kingfisher

Detect and Validate Secrets Anywhere. Map Access. Revoke Fast.

Find leaked secrets. Validate what’s live. Map the blast radius. Revoke fast.

Kingfisher is a blazingly fast, completely free and open source secret scanner built in Rust. It detects leaked secrets across your entire stack with hundreds of built-in rules, validates which credentials are actually live, maps the blast radius of every leak, and revokes exposed secrets in minutes - the full defender workflow in one Apache-2.0-licensed release:

Detect → Validate → Map → Triage → Revoke

• scan source code, Git history, cloud storage, container images, archives, and developer platforms
• validate which credentials are active
• map a leaked secrete's identity, permissions, and reachable resources
• triage findings in a browser, or output as SARIF, JSON, TOON
• revoke supported secrets

Defender workflow: Follow the end-to-end defender workflow for secret detection, validation, notifications, blast-radius mapping, and revocation.

Scan Targets

Kingfisher handles local files and directories, Git repositories and history, compressed and office-document archives, SQLite databases, Python bytecode, Docker images, source-hosting organizations, cloud object storage, collaboration tools, and API-development platforms.

For target-specific commands, authentication, scope, and pagination behavior, use the platform integration guide.

Built for Speed and Accuracy

Kingfisher's multithreaded Vectorscan engine recorded the lowest runtime on every repository in the published benchmark suite, from small projects through the Linux kernel and GitLab monorepo. Lower runtimes are better.

Despite it's broad feature-set, Kingfisher ships as a compact static binary. For example, the published macOS arm64 comparison measures Kingfisher 2.1.0 at 25.3 MiB, making it easy to distribute in CI jobs and container images.

See the binary-size comparison and deployment options, which includes validation results, network-request counts, test environment, and binary-size comparison.

Why Kingfisher

Live validation, advanced cloud blast-radius analysis, visual triage, and supported revocation all ship in the free, open source Kingfisher. There is no separate paid or enterprise tier.

A few examples:

…

See usage for the full command reference and integrations for platform-specific examples, including GitLab, Azure DevOps, Gitea, Slack, and Jira.

See Kingfisher in action with basic scan and validation examples, the end-to-end defender workflow, platform-specific scan examples, blast-radius examples, direct revocation, and CI and pre-commit deployment.

Map the Blast Radius. Revoke the Credential.

For supported credentials, --blast-radius goes beyond a live/inactive verdict. It maps the effective identity, permissions, reachable roles or service accounts, and affected resource scopes. This includes advanced AWS role-assumption, GCP service-account impersonation analysis, and exact read methods accepted by a bounded Google API-key probe allowlist.

The HTML viewer turns that evidence into an interactive access map for rapid investigation and prioritization:

Kingfisher also provides explicit, defender-led revocation for supported credentials. Revocation is opt-in and is exposed only where Kingfisher has a bounded provider workflow; responders should always confirm the target and operational impact before containment.

