Source: Help Net Security
Author: Mirko Zorz
URL: https://www.helpnetsecurity.com/2026/09/02/sift-open-source-secret-scanning/
https://www.helpnetsecurity.com/2026/09/02/sift-open-source-secret-scanning/
ONE SENTENCE SUMMARY:
Sift is an open-source CLI that rapidly scans enterprise storage and collaboration platforms for secrets, with resumable runs and optional LLM filtering.
MAIN POINTS:
- Sift searches for passwords, API keys, and sensitive data across many enterprise locations.
- Targeted sources include disks, Windows shares, AD domains, SharePoint, OneDrive, Teams, Slack, Jira, Confluence.
- Built by Stratus Security for real penetration tests, then released publicly for free.
- Tool found thousands of credentials in Jira comments missed by years of prior testing.
- Guidance changed to scan all services equally; clean file shares don’t imply overall cleanliness.
- Benchmarks on synthetic data show Sift faster than Snaffler across multiple scenarios.
- Processor time and especially memory usage were substantially lower for Sift in tests.
- Unlimited default throughput can overload servers; flags allow thread and read-rate throttling.
- Checkpoints enable interrupted scans to resume near the stopping point, avoiding full restarts.
- Plain JSON detection rules and SHA256 verification compensate for unsigned release binaries.
TAKEAWAYS:
- Comprehensive secret discovery requires scanning collaboration tools, not just file shares.
- Performance and memory efficiency can make large-scale secret scanning more operationally feasible.
- Throttling controls are essential to prevent production outages and scan cancellations.
- Local LLM filtering via Ollama can reduce false positives without data leaving the environment.
- Open-source longevity depends on active maintainers and community contributions; verify downloads carefully.