Repository navigation
Home
SecretSifter is an OWASP Incubator project that finds credentials exposed in what web applications actually deliver to the browser: JavaScript bundles, configuration responses, API responses, HTML and request headers.
Most secret scanners look at source code: a Git repository, a CI pipeline, a container image. A credential can be absent from the repository and still reach every visitor's browser, because it was injected at build time, delivered by runtime configuration, or bundled by a front-end toolchain.
SecretSifter scans the other side: the content a client actually receives. It complements repository and CI scanning; it does not replace them.
| Edition | Best for | Get it |
|---|---|---|
| Burp Suite extension | Testers working in Burp Suite |
Releases (source in burp-extension/, MIT) |
| Burp MCP edition | The Burp extension plus AI triage and a local MCP server |
Releases (source in burp-mcp/, MIT) |
| Browser extension | Quick scanning while you browse | Chrome Web Store and Firefox Add-ons |
| Desktop app (Windows, macOS) | Standalone scanning without Burp | secretsifter/secretsifter-desktop |
This wiki documents the two Burp editions in detail, because their source is in this repository. The browser extension and desktop app are free releases; publishing their source under MIT is on the project roadmap.
- Passive scanning of responses as they pass through Burp
- Bulk Scan of URL lists, HAR files and the site map
- 133 anchored vendor-token rules and 51 context-gated rules, plus heuristic scanners
- Three scan tiers (FAST, LIGHT, FULL) to trade speed for coverage
- Custom regex rules and importable community rule files
- HTML, CSV and JSON exports
- MCP edition only: optional AI triage and a local MCP server
- Installation
- Quick Start
- How It Works
- Detection Rules
- Configuration
- AI Triage (MCP edition)
- MCP Integration (MCP edition)
- Troubleshooting and FAQ
- Contributing
- H. Gorijala, "Secrets That Survive Everything: Runtime Credential Exposure in Production Web Applications," IEEE Access, 2026. https://doi.org/10.1109/ACCESS.2026.3734984
- H. Gorijala, "SecretSifter: A Runtime Secret-Detection Engine for Live Web Traffic," SoftwareX, vol. 36, 103087, 2026. https://doi.org/10.1016/j.softx.2026.103087
Source code is licensed under MIT. This documentation is licensed under CC BY-SA 4.0.