# Why the Sift Secrets Scanning Tool is Exposing Hidden Passwords in Slack and Jira

> Discover how the open-source Sift secrets scanning tool hunts exposed credentials across Microsoft 365, Slack, and Jira faster than traditional pentest utilities.

- Canonical URL: https://coreiten.com/en/article/why-the-sift-secrets-scanning-tool-is-exposing-hidden-passwords-in-slack-and-jira
- Language: en
- Section: Projects
- Author: Sami
- Published: 2026-09-05T04:02:36+03:00
- Modified: 2026-09-05T04:02:36+03:00
- Publisher: CoreITen (https://coreiten.com)
- Keywords: Sift secrets scanning tool, Stratus Security, Microsoft 365 credential scanner, Jira security scan, open-source cybersecurity tools, Ollama local language model

## Summary

Stratus Security launched Sift, a free and open-source command-line tool designed to uncover hidden credentials and API keys in cloud collaboration platforms.

- Stratus Security CTO Colin Watson stated that Sift uncovered thousands of credentials in Jira ticket comments that went unnoticed for five years.
- In August 24, 2026 synthetic benchmark tests, Sift scanned 250,000 small files in 10.61 seconds compared to Snaffler's 25.48 seconds.
- Sift consumed an average memory of 92 MiB with a peak of 102.2 MiB, significantly lower than Snaffler's 337 MiB average and 429.5 MiB peak.
- The tool integrates with Ollama to use a local language model for filtering false positives without sending sensitive client data off the machine.
- Users must verify published SHA256 sums before execution because the release binaries available on GitHub are not yet code-signed.

**Why it matters:** Collaboration apps like Slack and Jira have become major shadow IT blind spots, proving that traditional file share scans are no longer enough for comprehensive security.

---

Penetration testers and IT security teams are missing thousands of exposed passwords hidden in plain sight across cloud collaboration apps. To bridge this gap, Stratus Security has released the Sift secrets scanning tool, a free, open-source command-line utility designed to hunt down credentials, API keys, and sensitive data across platforms like Microsoft 365, Slack, and Jira.

Standard security methodologies often overlook cloud environments, focusing heavily on local file shares and Active Directory domains. However, Sift expands this scope to include SharePoint, OneDrive, Teams channel files, and Confluence. [Colin Watson](https://www.linkedin.com/in/colin-watson-3729a497/), CTO at Stratus Security, noted that during a recent engagement, the tool uncovered thousands of credentials in Jira ticket comments that previous testers had missed for five years because the platform was not part of their standard tooling.

### Performance Benchmarks: Sift vs. Snaffler

Stratus Security built Sift after abandoning its own fork of Snaffler, citing that accumulated shortcuts became more work than a complete rewrite. In synthetic benchmark tests conducted on August 24, 2026, Sift demonstrated significant speed and efficiency advantages over Snaffler 1.0.244.

| Test Scenario | Sift (Average Time) | Snaffler (Average Time) |
| --- | --- | --- |
| Scanning 250,000 small files | 10.61 seconds | 25.48 seconds |
| Processing 5.5 GiB of content | 0.69 seconds | 6.32 seconds |
| Deep, wide directory tree | 1.12 seconds | 2.37 seconds |

Beyond raw speed, memory consumption showed a wide margin. Snaffler averaged 337 MiB and peaked at 429.5 MiB, whereas Sift averaged just 92 MiB with a peak of 102.2 MiB. Across all three scenarios, Sift used only 62.11 seconds of processor time compared to Snaffler's 276.56 seconds.

### Key Features and Actionable Safeguards

Because scanning for secrets inevitably produces false positives, Sift integrates with Ollama to hand matches to a local language model for filtering. This ensures no sensitive client data ever leaves the controlled machine. Additionally, detection rules are formatted as plain JSON files, allowing security teams to add custom rules using a simple text editor rather than a compiler.

Throughput is unlimited by default, but users can set flags for thread count and read rate to avoid hammering production servers. Every scan command also writes checkpoints, allowing interrupted runs to resume exactly where they stopped. Users downloading the tool from [GitHub](https://github.com/Stratus-Security/Sift) should note that release binaries are not yet code-signed, making it critical to verify the published SHA256 sums before execution.

> It’s ultimately a risk in all open-source software that it does stop being maintained, but since we actively use the tool, we’re motivated to keep it maintained and as it grows in popularity the other side of the business is also motivated by the reputational impact.
>
>  - Colin Watson, CTO, Stratus Security

### The Shadow IT Blind Spot in Pentesting

The release of the Sift secrets scanning tool highlights a critical evolution in corporate data sprawl: collaboration platforms have become the new shadow IT for credentials. While traditional tools excel at scanning local disks and Windows file shares, the reality is that developers and employees routinely paste API keys and passwords into Slack messages or Jira tickets for quick access.

By integrating local LLM filtering via Ollama, Stratus Security solves the massive false-positive problem that usually deters teams from scanning these noisy environments. This tool forces a necessary shift in penetration testing methodologies, proving that a clean file share scan is no longer sufficient evidence of a secure network. Security teams must now treat internal chat logs and project management tickets with the same scrutiny as a root directory.

## Sources

- [helpnetsecurity.com](https://www.helpnetsecurity.com/2026/09/02/sift-open-source-secret-scanning/)