Truffle Security, maker of the TruffleHog secrets scanner, writes about leaked credentials, GitHub data exposure, and Google API key and OAuth problems.
Commenters praise the firm's work, especially the post on accessing deleted GitHub repository data and its follow-up TruffleHog tool; one ex-employee calls the product impressive.
> instead they want to see a name and a check mark
How is that remotely surprising?
Most famous people are not known by domain names. Most are known by their real names. Some are known by usernames on particular services, like MrBeast on YouTube or dril on Twitter.
Maybe, if Bluesky stays popular, a new crop of Internet-famous people will be known by their domain names. But even then, you're probably not going to remember whether they're foo.com or foo.io or foo.bsky.social.
Some people, mostly in tech, do have well-known personal websites hosted at their own domains – but I for one rarely remember the specific domains, because I'm used to finding websites through search. (Off the top of my head I can only think of cr.yp.to.)
Companies are more likely to have websites and well-known domains, so there's that, but most social media users are individuals.
Besides, domain names are not more owned than Twitter handles or any other kind of username. If anything, they're less owned. When Elon Musk stole some people's Twitter handles, it was (tech) news. The expectation with most services is that you can register a name and hold onto it forever for free; at worst it might be lost if you're totally inactive for a long time. Meanwhile, domains require yearly payment. Once they expire, they're often instantly snapped up by a bot with no way for the original owner to get them back.
So in practice, people lose their personal domains all the time. Less common for…
We will have to disagree Kenneth.
Your idea of "so far out of line", would include any communication you disagree with, and is absent rational principles or social norms/mores basis, it is absurd.
I stuck to the objective issues in my previous post, you should too before making baseless claims.
Do some due dilligence on the business entities involved, peruse their github history (the deleted parts). Get a real picture about what's going on there. You'll find many contradictions if you dig.
The question on any critical IT professional's minds is how can you run the service given the resources claimed. Yes he runs the top traffic site for chess, and its done on a bespoke monolith.
You napkin math/sketch it out by required component services, and it quickly becomes clear that nothing adds up. When nothing is consistent, or supported, you examine your premises for contradictions and lies, which goes again back to credibility.
(Hint: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github)
> you will screw this up if you roll your own. The only secure option is to push as much as possible outside of your infrastructure.
In my experience the integration with outside infra (OAuth, OIDC etc.) carries significant complications in itself, and Im not convinced that you really gain that much in terms of reducing complexity or attack surface by using these technologies. See this article that was on the front page yesterday for an example of non-obvious things that can go wrong https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of/
Google API keys have been used for ages on the frontend. For example on Google Maps embeds. Those are not possible without exposing a key to the frontend. They weren't secret, until Gemini arrived.
https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules
https://medium.com/@ahhyesic/your-google-maps-api-key-now-has-access-to-gemini-ai-and-you-were-never-told-c8800129757b
https://www.malwarebytes.com/blog/news/2026/02/public-google-api-keys-can-be-used-to-expose-gemini-ai-data
It's actually much more than a billing leak [1]; again, most people don't know how bad this is, because Google is trying to keep it hush-hush. These keys don't just grant access to Gemini completions; they grant access to any endpoint on the generative AI google cloud product. This includes: seeing all of the files that google cloud project has uploaded to gemini, and interacting with the gemini token cache.
[1] https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules
Anyone can Access Deleted and Private Repository Data on GitHub [1].
You can get recent commit hashes from the wayback machine [2], and there are still forks of Ryujinx that can be used for accessing deleted data [3].
[1] https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github
[2] https://web.archive.org/web/20240929032104/https://github.com/Ryujinx/Ryujinx
[3] https://github.com/emmauss/Ryujinx