Skip to content
TrucklineMP

Leaked API Keys & Secrets

Leaked API Keys & Secrets

Section titled “Leaked API Keys & Secrets”

If a TrucklineMP secret — a Public API key (tlmp_api_..., or a legacy tl_... key), an OAuth client secret (tlmp_secret_...), an OAuth token (tlmp_oat_... / tlmp_ort_...), or a webhook signing secret — is committed to a public repository, pasted in a public channel, or otherwise exposed, treat it as compromised immediately and follow the steps below.

TrucklineMP participates in GitHub secret scanning. If GitHub detects a TrucklineMP secret pattern in a public repository, this page is the remediation guidance linked from that alert.

1. Rotate the secret immediately

Section titled “1. Rotate the secret immediately”

Exposed secrets should be treated as compromised, not just “at risk.” Rotating removes the leaked value from service regardless of whether it has been abused yet.

API keys (tlmp_api_..., or legacy tl_...)

Section titled “API keys (tlmp_api_..., or legacy tl_...)”
  1. Sign in and open the Developer Console.
  2. Select the project the key belongs to.
  3. Delete the exposed key and generate a new one.
  4. Update the key everywhere it’s used (servers, CI secrets, bots). The old key stops working the moment it’s deleted.

OAuth client secrets

Section titled “OAuth client secrets”
  1. Open the Developer Console → OAuth Apps → your app.
  2. Regenerate the client secret from the app’s settings.
  3. Update the secret in your app’s server-side configuration. Existing user sessions are not affected, but any code still using the old secret will fail to obtain new tokens.

Webhook signing secrets

Section titled “Webhook signing secrets”
  1. Open the Developer Console → Webhooks → the affected subscription.
  2. Regenerate the signing secret.
  3. Update your webhook receiver to verify signatures with the new secret.

2. Remove the secret from source history

Section titled “2. Remove the secret from source history”

Deleting the file or the line in a new commit is not enough — the secret remains readable in git history. Rewrite history to purge it:

If the repository is public and has been cloned or forked, assume the old value is permanently exposed even after history rewrite — rotation (step 1) is what actually protects your account, not history cleanup.

3. Check for abuse

Section titled “3. Check for abuse”
  • API keys: review request volume and origins for the project in the Developer Console’s analytics/audit log.
  • OAuth apps: review recent authorizations for users you don’t recognize.
  • Webhooks: review recent deliveries for unexpected activity on the endpoint.

If you see activity you didn’t initiate, contact support (below) so the team can investigate further.

4. Prevent future leaks

Section titled “4. Prevent future leaks”
  • Never commit secrets to source control. Use environment variables or a secrets manager.
  • Add a pre-commit hook or CI check (e.g. gitleaks, trufflehog) to catch secrets before they’re pushed.
  • Scope OAuth apps and API keys to only what the integration needs.

Reporting a leak or suspicious activity

Section titled “Reporting a leak or suspicious activity”

If you believe a TrucklineMP secret has been exposed or misused and need help beyond rotating it yourself, contact:

Section titled “Related guides”