Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira
Sift is a free, open-source command line tool that searches for passwords, API keys, and other sensitive data across the places a company keeps its work: local disks, Windows file shares, an entire Active Directory domain, SharePoint, OneDrive, Teams channel files, Slack messages, and Jira and Confluence. Stratus Security, a penetration testing consultancy, built it for its own engagements and released it for free.
Where the credentials are
Colin Watson is CTO at Stratus Security and works the engagements himself. “For example, on my most recent pentest there were thousands of credentials in Jira ticket comments found by this tool and their pentester for 5 years prior had never noticed since it’s not in the standard tooling or methodology,” he told Help Net Security.
Watson said the finding changed the advice his firm gives, but not by producing a ranked list of danger spots. “It has absolutely changed the advice, but none of the spots are a priority over the others, we recommend they check all possible services equally.” If you take one thing from this, it is that a clean file share scan tells you about your file shares and nothing else.
It is also faster, and here is by how much
Stratus ran Sift against Snaffler 1.0.244 on synthetic file repositories on 24 August 2026, three runs per scenario. Scanning 250,000 small files took Sift 10.61 seconds against Snaffler’s 25.48. Pushing 5.5 GiB of content through took 0.69 seconds against 6.32. A deep, wide directory tree took 1.12 seconds against 2.37. Averaged across all three, Sift finished in 12.42 seconds where Snaffler took 34.18, and used 62.11 seconds of processor time where Snaffler used 276.56.
Memory is the wider margin. Snaffler averaged 337 MiB and peaked at 429.5 MiB; Sift averaged 92 MiB and peaked at 102.2 MiB. These are Stratus’s own benchmarks against its own tool, run on synthetic data, so treat the ratios as a direction. Stratus did patch Snaffler to report completion immediately rather than waiting out its once per minute check-in, removing an artifact that would have flattered Sift.
Throughput is unlimited by default, and a scan that hammers a production file server is a scan somebody cancels. Flags for thread count and read rate exist for that reason. Every scan command also writes checkpoints, so an interrupted run picks up near where it stopped instead of starting over.
Scanning for secrets produces false positives, and Sift can hand its matches to a local language model to filter them. The model runs through Ollama on a machine you control, with no scan data leaving it, which matters when the data in question is every password your client left lying around.
Somebody has to keep this alive
Stratus maintained a Snaffler fork before writing Sift, and abandoned it once the accumulated shortcuts became more work than a rewrite. Now the maintenance sits with a consultancy that has client work to deliver, which is how open source tools often quietly die.
Watson does not dodge this. “It’s ultimately a risk in all open-source software that it does stop being maintained, but since we actively use the tool, we’re motivated to keep it maintained and as it grows in popularity the other side of the business is also motivated by the reputational impact.” He wants outside patches and suggestions: “ultimately all open-source tooling is better as a community.”
Detection rules are plain JSON files, so adding one takes a text editor rather than a compiler, and a custom rules directory replaces the bundled catalog rather than adding to it. Release binaries are not code signed yet. Check what you download against the published SHA256 sums.
Sift is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
