Truffle Security protects your company from secret leaks with TruffleHog™ Enterprise. Scan Git repos in real-time. Detect Live API Keys across SaaS, code and cloud. Remediate your secrets and NHIs.
Visit trufflesecurity.com → On Hacker News Dec 2023 – Feb 2026
Security & Privacy 6Software Engineering 3Web & Frontend 2Hardware & Electronics 1
You can access data from deleted forks, deleted repositories and even private repositories on GitHub. And it is available forever. This is known by GitHub, and intentionally designed that way.
Google spent over a decade telling developers that Google API keys (like those used in Maps, Firebase, etc.) are not secrets. But that's no longer true.
GitHub Archive logs every public commit, even the ones developers try to delete. Force pushes often cover up mistakes like leaked credentials by rewriting Git history. GitHub keeps these dangling commits, from what we can tell, forever. In the archive, they show up as “zero-commit” PushEvents.