Contributing

Contributing

Contributions are welcome: detection rules, false-positive fixes, bug fixes and documentation.

Ways to contribute

• Detection rules: add a vendor token format that is not yet covered.
• False-positive fixes: report or fix a value that is reported but gives no real access.
• Bugs and features: open an issue with steps to reproduce.
• Documentation: suggest fixes to these wiki pages in an issue.

Contributing a rule

Rules use the format in Detection Rules:

RuleName | regex | severity

Before submitting:

1. Check that the vendor is not already covered by the built-in rules (Patterns.java) or the community rule files.
2. Prefer anchored patterns, with a fixed prefix and length. If the value is generic, require a nearby vendor keyword.
3. Use a valid Java regular expression, and test it.
4. Justify the severity. If replaying the value gives no new access, it does not need a rule.
5. Link to the vendor's public documentation of the token format, if there is one.

Low-noise, vendor-specific patterns go in community-rules-standard.txt. Broader or noisier patterns go in community-rules-extended.txt. Both files are in burp-extension/community-rules/.

Building from source

Requires Java 17 or later. Each Burp edition builds from its own folder with the included Gradle wrapper:

git clone https://github.com/OWASP/SecretSifter.git
cd SecretSifter/burp-extension     # or: cd SecretSifter/burp-mcp
./gradlew shadowJar

The JAR is written to build/libs/ (secretsifter-1.0.3.jar or secretsifter-mcp-1.0.2.jar).

Run the tests with ./gradlew test. The report is in build/reports/tests/test/index.html. Please add a test for any new rule or detection change.

Pull requests

1. Fork the repository and create a branch.
2. Make your change, with tests where they apply.
3. Run ./gradlew test in the folder you changed.
4. Sign off each commit with git commit -s. Contributions are accepted under the Developer Certificate of Origin.
5. Keep the change focused, and explain what it does and why.
6. For a new rule, include a synthetic sample value and a reference to the token format.

Test fixtures that look like real credentials can be blocked by GitHub push protection. Split them into concatenated strings, for example "sk_live_" + "ABC…", as the existing tests do.

Reporting a security issue

If you find a vulnerability in SecretSifter itself, email the project leader at hemanth.gorijala@owasp.org instead of opening a public issue.

Project leaders

• Hemanth Gorijala (hemanth.gorijala@owasp.org)