# Resend revokes leaked API keys found across more public sources

published: 2026-11-04T20:05:48.910Z
topic: identity
source: https://resend.com/changelog/trufflehog-secrets-revocation-program
url: https://aiagentnews.io/stories/resend-revokes-leaked-api-keys-found-across-more-public-sources

Resend is a launch partner in TruffleHog's Secrets Revocation Program, so exposed Resend API keys found in Docker images, Hugging Face datasets and other public places are revoked automatically. The protection is on by default for every Resend account, and account admins are emailed a link to where the key was found.

Resend already revokes any key exposed on public GitHub, a coverage it began in July as a GitHub secret scanning partner. Its new partnership with TruffleHog's Secrets Revocation Program extends this to other places where keys leak. TruffleHog scans public code, packages, container images and datasets, and now covers Docker Hub images, Hugging Face datasets, PyPI and npm packages, GitLab repositories, Android apps, Firefox add-ons and new pushes to GitHub.

When TruffleHog finds a working key, it reports it to Resend, which disables the key as soon as the report arrives and emails all admins with a link to where it was found. Resend chose revocation over warning because TruffleHog found that 81% of the leaked keys it reported last year were still live six months later. A warning leaves a key working until someone acts, and a live key lets anyone send spam or phishing from a verified domain.

## Why it matters if you build agents

Resend keys exposed in container images, packages or public datasets are now disabled automatically instead of waiting for a manual response. Agent builders should still keep keys out of those places, because a revoked key stops working and the pipeline that leaked it still needs fixing. Make sure the admin email alerts reach someone who can rotate keys quickly.