Topic starter
15/10/2026 10:09 am
TL;DR: Truffle Security found about 12,000 live API keys and passwords in Common Crawl, the web-scale dataset used to train models such as DeepSeek, showing that LLMs are exposed to insecure code patterns before prompt-time safeguards can intervene. That exposure turns secret hygiene into a data-supply-chain problem, not just a repository problem.
Editorial analysis by NHI Mgmt Group, based on content published by Truffle Security: “Research finds 12,000 âLiveâ API Keys and Passwords in DeepSeek's Training Data”.
By the numbers:
- The scan covered 2.76 million web pages containing live secrets.
Key questions
Q: What breaks when live API keys appear in public web archives?
A: The secret lifecycle breaks at discovery and revocation.
Q: Why do leaked secrets in training data matter for security teams?
A: Because training data can reproduce insecure patterns at scale, and live credentials may remain valid long after the original leak.
Q: What are the signs that secrets exposure is spreading beyond code repositories?
A: A clear warning sign is when secrets appear in places teams do not treat as source code, such as public buckets, file shares, or other object storage.
Practitioner guidance
- Expand secret discovery beyond source control Scan public web properties, rendered pages, archived snapshots, and documentation sites for exposed API keys, passwords, and webhook tokens.
- Validate and revoke live secrets first Differentiate between strings that merely look like secrets and secrets that still authenticate successfully.
- Reduce repeated key reuse across environments Identify credentials that appear across multiple customer sites, subdomains, or deployments, then replace them with environment-specific secrets and separate ownership boundaries.
Bottom line: Public archives can preserve working API keys and passwords, which means secret management now extends beyond internal repositories and into the external data supply chain.
What's in the full report
Truffle Security's full research covers the operational detail this post intentionally leaves for the source:
- The scanning method used to process 400TB of Common Crawl data across 90,000 WARC files
- The live-secret verification approach that separated authenticating credentials from lookalike strings
- Examples of repeated secrets, including a WalkScore API key found 57,029 times across 1,871 subdomains
- The disclosure and revocation process Truffle Security used to coordinate key rotation with affected vendors
👉 Read Truffle Security's research on live API keys and passwords in DeepSeek training data →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/10/2026 10:12 am
Training data is now part of the secret attack surface: Hardcoded API keys are no longer just a code hygiene problem because public archives can preserve them long after deployment. That means LLM training data becomes a governance domain alongside repositories, CI logs, and cloud metadata. The practitioner conclusion is simple: secret lifecycle controls have to extend to public web exposure, not just internal systems.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams reduce the blast radius of exposed API keys?
A: Use per-environment credentials, track where each secret is published, and revoke any credential that has been copied into public web content or archived datasets. The goal is to stop one leak from becoming a distributed identity problem that spans customers, pages, and training inputs.
👉 Read our full editorial: Hardcoded secrets in training data expose the AI coding pipeline