The Curious Engineer

All blogs / Security

Blog ◆ Truffle Security Co.

trufflesecurity.com/blog

The Truffle Security blog highlights the latest security research and open-source community content.

SecurityDevOps / SRE / infrastructure

’15’16’17’18’19’20’21’22’23’24’25’26
Posts
137 from 1 Jan 2015 to 29 Oct 2026
Posting
weekly (37 in the last year)
Kind
company blog

2026 33

  1. From The DigThe Vault Governs the Secret. The Copies Still Work.Read the post
  2. From The DigTruffle Security Announces Collaboration with Google Cloud to Help Secure Exposed SecretsRead the post
  3. From The DigModel Distillation: Why Attackers Want Your API KeysRead the post
  4. Luke MarshallApr 8, 2026Leaked and Still Live: Why Developers Fail to Remediate Exposed Credentials
  5. Truffle SecurityOct 20, 2026The Next Supply Chain Attack May Start With a Stolen Token
  6. Truffle Security ResearchOct 15, 2026AWS Key Quarantine is Not Revocation
  7. Truffle SecurityOct 14, 2026Focused S3 Scanning and OAuth2 Authentication in TruffleHog Enterprise October 2026 Release
  8. Brittany BodaneOct 8, 2026Leaked Credentials Let an AI Agent Into Two Companies’ Systems
  9. Truffle Security ResearchOct 6, 2026One non-human identity, two states
  10. Truffle Security ResearchOct 1, 2026Why exposed credentials stay live for years
  11. Truffle Security ResearchSep 29, 2026GitHub Repos Exposed 543,699 Credentials. Nobody Revoked Them.
  12. Dylan AyreySep 24, 2026AI Worms Are Coming Soon
  13. Dylan AyreySep 22, 2026The 14 leaked API keys that fueled OpenAI's Hugging Face attack
  14. Luke MarshallSep 14, 2026We discovered a Ruby account takeover; Rogue OpenAI Agents exploited it 2 months prior
  15. Luke MarshallSep 9, 2026How We Almost Owned the Internet's TLS
  16. Dzianis SkliarSep 1, 2026Scanning 1.2 Million DotNetFiddle Snippets for Secrets
  17. Matt BradyAug 27, 2026Beyond Laptops: What secrets to expect on your endpoints
  18. Jim FreelyAug 20, 2026Introducing TruffleHog AWS Analyze: Know What a Leaked AWS Key Can Reach
  19. Truffle Security ResearchAug 19, 2026768 Leaked Corporate AWS Keys Held Full Admin Rights
  20. Luke MarshallAug 13, 2026API Keys Leaking in PNG Metadata of AI Images
  21. Ian SharpeAug 12, 2026What's New in TruffleHog Enterprise: August 2026 Release Highlights
  22. Luke MarshallJul 22, 2026Securing the Supply Chain: Cache Vulnerability in RubyGems
  23. Luke MarshallJul 17, 2026Preventing a Supply Chain Attack: A Leaked Docker Token in a Public CI Artifact
  24. Ian SharpeJul 15, 2026What's New in TruffleHog Enterprise: July 2026 Release highlights
  25. Truffle Security Research TeamJun 29, 2026Google Fixes the Gemini API Key Privilege Escalation Issue
  26. Jacob DowdyJun 18, 2026Your PR scan is missing half the problem
  27. Luke MarshallJun 2, 2026Admin on Apache Org Exposed for 2.5 Years in Deleted PyPI Package
  28. Dylan AyreyJun 1, 2026Scanning 7.6 Petabytes of Hugging Face Training Data for Secrets
  29. Dylan AyreyMay 22, 2026CISA's Leaked Admin GitHub Token Remained Live 2 Days After Krebs Reported It Leaked
  30. Ian SharpeMay 13, 2026What’s New in TruffleHog Enterprise: May 2026 Release Highlights
  31. Ben ZimmermannApr 20, 2026Thousands of Live Secrets Found Across Four Cloud Development Environments
  32. Joe LeonMar 27, 2026Contributor Spotlight: Strengthening TruffleHog's SSRF Protections
  33. Joe LeonFeb 25, 2026Google API Keys Weren't Secrets. But then Gemini Changed the Rules.

