Resend revokes leaked API keys found across more public sources

Resend already revokes any key exposed on public GitHub, a coverage it began in July as a GitHub secret scanning partner. Its new partnership with TruffleHog's Secrets Revocation Program extends this to other places where keys leak. TruffleHog scans public code, packages, container images and datasets, and now covers Docker Hub images, Hugging Face datasets, PyPI and npm packages, GitLab repositories, Android apps, Firefox add-ons and new pushes to GitHub.

When TruffleHog finds a working key, it reports it to Resend, which disables the key as soon as the report arrives and emails all admins with a link to where it was found. Resend chose revocation over warning because TruffleHog found that 81% of the leaked keys it reported last year were still live six months later. A warning leaves a key working until someone acts, and a live key lets anyone send spam or phishing from a verified domain.

Resend keys exposed in container images, packages or public datasets are now disabled automatically instead of waiting for a manual response. Agent builders should still keep keys out of those places, because a revoked key stops working and the pipeline that leaked it still needs fixing. Make sure the admin email alerts reach someone who can rotate keys quickly.