Truffle Security Blog

This is interesting but the linked articles is even more interesting. https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-th… > Even Google themselves had old public API keys, which they thought were non-sensitive, that we could use to access Google’s internal Gemini. This is just a classic slow clap here for Cloud.

I don't think it could have worked anyway, given https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private… . The best they could do is hide new test material, and then only if the private repo is kept distinct and isn't recognized by GitHub as a fork.

This firm is doing great work, I still refer to this post ("Anyone can Access Deleted and Private Repository Data on GitHub"): https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private…

TruffleHog: https://trufflesecurity.com/trufflehog I worked for them a little bit and their product is really impressive and works great.

They released a tool to do this in a followup post: https://trufflesecurity.com/blog/trufflehog-now-finds-all-deleted-and-…

Congrats to https://trufflesecurity.com/ The email rejection's tone is weird.

Looks like the rubygems api was leaking users api keys due to some cache vulnerability. They did a write up alongside the org that found it: https://blog.rubygems.org/2026/07/22/security-advisory-legacy-api-key-… https://trufflesecurity.com/blog/rubygems-cache-vulnerability

In some cases, you can also use forks to read commits from private forks[0], but GitHub considers these linked commit networks working as intended. [0]: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private…

Google's world. They explicitly tell you that API keys are not secrets. https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-th…

Google API keys have been used for ages on the frontend. For example on Google Maps embeds. Those are not possible without exposing a key to the frontend. They weren't secret, until Gemini arrived. https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-th… https://medium.com/@ahhyesic/your-google-maps-api-key-now-has-access-t… https://www.malwarebytes.com/blog/news/2026/02/public-google-api-keys-…

It's actually much more than a billing leak [1]; again, most people don't know how bad this is, because Google is trying to keep it hush-hush. These keys don't just grant access to Gemini completions; they grant access to any endpoint on the generative AI google cloud product. This includes: seeing all of the files that google cloud project has uploaded to gemini, and interacting with the gemini token cache. [1] https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-th…

Relevant: "I found a backdoor into my bed" https://trufflesecurity.com/blog/removing-jeff-bezos-from-my-bed HN discussion https://news.ycombinator.com/item?id=43129439

wait is this the same company that had a backdoor that allowed their employees to ssh into customer mattresses to collect sleep data? https://trufflesecurity.com/blog/removing-jeff-bezos-from-my-bed

> Just scratch the commit from existence. Unfortunately, that is impossible: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private…

Anyone can Access Deleted and Private Repository Data on GitHub [1]. You can get recent commit hashes from the wayback machine [2], and there are still forks of Ryujinx that can be used for accessing deleted data [3]. [1] https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private… [2] https://web.archive.org/web/20240929032104/https://github.com/Ryujinx/… [3] https://github.com/emmauss/Ryujinx

If you thought your private GitHub repositories were safe from prying eyes, think again. This blog post caught my attention today, and I'm kind of surprised that no one's talking about it because this seems like a big deal. Here's a link for the blog post https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private…

Should be mentioned that this is not a bullet-proof solution (obviously), for some services the canary tokens can be bypassed, see e.g. https://trufflesecurity.com/blog/canaries ("TruffleHog Now Detects AWS Canaries without setting them off")

Exactly - this isn't going to open the door for someone but could add a ton of value to enumeration. As we are very canary focused, we also think it's interesting to consider the implications of the recent research from Truffle Security w.r.t canary tokens (https://trufflesecurity.com/blog/canaries).

> you will screw this up if you roll your own. The only secure option is to push as much as possible outside of your infrastructure. In my experience the integration with outside infra (OAuth, OIDC etc.) carries significant complications in itself, and Im not convinced that you really gain that much in terms of reducing complexity or attack surface by using these technologies. See this article that was on the front page yesterday for an example of non-obvious things that can go wrong https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of/

Seeing that reminded me of this recent onoz, which one should fold into their threat model: https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of/ <https://news.ycombinator.com/item?id=38670644>

> instead they want to see a name and a check mark How is that remotely surprising? Most famous people are not known by domain names. Most are known by their real names. Some are known by usernames on particular services, like MrBeast on YouTube or dril on Twitter. Maybe, if Bluesky stays popular, a new crop of Internet-famous people will be known by their domain names. But even then, you're probably not going to remember whether they're foo.com or foo.io or foo.bsky.social. Some people, mostly in tech, do have well-known personal websites hosted at their own domains – but I for one rarely remember the specific domains, because I'm used to finding websites through search. (Off the top of my head I can only think of cr.yp.to.) Companies are more likely to have websites and well-known domains, so there's that, but most social media users are individuals. Besides, domain names are not more owned than Twitter handles or any other kind of username. If anything, they're less owned. When Elon Musk stole some people's Twitter handles, it was (tech) news. The expectation with most services is that you can register a name and hold onto it forever for free; at worst it might be lost if you're totally inactive for a long time. Meanwhile, domains require yearly payment. Once they expire, they're often instantly snapped up by a bot with no way for the original owner to get them back. So in practice, people lose their personal domains all the time. Less common for…

We will have to disagree Kenneth. Your idea of "so far out of line", would include any communication you disagree with, and is absent rational principles or social norms/mores basis, it is absurd. I stuck to the objective issues in my previous post, you should too before making baseless claims. Do some due dilligence on the business entities involved, peruse their github history (the deleted parts). Get a real picture about what's going on there. You'll find many contradictions if you dig. The question on any critical IT professional's minds is how can you run the service given the resources claimed. Yes he runs the top traffic site for chess, and its done on a bespoke monolith. You napkin math/sketch it out by required component services, and it quickly becomes clear that nothing adds up. When nothing is consistent, or supported, you examine your premises for contradictions and lies, which goes again back to credibility. (Hint: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private…