Truffle Security

The TruffleHog company

We find credentials, with open source

[Truffle Security @trufflesec]

NEW RESEARCH
🔎 Between August 2022 and August 2026🚨
🔥 Over 700 Leaked Corporate AWS Keys Held Full Admin Rights.

💵Only 9.5% had billing alarms; million dollar bills waiting to happen.

🧐 We're launching TruffleHog AWS Analyze to help.

👉
https://t.co/PwXM6ku6Q8

[Truffle Security @trufflesec]

NEW RESEARCH
🔎 Between August 2022 and August 2026🚨
🔥 Over 700 Leaked Corporate AWS Keys Held Full Admin Rights.

💵Only 9.5% had billing alarms; million dollar bills waiting to happen.

🧐 We're launching TruffleHog AWS Analyze to help.

👉
https://t.co/PwXM6ku6Q8

[Intel Capital @intelcapital]

AI #agents don't just need permissions. In a recent @Inc Magazine article, @TruffleSec CEO Dylan Ayrey made the case that AI agents need the same security scrutiny we give human users, if not more. As AI evolves, so does the need for agent #security.

Read the full article below:

[Truffle Security @trufflesec]

Our CEO @InsecureNature on the rogue agent incidents at OpenAI, Anthropic and Meta: the bar for hacking used to be subject matter expertise, and now the models have it.

[Inc. @Inc]

Cybersecurity experts raise the alarm about AI agents and hacking vulnerabilities. https://t.co/Y9BYRig5xm

[Truffle Security @trufflesec]

🚨 Your AI-generated images may be leaking more than you think

⚠️ Every ComfyUI image embeds prompts, file paths, API keys & GPS data - even from nodes that never ran

🔎 2.49M Discord images scanned: 159,752 leaked metadata, 681 had live API keys

👉https://t.co/VC5cDjhbiX

[Truffle Security @trufflesec]

NO COMMENT. 🔑 😶😶😶

[Ludvig Rask @ludvigrask_]

Manage your go subscription ⚙️

[Truffle Security @trufflesec]

🚨TruffleHog Enterprise is now on the Slack Marketplace!

🔎Scan every message, channel & DM for leaked secrets: historical + continuous

Also: 📊 Activity Log for scan visibility + 🗄️ Source Archiving to retire integrations without losing findings.

👉 https://t.co/mVFUlby3vI

[Julien Chaumond @julien_c]

Happy to partner with @trufflesec to help them perform the largest secret scan of AI training data ever 🙏

[Truffle Security @trufflesec]

On scanning all the HuggingFace training data.

[Truffle Security @trufflesec]

We scanned HuggingFace. 👇👇👇

This was the largest secret scan of AI training data ever: 7.6 PB. 🔑🔑🔑🔑🔑🔑🔑🔑🔑

🔍Found 221,303 live unique credentials in 6,003 public datasets

☁️Cloud keys, live DBs, API keys worth ~$920K/yr.

⚠️Training data has no undo: one key hit 1,131 datasets

🔗 https://t.co/H3Njla3uSB

[Truffle Security @trufflesec]

🚨 New research: a cache flaw in https://t.co/KPgPxxs3KO leaked freshly minted API keys to other users

🔑gzip responses to an authenticated API key request got cached at the Fastly edge, then served to the next user, no auth needed

✅Now fully fixed
🔗 https://t.co/lBBw6VcxfE

[Truffle Security @trufflesec]

🚨 New research: how we helped prevent a supply chain attack

🐳A live #Docker Hub token sat in a public GitLab CI artifact with write access to all 384 Torizon images (4.5M+ pulls) 📦

⚠️ #GitLab masks secrets in logs, but NOT artifacts.

🔗 https://t.co/6xsDORLscv

[Truffle Security @trufflesec]

🚀 New in TruffleHog Enterprise!

🗺️ Topology: see the blast radius of a leaked secret, not just where it leaked

🔐 Shared Secrets: secure, expiring links to get findings to the right person

🐙 Multi-org GitHub scanning from one connection

🔗https://t.co/s8cSPLJ6IV

[Truffle Security @trufflesec]

🚨 Google is fixing a Gemini API key privilege escalation we disclosed.

~3,000 public API keys silently gained Gemini access, with bills up to $1M 💸🤯
🔐 New auth keys are rolling out before Sept. 2026 -now's the time to audit your credentials.

🔗https://t.co/BkJaritJ7s

[Truffle Security @trufflesec]

🔐 Your PR scanner caught it. But PR scanning alone has 3 blind spots:

⏱️ Timing gap: pushes go live BEFORE the PR opens
🌿 Abandoned branches: never scanned
🔄 "Fixed" ≠ revoked

Secrets are exploited within seconds. One gate isn't enough.
🔗https://t.co/P6b6ULnlco

[Truffle Security @trufflesec]

🚨 A "deleted" PyPI package exposed an admin GitHub PAT - granting access to Apache & Astronomer for 2.5 years

🔑 678K “deleted” packages were recovered from object storage & 190 live secrets found

❌ Deletion ≠ revocation 🔄 Rotate your creds!

🔗https://t.co/1eKvqDVKCp

[Truffle Security @trufflesec]

🔓 CISA admin GitHub App key still LIVE 2 days after Krebs reported it.

And there was more:
🔑 Org-wide GitHub admin access
📦 6 JFrog tokens + master keys
🔐 Guessable DB passwords

👉https://t.co/8sF2aMEbfk

[Truffle Security @trufflesec]

🐷 The May release of TruffleHog Enterprise is out.

📊 New summary dashboard. See your secrets program at a glance.

🔑 TruffleHog GCP Analyze just got smarter. IAM insights + guided rotation.

👉https://t.co/2RUiiAOxnX