After His OpenAI Key Was Stolen, He Found Stratum: a Docker-Layer Secret Scanner Crunching 700K Layers Daily
Ubunta · x · 2026-09-07
After his OpenAI API key was compromised, the author traced the logs to Stratum, a Rust project (built with gpt-6-astra) that mines Docker images for secrets:
- Unlike scanners that check small config files, Stratum targets 20–500MB image layers that are rarely inspected yet may hold 5–6× more exposed credentials
- Engineering: streaming layer downloads, RocksDB with column families and prefix-range scans, Snappy/Zstd compression, cryptographic validation (BIP39, secp256k1, Base58Check, CRC16), JWT classification, entropy checks, content-addressed caching
- It live-tests exposed OpenAI/Anthropic keys, reads OpenRouter credits, derives wallets from leaked private keys, and checks balances across seven blockchains
- A pool of Docker accounts bypasses rate limits, scanning roughly 700,000 layers per day
Beautiful engineering — essentially a high-performance loot scanner.
Related event: Stolen OpenAI Key Leads Dev to Docker-Layer Secret Scanner Stratum(2 posts)→
More from Infra
- Anthropic's ~11 GW contracted compute estimated at ~42% NVIDIA GPUs, ~4.5 GW Google TPU — ns123abc · 2026-10-27
- EdgeRock-4B holds KV cache at 72 MiB across 256K context, 99.1% smaller than Qwen3.5-4B — alifcoder · 2026-10-27
- RTX 5080 price jumps from $1658 to $2318 in ten days on Amazon — Frizzy-MacDrizzle · 2026-10-27
- ComfyUI on 12GB VRAM: measured peaks show offloading turns 24s into 11 minutes — Impossible-Mail-4619 · 2026-10-27
- Neon rebuilds its docs search entirely on its own stack: Lakebase Search, Functions, AI Gateway — matei_zaharia · 2026-10-27
- PyTorch details 2.12x faster on-device streaming ASR on Arm SME2 via ExecuTorch — PyTorch · 2026-10-27