Follow the data to learn the secret
summary
Scans of HuggingFace (25% so far) with Truffle Hog process millions of files across ~880,000 datasets and flag almost 100,000 live secrets, including API keys, credit card numbers, and SSNs. Concrete cases: a 3 TB “The Stack” dataset printed into thousands of volumes; Comfy UI PNGs embedding API keys in metadata; an Apache‑licensed SEMRAP release that leaked tokens to 1,800 private Nanix repos; public Telegram channels trading stolen Stripe keys. Orphan‑key filtering finds accidental one‑off leaks.
AI-written summary · about
chapters (18)
- 0:00Introduction and speaker
- 1:12Hugging Face origin story
- 3:39The Stack data set scale
- 6:33Scanning Hugging Face for secrets
- 7:55Open source AI model debate
- 10:06Nanix internal repo leak
- 13:39Comfy UI API keys in PNGs
- 16:25JetBrains intern GitHub scrape
- 19:32Telegram criminal Stripe keys
- 21:42Copyright law and old speeches
- 24:13Common Crawl and takedowns
- 26:37Leon 5 billion workaround
- 27:40Legal and security challenges
- 28:43Twitter API keys bias
- 30:51Orphan secrets and private leaks
- 32:35Toxic data in open models
- 33:37Hugging Face as humanity's archive
- 34:43Future archaeologists and secrets
related talks
31mExploiting Leaked Credentials - How python code is leaking millions of secrets
40mDue to Less Pollution, Secrets Stored on the Cloud are Now Clearly Visible
28mFresh Secrets From the Docks: Lessons Learnt From Analyzing 180,000 Public DockerHub Images
26mSecret Hunting
35mGit those secrets out your repos!
32mContainers Don't Keep Secrets: Scanning Docker Hub for Leaked Credentials and Private Keys.
31mFighting Secrets In Source Code With TruffleHog
48mHow Source Code is Revealing our Secrets