DEV Community: Khaled Hani

How My Open-Source Scanner Caught a Crypto Scammer Exposing Their Own Keys

Khaled Hani — Sat, 11 Jul 2026 06:37:35 +0000


Exposing the keys in the GitHub Issue	The Phishing Site (Notice the Spotify option)

There is a golden rule in cybersecurity: the weakest link is almost always human error. But what happens when that human error comes from a malicious actor trying to orchestrate a crypto phishing scam? The result is surprisingly comedic.

Here is the story of how my newly built open-source secret scanner, Sentinel, accidentally neutralized a Tether (USDT) phishing operation during a routine benchmark.

The Setup: Testing in the Wild

I recently released Sentinel, a statically compiled, context-aware Git secret scanner and pre-commit hook written in Go. After fine-tuning its engine to achieve near-zero false positives, I decided to benchmark it "in the wild" by scanning random, recently updated repositories on GitHub.
The goal was to see if Sentinel could catch edge-case credentials that traditional, regex-heavy tools often miss or drown in noise. During the scan, Sentinel instantly flagged a critical severity finding in a rather suspicious repository.

The Catch: AI Copy-Paste Gone Wrong

Upon inspecting the flagged file, the issue was immediately apparent: a fully exposed, hardcoded Firebase configuration object containing the API key, project ID, and messaging sender ID.
It was a textbook case of a script kiddie asking an AI for a web login template and blindly copy-pasting the frontend code into a public repository. They had effectively handed over the administrative keys to their backend infrastructure before the project even launched.

The Phishing Site: Logging into Crypto with Spotify?

Out of professional curiosity, I checked the Vercel deployment linked to the repository. The project was attempting to impersonate Tether (USDT), the world's largest stablecoin. It featured the official logo, a catchy slogan, and a login prompt designed to harvest credentials.
However, because the scammer had blindly copied a generic consumer application template, the authentication options presented to the victims were:

Continue with Google
Continue with Phone
Continue with Spotify Yes, the threat actor was attempting to steal cryptocurrency wallets by asking victims to authenticate via their music streaming accounts. It was a masterpiece of absolute incompetence.

The Confrontation

I could not let this slide. I navigated to the scammer's GitHub repository, opened a public Issue, and left them a piece of professional advice.
Issue Title: If you want to scam someone, you must first learn how to protect yourself.
Comment: "Ask the AI you used about the dangers of leaving this information public, you fool. Learn first before you experiment."
By exposing their keys publicly in the issue and highlighting the flaw, their Firebase project was flagged, effectively neutralizing the phishing attempt before it could claim any victims.

The Technical Takeaway

While the story provides a good laugh, it highlights a severe reality in modern software development:

AI Code Generation is a Double-Edged Sword: The blind reliance on AI-generated code without understanding environment variables (.env) is causing a massive spike in leaked secrets.
Standard Tools Miss Context: Many traditional scanners rely heavily on mathematical entropy and might ignore loosely structured configurations if they do not match strict regular expressions. This architectural flaw is exactly why I built Sentinel. It does not just look for random strings; it utilizes lexical context-awareness to catch hardcoded assignments. This ensures that whether you are a senior engineer making a late-night mistake or a clueless scammer copying code, your secrets are caught before they enter the version control history.

Secure Your Code (Don't be like our Tether guy)

If you want to ensure you never accidentally push your API keys, AWS credentials, or database connection strings to GitHub, take a look at Sentinel. It installs in seconds as a pre-commit hook and runs silently in the background, utilizing a three-tier detection pipeline built for speed.
🔗 Check out Sentinel on GitHub
If you enjoyed this case study, consider dropping a star on the repository, and let me know in the comments about the most absurd bug or leak you have ever encountered in the wild.

How to block API keys from leaking to Git with zero performance overhead

Khaled Hani — Tue, 07 Jul 2026 15:05:21 +0000

Hello everyone,

I wanted to share Sentinel, an open-source, statically compiled Git pre-commit hook and credentials scanner written in Go.

The project was born out of frustration with existing tools. Most secret scanners are either written in heavy runtime languages (Python, Node.js) that delay developer commit times, or they consume substantial memory footprints (sometimes over 150 MB RSS) just to scan a few staged lines of code.

Our goal was simple: block credential leaks at the local commit stage with a tool that runs under 30ms and consumes less than 12 MB of RAM.

