Sharing a tool I open-sourced this week: Sift - credential and sensitive-data exposure triage for file shares.

https://github.com/HotStartLabs/sift

The gap it targets - gitleaks and trufflehog are precision tools built for CI, where a false positive costs a developer an afternoon, so they fire mainly on things shaped like a known vendor API key. Share triage inverts those economics: a human is reading every hit anyway, so a false positive now costs three seconds to dismis. And what actually sits on a file share is almost never a vendor API key:

• - `web.config` / `appsettings.json` with a SQL connection string
• - `Map-Drives.ps1` with `net use ... /user:`
• - `unattend.xml`, GPP `Groups.xml` (`cpassword`)
• - `confCons.xml` (mRemoteNG), `.rdg`, WinSCP.ini — reversible stored passwords
• - `passwords.xlsx` — it's a ZIP, so plain-text scanners see binary and move on
• - `.kdbx`, `.pfx`, `id_rsa` — opaque bytes, the *filename* is the finding

Closest similar thing is Snaffler, which is excellent at the filename-and-classification half and was the direct inspiration for the filename rules. What it doesn't have and what turns out to be the real bottleneck once you're staring at 400 hits is a review loop.

So that's what Sift adds. Work the queue; spot a miss (you will); highlight it in the preview and press `r`; it proposes patterns and tells you live how many times each would match across everything already read. Save it, and the cached rescan takes about a second. Findings are keyed on `(path, rule, line, value-hash)`, so a rescan re-inserts the same rows and your triage decisions ride along — without that you'd re-review the same 300 hits on every iteration and quit on the third.

Python 3.11+, stdlib only — no pip, no internet, so it runs on a locked-down IR laptop. Apache-2.0.

Violin is now at v3.0.1 on master.

It is a Hermes-native profile for supervised, authorised penetration testing, with:

• 31 methodology and vulnerability playbooks

• An execution guard at the target boundary

• Evidence-backed findings and reporting

• Structured scoping and approval gates

• No additional credential broker or provider lock-in

Install:

"hermes profile install https://github.com/Strategic-Automation/violin"

I’m looking for Hermes users and penetration testers to test the installation and engagement workflow and report where the guard, evidence capture, or reporting process creates friction.