Repository navigation
Troubleshooting FAQ
This page covers the Burp editions.
- Use Burp Suite 2025.6 or later. On older versions the passive scan check is skipped, and Extensions, Output may say "Community Edition" even on Professional.
- Open Extensions, Errors and look for messages.
- Load the release JAR (
secretsifter-1.0.3.jarorsecretsifter-mcp-1.0.2.jar), or a JAR you built with./gradlew shadowJar.
- Set Scan Tier on the Bulk Scan tab to FULL.
- Make sure the response actually passes through Burp.
- For JavaScript-heavy apps, keep Follow
<script src>and Follow webpack chunks on, or browse the app through Burp and click Scan Site Map. - For secrets in request headers, check that Scan request headers / body for secrets is on.
- Check that the host is not covered by the CDN blocklist and that the key name is not in the Key Name Blocklist.
Turn Proxy Intercept off. If Intercept is on, Burp holds the scan's requests.
- Use the FAST or LIGHT tier.
- Add high-volume analytics or third-party hosts to the CDN blocklist.
Burp's passive scan check and Dashboard issues require Burp Suite Professional. In Community Edition, use Bulk Scan, Scan Site Map, or the SecretSifter tab on responses in the HTTP message editor. To collect passive findings in the Bulk Scan table, turn on Scope Monitor.
- Install a supported browser in its standard location: Chrome or Edge on Windows; Chrome, Chromium or Edge on macOS; Chrome or Chromium on Linux (or on your
PATH). - Check Extensions, Output for a browser-not-found message.
- Make sure the Proxy port on the Bulk Scan tab matches Burp's proxy listener, and that Intercept is off.
- Check that Enable custom rules is on and that you clicked Save Settings.
- Check the format:
RuleName | regex | severity, with a space on each side of the pipes. - Look in Extensions, Errors for an invalid-regex message.
- Write
\b, not\\b. - The match may be filtered as noise. Custom rules only (raw) reports every regex hit, but it turns off all built-in detection while it is on, so use it only to test your rules.
- Burp AI (Pro): requires Burp Suite Professional 2025.2 or later with AI features enabled.
- Anthropic or OpenAI / Compatible: enter an API key in Settings, AI Triage and save.
Triage waits up to 10 minutes for your MCP client. Turn on the MCP server and connect your client before clicking AI Triage All.
- Check that Enable MCP server on 127.0.0.1:8765 is on and saved.
- Use Copy CLI Command so the URL and token are exact.
- If you regenerated the token, update your client's configuration.
- Restart the client after adding the server.
Is SecretSifter open source? The Burp editions are open source under MIT, with source in this repository. The browser extension and desktop app are free releases, and publishing their source under MIT is on the roadmap.
Does it send my data anywhere? The scanner makes requests to the URLs you scan and the resources they reference (scripts, webpack chunks and, if enabled, cross-origin APIs). Headless Browse loads full pages, including third-party resources. In the MCP edition, findings go to an AI provider when you run AI Triage, and an MCP client can read findings while the MCP server is on. See AI Triage.
How is this different from a repository secret scanner? Repository scanners read source code. SecretSifter reads what the running application delivers to the browser. They cover different gaps, so use both. See How It Works.
Why was a public identifier not reported, or reported as LOW? Values that give no extra access, such as OAuth client IDs or tenant IDs, are filtered or reported at low severity. See How It Works.
How many rules are built in? 133 anchored rules and 51 context-gated rules, plus heuristic scanners at the FULL tier. See Detection Rules.
Where do I report a bug or suggest a rule? Open an issue on OWASP/SecretSifter. See Contributing.
OWASP SecretSifter is an OWASP Incubator project. Documentation licensed under CC BY-SA 4.0.
Getting started
Understanding the tool
MCP edition
Help