2025 16

  1. Brad LarsenDec 16, 2025TruffleHog now detects JWTs with public-key signatures and verifies them for liveness
  2. Dylan AyreyDec 1, 2025The Rise of API Worms
  3. Luke MarshallNov 25, 2025Scanning 5.6 million public GitLab repositories for secrets
  4. Luke MarshallNov 20, 2025Scanning 2.6 million public Bitbucket Cloud repositories for secrets
  5. Dylan Ayrey, Brad Larsen, & Zach RiceOct 31, 2025We've been doing NHI since 2016
  6. Joe LeonOct 17, 2025Contributor Spotlight: Adam Reiser of Cisco Talos
  7. Joe LeonSep 17, 2025TruffleHog in Your Logs?
  8. Joe LeonSep 10, 2025Detecting Exposed Secrets in Salesforce with TruffleHog
  9. Eduard Agavriloae & Matei JosephsJul 18, 2025Guest Post: GCP CloudQuarry: Searching for Secrets in Public GCP Images
  10. Joe LeonJul 11, 2025How to Scan Force Pushed Commits for Secrets
  11. Dylan AyreyMay 9, 2025This is how you build an AI Ransomware Worm
  12. Joe LeonMar 13, 2025Introducing TruffleHog's Burp Suite Extension: A Techical Deep Dive
  13. Joe LeonFeb 27, 2025Research finds 12,000 ‘Live’ API Keys and Passwords in DeepSeek's Training Data
  14. Dylan Ayrey and Jake KingFeb 21, 2025Removing Jeff Bezos From My Bed
  15. Ahrav DuttaJan 23, 2025Under the Hood: The Algorithmic Power Behind TruffleHog’s Secret Scanning
  16. Dylan AyreyJan 13, 2025Millions of Accounts Vulnerable due to Google’s OAuth Flaw

2024 44

  1. Dylan AyreyDec 27, 2024Vigilante Justice on GitHub
  2. Joe LeonDec 19, 2024Mishandled OAuth Tokens Open Backdoors
  3. Joe LeonDec 12, 2024LLMs are Teaching Developers to Hardcode API Keys
  4. Joe LeonDec 4, 2024Cracking Open APK Files at Scale
  5. Zach RiceNov 26, 2024Announcing the Winners of the TruffleHog Hacktoberfest 2024 Detector Competition
  6. Joe LeonOct 31, 20247 Spooky Places Your Secrets Leak Online
  7. Dylan Ayrey & Joe LeonOct 24, 202410% of TLS Certificates Reuse Private Keys
  8. Joe LeonOct 18, 2024Secret Scanning Encoded and Archived Data
  9. Joe LeonOct 10, 2024Securely Open-Sourcing on GitHub
  10. Zach RiceOct 1, 2024Hacktoberfest 2024: Detector Improvement Competition at Truffle Security!
  11. Joe LeonSep 27, 2024Announcing Truffle Security’s CFP
  12. Joe LeonSep 19, 20248 Must-See Talks at OWASP 2024 Global AppSec
  13. Joe LeonSep 12, 2024You can Access Private Azure DevOps Repo Data
  14. Joe LeonSep 4, 2024TruffleHog Partners With Hugging Face to Scan for Secrets
  15. Joe LeonAug 23, 2024Why TruffleHog Analyze is a Game-Changer for Security Teams
  16. Dustin DeckerAug 16, 2024Contributor Spotlight: Karan Bamal
  17. Dylan Ayrey & The Analyze TeamAug 7, 2024TruffleHog Now Analyzes Permissions Of API Keys and Passwords
  18. Joe LeonAug 2, 2024TruffleHog now finds all Deleted & Private Commits on GitHub
  19. Joe LeonJul 24, 2024Anyone can Access Deleted and Private Repository Data on GitHub
  20. Dylan Ayrey & Zach RiceJul 19, 2024Secrets in Source Code Are Not A Code Security Problem
  21. Haoxi TanJul 10, 2024Leaked Secrets in Public Jenkins Logs
  22. Dylan Ayrey & Joe LeonJul 3, 2024TruffleHog Scans Deleted Git Branches
  23. Joe LeonJun 27, 2024TruffleHog Now Scans Jenkins Logs
  24. Charlie GunyonJun 17, 2024TruffleHog Partnering With Elastic to Scan for Secrets
  25. Dylan AyreyJun 7, 202411,000+ GitHub users' SSH keys are too weak
  26. Joe LeonMay 29, 2024Credentials Leaking with Subdomain Takeover
  27. Dylan AyreyMay 17, 2024Stop Recommending JWTs (with symmetric keys)
  28. Joe Leon and Dylan AyreyMay 9, 2024Bug Bounty Hunting Leaked Credentials
  29. Joe LeonMay 2, 2024Scan Postman for Secrets with TruffleHog
  30. Joe LeonApr 25, 2024(The) Postman Carries Lots of Secrets
  31. Joe LeonApr 12, 2024Do Secrets Leak on Public GitHub Gists in 2024?
  32. Joe LeonApr 4, 2024Scan Every Tag and Architecture of a Docker Image for Secrets
  33. Sam ChanMar 20, 2024How to Scan Jira for Secrets
  34. Dylan AyreyMar 14, 2024The Keyboard Button that Displays Linux Root Memory
  35. Dylan AyreyMar 6, 2024Contributor Spotlight: Helena Rosenzweig and Assetnote team
  36. Joe LeonFeb 27, 2024How TruffleHog Verifies Secrets
  37. Dylan AyreyFeb 21, 2024TruffleHog Now Detects AWS Canaries without setting them off
  38. Haoxi TanFeb 14, 2024How to Scan S3 Buckets for Secrets
  39. Haoxi TanFeb 7, 2024How to Scan Azure Blobs for Secrets in 2024
  40. Haoxi TanJan 31, 2024Scanning Git for Secrets: The 2024 Comprehensive Guide
  41. Haoxi TanJan 25, 2024 The Risks of a Leaked Stripe API Key
  42. Joe LeonJan 17, 2024Introducing whoamislack: Identify Slack Workspace Names from Webhook URLs
  43. Joe LeonJan 10, 202474% of publicly leaked keys are never revoked
  44. Joe LeonJan 4, 2024Research Uncovers AWS Account Numbers Hidden in Access Keys

