After His OpenAI Key Was Stolen, He Found Stratum: a Docker-Layer Secret Scanner Crunching 700K Layers Daily
Ubunta · x · 2026-09-07
After his OpenAI API key was compromised, the author traced the logs to Stratum, a Rust project (built with gpt-6-astra) that mines Docker images for secrets:
- Unlike scanners that check small config files, Stratum targets 20–500MB image layers that are rarely inspected yet may hold 5–6× more exposed credentials
- Engineering: streaming layer downloads, RocksDB with column families and prefix-range scans, Snappy/Zstd compression, cryptographic validation (BIP39, secp256k1, Base58Check, CRC16), JWT classification, entropy checks, content-addressed caching
- It live-tests exposed OpenAI/Anthropic keys, reads OpenRouter credits, derives wallets from leaked private keys, and checks balances across seven blockchains
- A pool of Docker accounts bypasses rate limits, scanning roughly 700,000 layers per day
Beautiful engineering — essentially a high-performance loot scanner.
Related event: Stolen OpenAI Key Leads Dev to Docker-Layer Secret Scanner Stratum(2 posts)→
More from Infra
- Updated guide: running GitHub Copilot with local models via VS Code and Lemonade — admcpr · 2026-09-07
- Tech companies eye Argentina's windswept Patagonia for massive data centers — Shot-Height-7194 · 2026-09-07
- Microsoft open-sources tgrep, a trigram-indexed grep up to 52x faster than ripgrep — jedisct1 · 2026-09-07
- How should billing work when an AI system auto-selects the model? — Colddew-YJ · 2026-09-07
- Can you run Qwen Next on a 3090 + 64GB CMP 170HX? Local deployment help — JustinPooDough · 2026-09-07
- SmolVM: open-source microVM sandbox runs OpenClaw 2.0 in isolation, boots in milliseconds — aniketmaurya · 2026-09-07