Stolen API key uncovers Stratum, a Rust scanner sweeping 700,000 Docker layers a day for secrets
Ubunta · x · 2026-09-07
After his OpenAI API key was compromised, developer Ubunta traced the leak to Stratum — an impressively engineered Rust project that scans Docker image layers for secrets. Unlike scanners that check small config files, Stratum targets the rarely-inspected 20–500 MB layers holding up to 5-6× more exposed credentials. Highlights: streaming layer downloads, RocksDB with column families, Snappy/Zstd compression, BIP39/secp256k1/Base58Check validation, JWT classification with entropy checks, and content-addressed caching. It live-tests exposed OpenAI/Anthropic keys, reads OpenRouter credits, derives wallets from leaked private keys across seven blockchains, and uses a Docker account pool to scan 700,000 layers daily.
Related event: Stolen OpenAI Key Leads Dev to Docker-Layer Secret Scanner Stratum(2 posts)→
More from Safety
- Fangcun AI, China's first independent frontier AI safety lab, launches with DeepSeek eval report — JacquesThibs · 2026-10-26
- ESR on the Bugpocalypse: locking down frontier models only hands the game to Chinese open weights — colinmcnamara · 2026-10-26
- OpenCode breach exposed AI API keys of 1.4% of Console users — thione · 2026-10-26
- DHS orders DeepSeek products removed from US civilian agency systems — thione · 2026-10-26
- One hacker breached 100+ company websites using AI, scope unknown — thione · 2026-10-26
- METR red-teams OpenAI's agent monitoring, finds bypasses and gaps — thione · 2026-10-26