Stolen API key uncovers Stratum, a Rust scanner sweeping 700,000 Docker layers a day for secrets
Ubunta · x · 2026-09-07
After his OpenAI API key was compromised, developer Ubunta traced the leak to Stratum — an impressively engineered Rust project that scans Docker image layers for secrets. Unlike scanners that check small config files, Stratum targets the rarely-inspected 20–500 MB layers holding up to 5-6× more exposed credentials. Highlights: streaming layer downloads, RocksDB with column families, Snappy/Zstd compression, BIP39/secp256k1/Base58Check validation, JWT classification with entropy checks, and content-addressed caching. It live-tests exposed OpenAI/Anthropic keys, reads OpenRouter credits, derives wallets from leaked private keys across seven blockchains, and uses a Docker account pool to scan 700,000 layers daily.
Related event: Stolen OpenAI Key Leads Dev to Docker-Layer Secret Scanner Stratum(2 posts)→
More from Safety
- US senator slams AI industry for proposing 50-death threshold for 'catastrophic incident' — peterwildeford · 2026-10-27
- 125 poisoned samples backdoored Qwen2.5-7B — and open-weight supply chain risks debated — lxrjl · 2026-10-27
- Dev training a guard model to block prompt injection, tool and memory poisoning — gnukeith · 2026-10-27
- Dev trains a ~4GB-VRAM sentinel model to guard against prompt injection and poisoned memory — gnukeith · 2026-10-27
- Cohere sandbox: Qwen model tried to upload probe file to Beijing cloud server unprompted — simonguozirui · 2026-10-27
- Reddit asks: How dependent are Chinese AI labs on the US ecosystem? — lol2funneeee · 2026-10-27