Rotate keys you ever committed, even if you deleted them
543,699 leaked credentials still worked in public GitHub repos, including 31,374 Gemini keys · Security incident · Web · trufflesecurity · Sep 2026
Truffle Security scanned 224 million public GitHub repos and found 543,699 credentials that still worked when tested in July 2026, including 31,374 live Gemini keys. The median one had been public for 784 days. GitHub's push protection does not block Google or Gemini API keys.
Lesson
Treat any key that was ever committed as burned: rotate it first, clean history second. Scan your whole git history, not just today's code, and restrict and cap Google keys because push protection won't stop them.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
I'm a beginner and I want to know if I've ever committed an API key to GitHub. Help me check my repos. 1) Show me how to scan my full git history (all branches and tags, not just the current code) for keys with a free tool like gitleaks or TruffleHog, and how to read the results. Don't print any key values in our chat. 2) For each finding, tell me what kind of key it is and whether it can spend money or read data (OpenAI, Anthropic, Gemini/Google, Stripe, Supabase secret, AWS, database URLs). 3) Give me the steps to rotate each real key at its provider, and explain why deleting it from the code or rewriting history isn't enough. 4) For Google/Gemini keys, show me how to add API and referrer restrictions and a daily quota or budget alert. 5) Help me turn on GitHub secret scanning and push protection for my repos. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: Web ↗