After His OpenAI Key Was Stolen, He Found Stratum: a Docker-Layer Secret Scanner Crunching 700K Layers Daily
Ubunta · x · 2026-09-07
After his OpenAI API key was compromised, the author traced the logs to Stratum, a Rust project (built with gpt-6-astra) that mines Docker images for secrets:
- Unlike scanners that check small config files, Stratum targets 20–500MB image layers that are rarely inspected yet may hold 5–6× more exposed credentials
- Engineering: streaming layer downloads, RocksDB with column families and prefix-range scans, Snappy/Zstd compression, cryptographic validation (BIP39, secp256k1, Base58Check, CRC16), JWT classification, entropy checks, content-addressed caching
- It live-tests exposed OpenAI/Anthropic keys, reads OpenRouter credits, derives wallets from leaked private keys, and checks balances across seven blockchains
- A pool of Docker accounts bypasses rate limits, scanning roughly 700,000 layers per day
Beautiful engineering — essentially a high-performance loot scanner.
Related event: Stolen OpenAI Key Leads Dev to Docker-Layer Secret Scanner Stratum(2 posts)→
More from Infra
- Legora runs 2,000 parallel agent evals on Modal Sandboxes for legal AI — blelbach · 2026-10-27
- Cloud release velocity scores: AWS 95, Azure 90, Google Cloud 82 — DavidLinthicum · 2026-10-27
- Selling a 5090 to scale local inference: one business weighs 5 hardware paths — Anarchaotic · 2026-10-27
- AWS tutorial: fleet-wide edge CV model lifecycle with SageMaker SDK v3, ~$0.07 per run — AWS ML Blog · 2026-10-27
- Qwen3.8-27B hits 40 tok/s on Jetson Thor with INT4 + MTP, accuracy beats FP16 — No-Dragonfly6246 · 2026-10-27
- Celesto launches CI runners nearly 90% cheaper than GitHub Actions, with agent sandboxes — aniketmaurya · 2026-10-27