Christopher Lambert

building @bitpatrol_io (YC X25) 💻 prev @stripe | computer science @columbia | top 1% on @hackerone

[Christopher Lambert @theriley106]

@aaron_epstein @bitpatrol_io Appreciate you a ton for the shoutout, @aaron_epstein!

[Aaron Epstein @aaron_epstein]

I’ve never met anyone as obsessed with uncovering secret leaks as @theriley106. He’s been doing it for fun in his spare time, rose to the top 2% globally on HackerOne, and now launched @bitpatrol_io to give his superpowers to every company.

[Christopher Lambert @theriley106]

@curious_vii Founder here 👋 Appreciate the question! GitGuardian and tools like it are solid at detecting keys with known patterns and shapes (AWS keys, GH tokens, etc) when they show up in clean, predictable ways in code.

BitPatrol catches those too, but really shines with what those tools call “generic secrets” -- internal API keys, DB creds, obfuscated tokens, etc. We detect secrets that regex-based tools miss by understanding code context.

Prior to starting BitPatrol, I submitted dozens of secret leaks on HackerOne. Many of these companies were actively using our competitor's secret scanning tools.

[Christopher Lambert @theriley106]

@victordevguy @ycombinator @bitpatrol_io hey @victordevguy 👋 yep, it's just me! i think YC prefers companies with multiple cofounders, but i know of a few others as well that are also solo!

[Christopher Lambert @theriley106]

@IceSolst @ycombinator @bitpatrol_io appreciate you a ton @IceSolst! sent you a DM! :)

[Christopher Lambert @theriley106]

@IceSolst Founder here 👋 For context -- before starting BitPatrol, I submitted dozens of secret leaks on HackerOne. I’d estimate ~30% of the leaks I found wouldn’t pass the default entropy thresholds used by many entropy-based scanners. This is especially true for things like passwords, which often don’t have high entropy.

Our model analyzes not just the contents of a secret, but also the context around it. When something is flagged, we cross-reference it against a dataset built from billions of public commits, open-source packages, Docker images, and more to see how often that exact string has been exposed (which helps us drastically reduce false positives).

Entropy is a great starting point, and I have huge respect for the folks who built those tools!

[Christopher Lambert @theriley106]

@Visaals @Visaals Was looking for a post about this! Such an awesome tool that you’ve built here, man!! Can’t wait to upgrade once it’s switched over to live mode! 🧘

Rocking that 4242 pro badge for now 😎

[Christopher Lambert @theriley106]

Really excited to share what I've been building @bitpatrol_io!

[Y Combinator @ycombinator]

Vibe coding is flooding GitHub with leaked secrets.

BitPatrol (@bitpatrol_io) catches secrets that traditional scanners miss—preventing costly security incidents without slowing down development.

Congrats on the launch, @theriley106!

https://t.co/Yjv13qHS8m

[Christopher Lambert @theriley106]

@arafatkatze @signulll Any recommendations for an airline with good wifi?

[Christopher Lambert @theriley106]

@KillorglinKen @DavidDack Awesome work Ken!! 👏

[Christopher Lambert @theriley106]

@abacaj @abacaj Can you share the part list of your multi-3090 rig? I’m trying to build something similar with 4x 3090s, a 3955WX Threadripper and a Gigabyte MC62-G40. Super inspired by the work you’re doing here 🙏🏻

[Kevin Naughton Jr. @KevinNaughtonJr]

the first step in learning to code is buying a MacBook pro

[Christopher Lambert @theriley106]

I was awarded a $6,000 bounty on @Hacker0x01! https://t.co/E0ZMra4NJn #TogetherWeHitHarder #BugBounty #BugBountyTips

[Christopher Lambert @theriley106]

@OasisLabs @OasisLabs I know this is an old tweet, but I was curious if OasisLabs vulnerabilities fall within the scope of the OasisProtocol bug bounty? I found a 10.0 CVSS/Critical vulnerability and wasn't sure of the correct avenue for reporting it

cc @dawnsongtweets

[Christopher Lambert @theriley106]

I was awarded a $2,048 bounty on @Hacker0x01! https://t.co/E0ZMra4NJn #TogetherWeHitHarder #BugBounty

[Christopher Lambert @theriley106]

I was awarded a $5,376 bounty on @Hacker0x01! https://t.co/E0ZMra4NJn #TogetherWeHitHarder #BugBounty

[Christopher Lambert @theriley106]

I was awarded a $5,000 bounty on @Hacker0x01! https://t.co/E0ZMra4NJn #TogetherWeHitHarder

[Christopher Lambert @theriley106]

@spookyseona sorry my friend :/ hope you're feeling better

[Stripe Atlas @atlas]

Applying to @ycombinator for Summer 2022? Our team of YC application reviewers is ready to help and give feedback. Get in touch before March 14 at https://t.co/56GnKnxfvp.

[Patrick Collison @patrickc]

Stripe is partnering with Apple to enable Tap to Pay on iPhone: https://t.co/THtuND9EvQ.

(You can sign up to be notified when it's available over at https://t.co/DCFWV1KwAW.)