Hugging Face taps TruffleHog to catch leaked API keys in every commit

Hugging Face is making a serious push to stop developers from accidentally broadcasting their passwords and API keys to the world. They’ve partnered with TruffleHog, the open-source secret-scanning tool, to bake automated leak detection directly into their platform’s plumbing.

This isn’t just a suggested best practice anymore. The platform has extended its automated security pipeline so that every single push to a repository now gets scanned by TruffleHog. It looks at every new or modified file, hunting for credentials, tokens, and encryption keys. This new layer joins existing scans for malware (via ClamAV) and malicious pickle files. If TruffleHog finds a verified secret—meaning it confirmed the credential actually works—Hugging Face fires off an email notification to the user so they can revoke it. The company is quick to note that an “unverified” flag doesn’t mean you’re off the hook, either; verification can fail if a provider is simply having downtime. The secret might still be live.

The collaboration goes both ways. Beyond the server-side scans, the TruffleHog team has built a native Hugging Face scanner that lets users and security teams proactively audit their own accounts. With a single command—trufflehog huggingface --user <username>—developers can scan all their models, datasets, and Spaces. It even gets into the weeds of pull requests and discussion comments with the right flags. The one current blind spot is files stored in Git LFS, though TruffleHog says they’re working on closing that gap for all git sources.

This move signals a maturing security posture for a platform that hosts over a million models and has become a central hub for the AI community. We’ve seen similar supply-chain moves from GitHub, but applying this level of scrutiny to the model-sharing ecosystem feels overdue. The fact that you can now point a tool at an entire organization’s repositories and surface hard-coded credentials in seconds is a big deal. For any team sharing fine-tuned models, running trufflehog huggingface --org should probably become as routine as running a linter.