Top all-time · #1141
Truffle Security Co.
Company blog · trufflesecurity.com/blogsecurityprogramming
Truffle Security Co. is the company blog at trufflesecurity.com, writing about security and programming. Since 2020, 59 different Hacker News readers have linked it 73 times, most often “Anyone can access deleted and private repository data on GitHub”. No feed was found, so read it on the site itself.
Truffle Security protects your company from secret leaks with TruffleHog™ Enterprise. Scan Git repos in real-time. Detect Live API Keys across SaaS, code and cloud. Remediate your secrets and NHIs.
Most-linked posts?
- Anyone can access deleted and private repository data on GitHub9 people · 10 mentions · first linked 2024-07-24
- Google OAuth is broken (sort of)7 people · 7 mentions · first linked 2023-12-16
- Google API Keys Weren't Secrets. But Then Gemini Changed the Rules5 people · 5 mentions · first linked 2026-02-25
- I found a backdoor into my bed3 people · 3 mentions · first linked 2025-02-21
- Postman is largest public source of leaked secrets?3 people · 3 mentions · first linked 2024-04-26
- Claude Tried to Hack 30 Companies.Nobody Asked It To3 people · 3 mentions · first linked 2026-03-10
- TruffleHog now finds all Deleted and Private Commits on GitHub3 people · 3 mentions · first linked 2024-08-04
- /blog/canaries2 people · 2 mentions · first linked 2024-02-26
- Google’s OAuth login doesn’t protect against purchasing a failed startup domain2 people · 2 mentions · first linked 2025-01-14
- GCP CloudQuarry: Searching for Secrets in Public GCP Images2 people · 2 mentions · first linked 2025-07-28
What Hacker News says?
They released a tool to do this in a followup post: https://trufflesecurity.com/blog/trufflehog-now-finds-all-de...
Comment linking /blog/trufflehog-now-finds-all-deleted-and-private-commits-on-github
on “Anyone can access deleted and private repository data on GitHub”Submitted Anyone can access deleted and private repository data on GitHub as a story · 1983 points
HN discussionIt is already known to be true for repos that are forks or have been forked: https://trufflesecurity.com/blog/anyone-can-access-deleted-a...
Comment linking /blog/anyone-can-access-deleted-and-private-repo-data-github
on “Git 3.0's upcoming SHA-256 default will be a costly mistake”Submitted I found a backdoor into my bed as a story · 980 points
HN discussionExactly - this isn't going to open the door for someone but could add a ton of value to enumeration. As we are very canary focused, we also think it's interesting to consider the implications of the recent research from Truffle Security w.r.t canary tokens ( https://trufflesecurity.com/blog/canaries ).
Comment linking /blog/canaries
on “How to find the AWS account ID of any S3 bucket”Submitted Google’s OAuth login doesn’t protect against purchasing a failed startup domain as a story · 503 points
HN discussionAnyone can Access Deleted and Private Repository Data on GitHub [1]. You can get recent commit hashes from the wayback machine [2], and there are still forks of Ryujinx that can be used for accessing deleted data [3]. [1] https://trufflesecurity.com/blog/anyone-can-access-deleted-a... [2] https://web.archive.org/web/20240929032104/https://github.co... [3] https://github.com/emmauss/Ryujinx
Comment linking /blog/anyone-can-access-deleted-and-private-repo-data-github
on “Ryujinx (Nintendo Switch emulator) has been removed from GitHub”Submitted Google OAuth is broken (sort of) as a story · 350 points
HN discussionTruffleHog: https://trufflesecurity.com/trufflehog I worked for them a little bit and their product is really impressive and works great.
Comment linking /trufflehog
on “Hacking India's largest automaker: Tata Motors”Submitted I scanned all of GitHub's "oops commits" for leaked secrets as a story · 203 points
HN discussionRelevant: "I found a backdoor into my bed" https://trufflesecurity.com/blog/removing-jeff-bezos-from-my... HN discussion https://news.ycombinator.com/item?id=43129439
Comment linking /blog/removing-jeff-bezos-from-my-bed
on “Fallout from the AWS outage: Smart mattresses go rogue”Submitted Driftwood: Know if private keys are sensitive as a story · 78 points
HN discussionwait is this the same company that had a backdoor that allowed their employees to ssh into customer mattresses to collect sleep data? https://trufflesecurity.com/blog/removing-jeff-bezos-from-my...
