A password lands in a Jira comment because somebody was reproducing a bug, and it stays there, indexed and readable by everyone on the project, long after the ticket closes. Stratus Security CTO Colin Watson says his firm's scanner pulled thousands of those out of one client's tickets on his most recent engagement, and that the tester who held the account for the five years before had never noticed, because ticket comments are not in the standard tooling or methodology [3]. Watson declines to rank the hiding places and tells clients to check every service equally [4]. That is the honest version of the advice: a clean file share report is a statement about file shares.
The performance case is Stratus's own, run against its own tool on synthetic repositories on 24 August 2026, three runs per scenario [5][11]. Averaged, Sift finished in 12.42 seconds where Snaffler 1.0.244 took 34.18, and burned 62.11 processor seconds against 276.56 [9]. That is 2.75 times faster on the clock and 4.45 times cheaper in CPU [1][2], with average memory of 92 MiB against 337 MiB, a factor of 3.7 [10][3]. Divide processor seconds by elapsed seconds and you see how wide each tool ran: 5.0 for Sift, 8.1 for Snaffler [5]. Snaffler used more concurrency and still finished later. The widest single gap was raw throughput, 0.69 seconds against 6.32 on 5.5 GiB, about nine to one [7][4]. Treat the ratios as direction rather than measurement, with one point in Stratus's favour: it patched out Snaffler's once-per-minute completion check-in, which was the easiest available way to flatter its own numbers [12].
Throughput is unlimited by default, which is how a scan gets killed by whoever owns the file server; thread count and read rate are flags, and every scan writes checkpoints so an aborted run resumes near where it stopped [13]. False positive triage can be handed to a local model through Ollama, with no scan data leaving the machine [14], which is the correct default for a corpus that is by definition every password the client left lying around. Detection rules are plain JSON, and a custom rules directory replaces the bundled catalog instead of extending it [17], so a first custom rule quietly narrows the scan unless the defaults get copied in.
The maintenance question is not theoretical. Stratus ran a Snaffler fork before this and dropped it when the accumulated shortcuts became more work than a rewrite [15]. Watson's answer is that the firm uses Sift on live engagements and has reputation riding on it as it spreads [16]. That is a better answer than a roadmap, and it is still a consultancy's spare capacity.
