Stratus Security releases Sift, an open-source tool to scan Microsoft 365, Slack, and Jira for leaked credentials and API keys to prevent data breaches.

In the current enterprise landscape, a single password buried within a legacy configuration file or an API key left in a forgotten project folder often poses a greater risk than a complex software vulnerability. As companies scale their digital operations, sensitive credentials tend to migrate from secure vaults into the periphery of collaboration tools and shared drives. This fragmentation creates a massive attack surface where secrets hide in plain sight, waiting for a malicious actor to discover them.

To combat this systemic weakness, Stratus Security, a penetration testing consultancy, has released Sift. This free, open-source command-line tool is designed to automate the hunt for credentials, passwords, and sensitive data across the diverse environments where modern business actually happens.

Beyond the local disk: a wide scanning perimeter

Most traditional secrets scanners focus on code repositories or specific server directories. Sift expands this scope significantly, recognizing that employees often paste credentials into chat messages or documentation pages for the sake of convenience. The tool is engineered to scan not only local disks and Windows file shares but also an entire Active Directory domain.

The real value for the modern enterprise lies in its integration with cloud-based collaboration suites. Sift can sift through Microsoft 365 ecosystems, including SharePoint, OneDrive, and Teams channel files. Furthermore, it extends its reach into the primary tools used by development and operations teams, specifically Slack, Jira, and Confluence. By consolidating these disparate sources into a single scanning mission, security teams can identify where sensitive data has leaked into non-secure communication channels.

The evolution from Snaffler to Sift

The creation of Sift was born out of necessity and professional frustration. For years, many in the penetration testing community relied on a tool called Snaffler. While effective, Stratus Security found that maintaining a custom fork of Snaffler became more burdensome than building a new solution from the ground up. Sift was developed to be a cross-platform replacement that prioritizes performance and extensibility.

One of the primary technical upgrades is the use of Native AOT (Ahead-of-Time) executables. This means the tool is self-contained and does not require a separate .NET runtime installation on the target system, making it faster to deploy during security engagements. This architectural choice reduces the footprint of the tool and streamlines the execution process for security auditors.

Reducing noise through AI and custom validation

A recurring problem with secrets scanning is the high volume of false positives. Traditional regex-based scanners often flag strings that look like API keys but are actually benign identifiers, leading to alert fatigue for security analysts. Sift addresses this by implementing a more sophisticated validation layer.

The tool utilizes custom code-based validators to verify the legitimacy of a found secret. More impressively, it allows for the integration of local Large Language Models (LLMs) to filter through potential matches. By leveraging AI to analyze the context of a found string, Sift can distinguish between a real credential and a piece of dummy data, significantly reducing the manual effort required to clean up scan results.

Sift approaches the problem from a simple but powerful perspective: find the secrets before someone else does.

Operational flexibility for security teams

Sift is designed to be modular, allowing for connector flexibility as enterprise environments evolve. Whether a team is performing a routine internal audit or a high-stakes penetration test, the tool provides various levels of complexity. For those familiar with previous tools, a simple command like .\sift.exe local --path C:\ allows for an immediate start, while more advanced commands enable deep dives into cloud infrastructure.

The tool's ability to handle resumable scans ensures that large-scale enterprise environments—which may contain terabytes of data across SharePoint and Jira—can be audited without the risk of losing progress due to network interruptions or system timeouts. This makes it a viable tool for enterprise-grade security missions rather than just small-scale scripts.

The risk of credentials hiding in plain sight

The release of Sift highlights a critical vulnerability in how businesses manage their digital identity. When organizations move their documentation and identity infrastructure to the cloud, they gain productivity but often lose visibility. An API key sitting in a Jira ticket from three years ago might still be active, providing a backdoor into a production environment.

By open-sourcing this tool, Stratus Security is providing a way for companies to audit their own "digital exhaust." The goal is to move toward a state of proactive hygiene, where secrets are rotated and removed from collaboration platforms before they can be leveraged in a vishing campaign or a lateral movement attack within a network.

Global implications for US and UK enterprises

For business owners and CISOs in the USA and UK, the availability of tools like Sift underscores a shift in the regulatory and threat landscape. In the United Kingdom, the UK GDPR mandates strict controls over how sensitive data is stored and accessed; discovering that passwords are stored in plain text within Slack messages could be viewed as a failure of technical and organizational measures.

In the United States, where sector-specific regulations like HIPAA (healthcare) or GLBA (finance) apply, the presence of leaked credentials in cloud shares can lead to severe compliance penalties. Furthermore, as insurance providers in the US and UK tighten the requirements for cyber insurance policies, demonstrating a proactive approach to secrets management—such as using automated scanning tools—is becoming a necessity to maintain coverage.

Ultimately, Sift represents a democratization of penetration testing capabilities. While it is a powerful asset for defenders, it also serves as a reminder that attackers are already using similar logic to map out corporate networks. For the international entrepreneur, the lesson is clear: the cloud does not automatically secure your secrets; it only changes where they are hidden.

FAQ

---

Sources: Newsbreak, Github, Undercodenews ·