OWASP Incubator project: detects credentials exposed in browser-delivered content (JavaScript, config responses, live traffic).
SecretSifter is an OWASP Incubator project that finds credentials exposed in what web applications actually deliver to the browser: JavaScript bundles, configuration responses and other live content.
Pre-deployment secret scanning looks at source code. Some credentials are only introduced at build time or runtime, so they never appear in the repository being scanned. SecretSifter inspects traffic as it reaches the browser and reports each finding with its location and evidence for a tester to assess.
| Edition | Get it | Source |
|---|---|---|
| Burp Suite extension | Build from source | burp-extension/ (MIT) |
| Burp Suite extension with AI triage and MCP | Build from source | burp-mcp/ (MIT) |
| Chrome extension | Chrome Web Store | Coming soon (MIT, on the roadmap) |
| Firefox extension | Firefox Add-ons | Coming soon (MIT, on the roadmap) |
| Desktop app (macOS, Windows) | Releases | Coming soon (MIT, on the roadmap) |
| InsecureShield practice target (synthetic credentials only) | secretsifter/insecureshield-demo | MIT |
Both Burp editions build with ./gradlew shadowJar (Java 17+). Each folder has its own README with build and install steps.
Only scan applications you own or are authorized to test. If you find a live credential, report it so it can be rotated, and never publish its value.
Issues and pull requests are welcome, especially new detection rules with test cases for both true and false positives.
Contributions are accepted under the Developer Certificate of Origin. Sign off each commit with git commit -s.
Project page: owasp.org/projects/secretsifter
Source code is licensed under MIT (see LICENSE). Documentation is licensed under CC BY-SA 4.0.
