work because they are keys. A standard sk_live carries refunds and sometimes payouts. The fix that matters today is rotation. The fix that lasts is a document root that refuses to serve dotfiles.
Reality
Codecov in 2021 and tj-actions/changed-files in March 2025 failed the same way: trusted third-party code running with pipeline privileges on a push nobody on your team made.
Reality