StegoWipe

Who it's for

Journalists, leak-handling editors, and activists who currently rely on ExifTool or generic 'strip metadata' tools that clear EXIF but not the pixel-embedded steganographic watermarks just disclosed in the MS Paint reverse-engineering writeup.

The problem

legal/safety exposure — an embedded GUID in an edited image can tie a published leak back to a specific device or Microsoft account, deanonymizing a source; this is a subpoena/safety risk, not mere inconvenience.

How to build it

Offline-capable web app (WASM, no upload) plus a CLI for bulk newsroom use; drag-drop an image, get a report + a re-encoded clean copy.

How it makes money

Free single-image web check funds itself via a $9/mo or $99 one-time bulk CLI/API tier bought by newsroom digital-security teams and J-school programs who must vet source-submitted images before publication and can't trust a random free browser tool with unverified images.

Why it doesn't exist yet

Microsoft/Adobe have no incentive to publicize or help remove their own embedded watermarks, and forensic/OSINT firms keep decode techniques proprietary; the reverse-engineering writeup just went public (HN 495pt), giving an indie a narrow window to ship a detector/stripper before ExifTool or a browser extension bakes it in natively.

First users

Post directly into journalist/OSINT safety Signal groups, r/privacy, and Freedom of the Press Foundation-adjacent Slacks referencing the HN disclosure — people who just learned their past screenshots may be traceable will search for a fix same-week.

Build size

2 people x 8 weeks — includes: decoder for the disclosed MS Paint/Windows Photos GUID watermark, a C2PA manifest parser/viewer, and a re-encode-and-verify strip pipeline; excludes: detecting proprietary AI-generation watermarks like SynthID or Stable Diffusion invisible marks (v2 scope).

Biggest risk

Microsoft patches or changes the watermarking scheme, or an established tool (ExifTool, a browser extension) adds stego-detection within weeks now that the technique is public, erasing the differentiation.

Conditions for a hit (all 3 required)

• Given a PNG/JPEG edited in MS Paint or Windows Photos, extracts and displays the embedded GUID string if present
• Given an image carrying a C2PA manifest, displays the parsed device/software/edit-history provenance chain
• Outputs a re-encoded copy of the image with detected watermark payloads removed, and re-runs its own detector to confirm zero matches remain

How it's judged (in 6 months)

GitHub 500+ stars or Product Hunt daily top 5(judgment date 2027-02-25)

AI self-confidence 42/100 — self-reported likelihood of meeting the criterion, not a business success rate