Hemanth Gorijala is a security researcher and Global Pentest Lead at a Fortune 100 financial services company, where he leads application security assessments and reviews vulnerability reports in enterprise bug bounty programs. His work focuses on the runtime credential gap: the space between where shift-left secret scanning stops and where credentials actually appear in production. He built SecretSifter to detect them passively in live traffic without requiring source code access or configuration. This talk covers how blue teams can deploy SecretSifter to monitor production traffic and catch credentials before attackers do. His research has been presented at DEF CON 34 Demo Labs, The Carnegie Mellon Software Engineering Institute (SEI’s Secure by Design), and BSides conferences across the US. SecretSifter is open source at github.com/secretsifter.
Twitter