How It Works

How It Works

This page describes the detection engine in the Burp editions. Both Burp editions share the same engine.

Served-response scanning

Repository, SAST and CI scanners inspect code before deployment. They cannot see a credential that is injected at build time, delivered by runtime configuration, or bundled by a front-end toolchain.

SecretSifter inspects what a client actually receives:

• JavaScript bundles and webpack chunks
• JSON and XML API responses
• HTML pages and inline <script> blocks
• Server-side-rendered state blobs
• Request headers that carry credentials (for example Authorization, x-api-key or Ocp-Apim-Subscription-Key)

What counts as a secret

SecretSifter is designed around one test: a delivered value matters when replaying it gives the holder access or authority they did not already have. Client secrets, privileged API keys, database passwords, private keys and live payment keys meet that bar. Public identifiers such as OAuth client IDs, tenant IDs and analytics keys usually do not.

In practice, public identifiers are either filtered out or reported at LOW or INFORMATION severity so they do not crowd out real secrets. Google API keys, including Firebase web keys, are reported as HIGH.

Detection layers

Anchored rules

Anchored rules match tokens with a fixed, recognizable format, such as GitHub tokens, AWS access key IDs, Stripe keys and Slack tokens. Most are fixed-prefix vendor tokens; a few cover fixed structural formats such as JWTs and bcrypt hashes. The Burp editions ship 133 anchored rules.

Context-gated rules

Some credentials have no distinctive format. A context-gated rule only reports a match when a vendor keyword appears near the value. The Burp editions ship 51 context-gated rules.

Heuristic scanners (FULL tier)

The FULL tier adds scanners for secrets that match no known vendor rule: a generic key-value scanner, a high-entropy scanner, server-side-rendered state blobs, base64 blobs, a recursive JSON walker, an XML leaf scanner, a JavaScript getter-function scanner, and computed-property objects. PII detection (SSNs and credit card numbers) also runs at FULL when it is enabled, which it is by default.

Scan tiers

Tier	What runs
FAST	Anchored rules, URL credentials, custom rules, commented-out GUIDs next to credential keys, and hardcoded CryptoJS/sjcl passphrases
LIGHT	FAST plus database connection strings and the 51 context-gated rules
FULL	LIGHT plus the heuristic scanners and PII detection

Set the tier with the Scan Tier dropdown on the Bulk Scan tab. The default is FULL. A new tier takes effect when you click Start Scan or Scan Site Map, and it then also applies to passive scanning. Custom rules run on every tier.