Truffle Security launched a free program enabling credential issuers to revoke 1.4 million verified API keys, tokens and other secrets exposed online. In a 2025 study, 81% of 21,981 reported keys still worked six months later; 88% of 64,024 leaked AWS keys checked in August 2026 remained active.