OWASP SecretSifter

What it does

Pre-deployment secret scanning looks at source code, but some credentials are introduced at build time or by runtime configuration and never appear in the repository. SecretSifter inspects the content a client actually receives and reports each finding with its location and evidence for a tester to assess. It complements repository and CI scanning; it does not replace them.

Editions

• Burp Suite extension: open source (MIT), source in burp-extension/

• Burp MCP edition: the Burp extension plus optional AI triage and a local MCP server, open source (MIT), source in burp-mcp/

• Browser extension for Chrome and Firefox: free release

• Desktop app for Windows and macOS: free release

Publishing the browser extension and desktop app source under MIT is on the project roadmap.

Latest releases

• Burp Suite extension v1.0.3, released October 14, 2026

• Burp MCP edition v1.0.2, released October 14, 2026

Research

• H. Gorijala, "Secrets That Survive Everything: Runtime Credential Exposure in Production Web Applications," IEEE Access, 2026. https://doi.org/10.1109/ACCESS.2026.3734984

• H. Gorijala, "SecretSifter: A Runtime Secret-Detection Engine for Live Web Traffic," SoftwareX, vol. 36, 103087, 2026. https://doi.org/10.1016/j.softx.2026.103087

Get involved

Issues and pull requests are welcome, especially new detection rules with test cases.