Penetration testers and IT security teams are missing thousands of exposed passwords hidden in plain sight across cloud collaboration apps. To bridge this gap, Stratus Security has released the Sift secrets scanning tool, a free, open-source command-line utility designed to hunt down credentials, API keys, and sensitive data across platforms like Microsoft 365, Slack, and Jira.
Standard security methodologies often overlook cloud environments, focusing heavily on local file shares and Active Directory domains. However, Sift expands this scope to include SharePoint, OneDrive, Teams channel files, and Confluence. Colin Watson, CTO at Stratus Security, noted that during a recent engagement, the tool uncovered thousands of credentials in Jira ticket comments that previous testers had missed for five years because the platform was not part of their standard tooling.
Performance Benchmarks: Sift vs. Snaffler
Stratus Security built Sift after abandoning its own fork of Snaffler, citing that accumulated shortcuts became more work than a complete rewrite. In synthetic benchmark tests conducted on August 24, 2026, Sift demonstrated significant speed and efficiency advantages over Snaffler 1.0.244.
| Test Scenario | Sift (Average Time) | Snaffler (Average Time) |
|---|---|---|
| Scanning 250,000 small files | 10.61 seconds | 25.48 seconds |
| Processing 5.5 GiB of content | 0.69 seconds | 6.32 seconds |
| Deep, wide directory tree | 1.12 seconds | 2.37 seconds |
Beyond raw speed, memory consumption showed a wide margin. Snaffler averaged 337 MiB and peaked at 429.5 MiB, whereas Sift averaged just 92 MiB with a peak of 102.2 MiB. Across all three scenarios, Sift used only 62.11 seconds of processor time compared to Snaffler's 276.56 seconds.
Key Features and Actionable Safeguards
Because scanning for secrets inevitably produces false positives, Sift integrates with Ollama to hand matches to a local language model for filtering. This ensures no sensitive client data ever leaves the controlled machine. Additionally, detection rules are formatted as plain JSON files, allowing security teams to add custom rules using a simple text editor rather than a compiler.
Throughput is unlimited by default, but users can set flags for thread count and read rate to avoid hammering production servers. Every scan command also writes checkpoints, allowing interrupted runs to resume exactly where they stopped. Users downloading the tool from GitHub should note that release binaries are not yet code-signed, making it critical to verify the published SHA256 sums before execution.
It’s ultimately a risk in all open-source software that it does stop being maintained, but since we actively use the tool, we’re motivated to keep it maintained and as it grows in popularity the other side of the business is also motivated by the reputational impact.
- Colin Watson, CTO, Stratus Security
The Shadow IT Blind Spot in Pentesting
The release of the Sift secrets scanning tool highlights a critical evolution in corporate data sprawl: collaboration platforms have become the new shadow IT for credentials. While traditional tools excel at scanning local disks and Windows file shares, the reality is that developers and employees routinely paste API keys and passwords into Slack messages or Jira tickets for quick access.
By integrating local LLM filtering via Ollama, Stratus Security solves the massive false-positive problem that usually deters teams from scanning these noisy environments. This tool forces a necessary shift in penetration testing methodologies, proving that a clean file share scan is no longer sufficient evidence of a secure network. Security teams must now treat internal chat logs and project management tickets with the same scrutiny as a root directory.