Comment linking /blog/removing-jeff-bezos-from-my-bed
on “Fallout from the AWS outage: Smart mattresses go rogue”Submitted GitLab scan finds 17,000 secrets in public repos, leading to $9000+ in bounties as a story · 30 points
HN discussion> Just scratch the commit from existence. Unfortunately, that is impossible: https://trufflesecurity.com/blog/anyone-can-access-deleted-a...
Comment linking /blog/anyone-can-access-deleted-and-private-repo-data-github
on “I scanned all of GitHub's "oops commits" for leaked secrets”Submitted Postman is largest public source of leaked secrets? as a story · 22 points
HN discussionWe will have to disagree Kenneth. Your idea of "so far out of line", would include any communication you disagree with, and is absent rational principles or social norms/mores basis, it is absurd. I stuck to the objective issues in my previous post, you should too before making baseless claims. Do some due dilligence on the business entities involved, peruse their github history (the deleted parts). Get a real pictu…
Comment linking /blog/anyone-can-access-deleted-and-private-repo-data-github
on “Lichess: Post-Mortem of Our Longest Downtime”Submitted How to Scan Force Pushed Commits for Secrets as a story · 20 points
HN discussionShould be mentioned that this is not a bullet-proof solution (obviously), for some services the canary tokens can be bypassed, see e.g. https://trufflesecurity.com/blog/canaries ("TruffleHog Now Detects AWS Canaries without setting them off")
Comment linking /blog/canaries
on “Canarytokens: Honeypot for critical credentials, get notified when they are used (2015)”Submitted GCP CloudQuarry: Searching for Secrets in Public GCP Images as a story · 18 points
HN discussionGoogle's world. They explicitly tell you that API keys are not secrets. https://trufflesecurity.com/blog/google-api-keys-werent-secr...
Comment linking /blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules
on “€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs”Submitted TruffleHog now finds all Deleted and Private Commits on GitHub as a story · 15 points
HN discussionGoogle API keys have been used for ages on the frontend. For example on Google Maps embeds. Those are not possible without exposing a key to the frontend. They weren't secret, until Gemini arrived. https://trufflesecurity.com/blog/google-api-keys-werent-secr... https://medium.com/@ahhyesic/your-google-maps-api-key-now-ha... https://www.malwarebytes.com/blog/news/2026/02/public-google...
Comment linking /blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules
on “€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs”Submitted TruffleHog V3: Automatically Validate over 600 API Keys as a story · 13 points
HN discussionIt's actually much more than a billing leak [1]; again, most people don't know how bad this is, because Google is trying to keep it hush-hush. These keys don't just grant access to Gemini completions; they grant access to any endpoint on the generative AI google cloud product. This includes: seeing all of the files that google cloud project has uploaded to gemini, and interacting with the gemini token cache. [1] htt…
Comment linking /blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules
on “€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs”Submitted Live API Keys and Source Code Leaked in 4,500 of the Top Alexa Sites as a story · 11 points
HN discussion> instead they want to see a name and a check mark How is that remotely surprising? Most famous people are not known by domain names. Most are known by their real names. Some are known by usernames on particular services, like MrBeast on YouTube or dril on Twitter. Maybe, if Bluesky stays popular, a new crop of Internet-famous people will be known by their domain names. But even then, you're probably not going to re…
Comment linking /blog/millions-at-risk-due-to-google-s-oauth-flaw
on “ATProto and the ownership of identity”Submitted Research Finds 12,000 'Live' API Keys and Passwords in DeepSeek's Training Data as a story · 7 points
HN discussion> you will screw this up if you roll your own. The only secure option is to push as much as possible outside of your infrastructure. In my experience the integration with outside infra (OAuth, OIDC etc.) carries significant complications in itself, and Im not convinced that you really gain that much in terms of reducing complexity or attack surface by using these technologies. See this article that was on the front…
Comment linking /blog/google-oauth-is-broken-sort-of/
on “What Is OIDC?”Submitted Browse millions of secrets leaked in GitHub/NPM via Forager as a story · 7 points
HN discussion