Technical Architecture & Optimization Decisions

To keep the scan latency sub-30ms without sacrificing recall accuracy, we built a three-tier pipeline:

Flat DFA Trie Representation: Rather than relying on pointer-heavy tree structures ([256]*acNode) for the Aho-Corasick automaton, Sentinel compiles rule prefixes into a flat, contiguous, integer-indexed DFA table ([128]uint16). This keeps the trie lookup memory footprint under 500 KB and limits total Resident Set Size (RSS) to ~11 MB (the baseline overhead of the Go runtime).
Buffer-Pooled Base64 Pipeline: Staged assets often contain encoded configurations. To decode and scan inline Base64 data, we implemented a thread-safe sync.Pool for reusable byte buffers. Reusing buffers across the scanning loop completely eliminates heap allocations on the hot path.
Context-Aware Suppression: To eliminate the developer-fatiguing false positives common in entropy-based scanners, Sentinel uses context validation. It checks assignment syntax (LHS vs. RHS), comments, file extensions, and variable names (e.g., ignoring variables prefixed with mock, fake, or dummy) before raising an alert.

Performance Benchmarks

Here is a performance snapshot comparing Sentinel v2.0.5 against Gitleaks and TruffleHog on standard hardware (octa-core ARM64 workstation):

Metric	Sentinel v2.0.5	Gitleaks v8.30.1	TruffleHog v3.95.7
Binary Size	11.6 MB	42.5 MB	185.0 MB
Peak RAM (RSS)	11.2 - 11.6 MB	15.0 - 16.8 MB	152.9 - 155.7 MB
Staged File Scan	30 - 40 ms	210 - 220 ms	7.13 - 11.41 s
Git History Scan	60 - 140 ms	160 - 260 ms	6.32 - 9.05 s
Dependencies	None (Static)	None (Static)	Python Runtime

Quick Start

Sentinel is fully self-contained and has native support for Linux, macOS, and Android/Termux.

You can install it directly via Go:

go install https://github.com/sentinel-cli/sentinel/v2/cmd/sentinel@latest

Or download the pre-compiled binary for your architecture from our releases page, then protect your repository:

# Initialize the pre-commit hook in the current repository
sentinel install

# Or set it up globally for all future repositories
sentinel install --global

Looking for Feedback

We would love to hear your feedback on the architecture, custom rule compiler, or general implementation. The repository is open-source under the AGPLv3 license.
Project repository: https://github.com/sentinel-cli/sentinel
Thank you for your time, and I look forward to your suggestions!

.

Khaled Hani — Mon, 06 Jul 2026 19:47:04 +0000

Khaled Hani

Jun 28

I built Sentinel: A blazing fast, regex-free secret scanner in Go 🛡️

#showdev #go #performance #security

1 min read

[Boost]

Khaled Hani — Mon, 06 Jul 2026 07:58:25 +0000

Khaled Hani

Jun 28

I built Sentinel: A blazing fast, regex-free secret scanner in Go 🛡️

#showdev #go #performance #security

1 min read

I built Sentinel: A blazing fast, regex-free secret scanner in Go 🛡️

Khaled Hani — Sun, 28 Jun 2026 02:55:34 +0000

If you’ve ever used standard secret scanners (like Gitleaks or TruffleHog) in a heavy CI/CD pipeline, you’ve probably hit the "Catastrophic Backtracking" wall. A massive minified JS file slips in, the regex engine chokes, and your pipeline freezes.

I got extremely frustrated with the performance bottlenecks and false positives, so I decided to rewrite the architecture from scratch.

Meet Sentinel, an enterprise-grade, ultra-fast pre-commit scanner written in Go.

🔥 How it’s different:

Aho-Corasick Engine: Instead of relying purely on Regex, the core engine uses an Aho-Corasick automaton. It scans massive payloads in strict O(n) linear time.
Pre-Decoding Layer: It detects Base64 strings in-memory, decodes them dynamically, and feeds them back into the entropy pipeline to catch nested K8s/GCP keys.
Blob Aggregation: Multi-line certs (like JKS or PEM) are aggregated into a single CRITICAL alert instead of blasting you with 50 lines of fragmented noise.
100% Silent: Zero "skipping binary file" logs. It acts as a true silent guardian—natively using git ls-files for traversal.

📊 The Doomsday Benchmark

I built a "Doomsday Payload" (15MB of compressed minified strings mixed with 100+ structural baits like UPPER_SNAKE_CASE constants).
Result: Sentinel ripped through it in ~1.5s with a flawless 100% signal-to-noise ratio.

It is fully open-source under the AGPL-3.0 license. I'd love for the community to try it out, read the code, and give me some harsh feedback!

GitHub Repo: https://github.com/sentinel-cli/sentinel