2023 29

  1. Dylan AyreyDec 15, 2023Google OAuth is Broken (Sort Of)
  2. Haoxi TanDec 13, 2023Why did 1 GitHub Repo leak 5,000 Live GCP Keys?
  3. Joe LeonDec 4, 2023Running TruffleHog in Travis CI
  4. Zach RiceNov 28, 2023Improving TruffleHog Part I: Adding a New Detector
  5. Zach RiceNov 22, 2023Announcing the TruffleHog Hacktoberfest 2023 Winners!
  6. Joe LeonNov 15, 2023Tailscale + Truffle: A Blueprint for Open Source TruffleHog Contributions
  7. Karim RahalNov 8, 2023Does Travis CI leak secrets in 2023?
  8. Karim RahalOct 25, 2023Mirror, Mirror, on the Wall, Secrets Leaked from Repos All
  9. Zach RiceOct 19, 2023Contributor Spotlight: Richard Gomez
  10. Zach RiceOct 6, 2023TruffleHog Detector Competition at Hacktoberfest 2023!
  11. Joe LeonSep 27, 2023Think Twice Before Commenting: Thousands of GitHub Comments Leak Live API Keys
  12. Joe LeonSep 18, 2023How to Rotate: Key Rotation Tutorials
  13. Joe LeonSep 11, 2023How Secrets Leak out of Docker Images
  14. Joe LeonSep 5, 20234,500 of the Top 1 Million Websites Leaked Source Code, Secrets
  15. Miccah CastorinaAug 30, 2023Do Pre-Commit Hooks Prevent Secrets Leakage?
  16. Joe LeonAug 22, 2023Running TruffleHog in Azure Pipelines
  17. Joe LeonAug 15, 2023TruffleHog Commands: Git vs Filesystem
  18. Hon KwokAug 9, 2023Announcing TruffleHog Terminal UI
  19. Dylan AyreyAug 3, 2023Discovering a Vulnerability in Forager AuthZ, Hours before Public Launch
  20. Joe LeonAug 3, 2023Deleting leaked API keys isn’t a solution
  21. Karim RahalJul 28, 2023How Secrets Leak in CI/CD Pipelines
  22. Hon KwokJul 17, 2023Introducing Forager: Browse Millions of Leaked API keys Found With TruffleHog
  23. Mike VanbuskirkMay 18, 2023Running TruffleHog in a GitHub action
  24. Zach RiceApr 17, 2023Making TruffleHog Faster with Aho Corasick
  25. Dustin DeckerFeb 22, 2023Secure Credential Storage in 2023
  26. Dylan AyreyJan 30, 2023Introducing: A New XSSHunter, Hosted by the Truffle Security Co.
  27. Dustin DeckerJan 17, 2023Introducing cloudsql-exporter, a New Way to Protect Cloud SQL Data
  28. Dylan AyreyJan 6, 2023TruffleHog Now Scans CircleCI Build Logs
  29. Chris GraysonJan 3, 2023Bypass firewalls with of-CORs and typo-squatting

2022 5

  1. Dylan AyreyNov 20, 2022Email Graffiti: Hacking Old Email
  2. Dylan AyreyJul 7, 2022It’s Impossible to Find Every Vulnerability, So We Don’t Try To
  3. Dylan AyreyApr 4, 2022Introducing TruffleHog v3
  4. Dylan AyreyFeb 9, 2022Introducing Driftwood: Know if Private Keys are Sensitive
  5. Dylan AyreyJan 9, 2022The Breach They Kept Secret

2021 8

  1. Dylan AyreyDec 8, 2021Truffle Security raises $14 million Series A led by a16z
  2. Dylan AyreySep 19, 2021Introducing TruffleHog, The Chrome Extension
  3. Dylan AyreyAug 30, 2021Why Isn’t XSS Used More in the Wild?
  4. Dylan AyreyAug 23, 2021A Leaky Key That Led to Jail Time
  5. Dylan AyreyAug 16, 2021Uber’s Wild Story of Leaky Keys
  6. Dylan AyreyAug 9, 2021Leaked Code Leads to Leaked Keys
  7. Dylan AyreyAug 4, 2021Remediating TruffleHog Findings with Doppler
  8. Guest UserAug 3, 2021An API Worm In The Making: Thousands Of Secrets Found In Open S3 Buckets

2015 1

  1. Sharon BrizinovGuest Post: How I Scanned all of GitHub’s “Oops Commits” for Leaked Secrets

Undated 1

  1. Dylan AyreyMar 10, 2026Claude Tried to Hack 30 Companies. Nobody Asked It To.