Your old API keys are worth money to a stranger. That's the ugly lesson from this month, when attackers kept breaking into companies not by cracking passwords, but by finding login keys that careless coders left sitting in their own code.
In May 2026 alone, hackers poisoned hundreds of software packages and pulled off a string of supply-chain attacks aimed at one prize. Developer secrets. Cloud keys, SSH keys, login tokens. GitHub itself got hit. On May 18, a booby-trapped code editor add-on compromised an employee laptop, and an attacker claimed access to roughly 3,800 internal GitHub repositories. GitHub spent the next two days rotating its most sensitive credentials before anyone could use them.
So here's the question worth asking. If a stranger cloned your code right now, what would they find?
Why a leaked key is so dangerous
A secret is just a credential one machine uses to log in to another. An API key, a database password, a private encryption key. The problem is that these things have a way of ending up hardcoded into source files, then committed to git and forgotten. Delete it in a later commit and you've done nothing, because git keeps the whole history. The key is still right there in an old snapshot.
That's exactly what bit the US government this month. Dylan Ayrey, the developer behind the secret-scanning tool TruffleHog, flagged that a leaked CISA repo still held a live RSA private key (basically a master login file) that nobody had bothered to cancel. A key sitting in public, still working. Yeah. Not great.
Scan your own code
TruffleHog is free and open source, and it does one job well. It digs through your code, finds anything that looks like a secret, then actually tries to log in with it to see if the key still works. That last part matters. A dead key is noise. A live one is a fire.
trufflehog git file://. --results=verified,unknown
Run that from inside any repo on your machine. The --results=verified,unknown bit tells it to show you keys it confirmed are live, plus ones it couldn't check, and to hide the dead ones.
What to do when it finds something
Don't just delete the key from the file. That fixes nothing, remember? The history still has it. The only real fix is to cancel the leaked key at the source and make a new one. Log in to AWS, Stripe, whatever issued it, kill the old credential, generate a fresh one.
This is the same advice the pros gave during the GitHub mess. Even Binance founder CZ told developers to rotate every API key sitting in their repos, public or private, the moment the breach went public. Rotate first, clean up the file second.
Want to stop it happening again? Run TruffleHog before every commit so a key never makes it into history in the first place.
The bigger picture
Scanning is cheap. The cleanup after a stolen key drains a cloud account or backdoors your users is not. TruffleHog can spot over 800 kinds of secret, from AWS keys to database passwords to SSL private keys, so it'll likely catch whatever you forgot about. Honestly, the worst case is that it finds nothing and you wasted thirty seconds.
The attackers already run these scans against every public repo they can reach. They have for years. The only question is whether you check your code before they do. Spin it up tonight. It's free.