Performance, Accuracy, and Extensible Rules

• Performance: multithreaded, Hyperscan‑powered scanning built for huge codebases
• Extensible rules: Betterleaks is the main catalog, with selected Veles detectors filling gaps; custom Betterleaks TOML and Kingfisher 1.x YAML rules are supported (built-in rules, docs/RULES.md)
• Validation and defender-led revocation: validate discovered credentials live, then revoke supported credentials from the CLI. For supported provider flows, responders can contain a leaked token even when its owner is unknown or has left the company (docs/USAGE.md, docs/REVOCATION_PROVIDERS.md)
• Blast-radius mapping included by default: use --blast-radius (alias --access-map) to map supported credentials to their effective identities, permissions, reachable roles/service accounts, and impacted resource scopes. All 43 providers—including advanced AWS role-assumption and GCP service-account impersonation analysis—are included in the Apache-2.0 release (blast-radius docs)
• Broad provider coverage: detect and validate credentials across cloud, AI, developer tooling, databases, SaaS, messaging, identity, and cryptographic systems through the Betterleaks- and Veles-based candidate catalog
• Compressed Files: Supports extracting and scanning compressed files for secrets, including tar.gz/bz2/xz, ZIP-family containers (zip, jar, docx, xlsx, pptx, odt, epub, hwpx, and more), asar, HWP (Hancom OLE2/CFBF binary with DEFLATE/zlib stream decoding), and EGG (ALZip; raw-byte scanning)
• SQLite Database Scanning: Automatically extracts and scans SQLite database contents for secrets stored in table rows
• Python Bytecode (.pyc) Scanning: Extracts and scans string constants from compiled Python (.pyc, .pyo) files
• Baseline management: generate and track baselines to suppress known secrets (docs/BASELINE.md)
• Checksum-aware custom detection: Kingfisher 1.x custom rules can verify token checksums offline before validation (checksum intelligence)
• Report Viewer (local + hosted): Visualize and triage Kingfisher, SARIF, Gitleaks, and TruffleHog output locally with kingfisher view ./report.json or online with the hosted viewer. Multiple files, directories, and imported third-party reports are merged and deduplicated. See docs/USAGE.md.
• Audit reporting: Generate compliance-oriented HTML reports with scan metadata and validation ordering
• Library crates: Embed Kingfisher's scanning engine in your own Rust applications (docs/LIBRARY.md)

Basic Usage Demo

kingfisher scan /path/to/scan --view-report

NOTE: Replay has been slowed down for demo

Getting Started

Quick Start

Install with your preferred package manager:

# Homebrew (macOS/Linux)
brew install kingfisher

# PyPI wrapper
uv tool install kingfisher-bin

Then scan a repository, including its Git history:

kingfisher scan /path/to/repository

Open the results in the bundled local viewer:

kingfisher scan /path/to/repository --view-report

Scan files and Git history

See documentation for full detailed examples.

…

Save and combine reports

# Save a JSON report and open it later
kingfisher scan /path/to/repository --format json --output findings.json
kingfisher view findings.json

# Export SARIF for code-scanning integrations
kingfisher scan /path/to/repository --format sarif --output findings.sarif

# Generate a standalone HTML audit report
kingfisher scan /path/to/repository --format html --output audit.html

# Import and combine Kingfisher, Gitleaks, and TruffleHog reports
kingfisher view findings.json gitleaks.json trufflehog.jsonl

# Load every supported report in a directory
kingfisher view ./reports/

Scan source-hosting organizations

Set the relevant authentication variables from the integration guide, then choose a target:

# GitHub organization
kingfisher scan github --organization my-org

# GitLab group, including nested subgroups
kingfisher scan gitlab --group my-group --include-subgroups

# Azure Repos organization
kingfisher scan azure --azure-organization my-org

# Bitbucket workspace
kingfisher scan bitbucket --workspace my-team

# Gitea organization
kingfisher scan gitea --organization my-org

# Hugging Face organization
kingfisher scan huggingface --huggingface-organization my-org

# Preview the GitHub repository scope without scanning
kingfisher scan github --organization my-org --list-only

Scan S3 and GCS buckets

Scan a whole bucket, or use --prefix to limit scanning to objects whose names start with the given prefix. Use a bucket name without s3:// or gs://; omit --prefix to scan the whole bucket.

# AWS S3: whole bucket
kingfisher scan s3 my-bucket

# AWS S3: only objects under backups/production/, using a named AWS profile
kingfisher scan s3 my-bucket --prefix backups/production/ --profile security

# Google Cloud Storage: whole bucket
kingfisher scan gcs my-bucket

# Google Cloud Storage: only objects under exports/daily/
kingfisher scan gcs my-bucket --prefix exports/daily/

Authenticate to S3 with KF_AWS_KEY / KF_AWS_SECRET or --profile; GCS uses Application Default Credentials, or an explicit --service-account /path/to/key.json. See the S3 and GCS guides for authentication and public-bucket examples.

Scan containers or run Kingfisher in Docker

# Scan a registry image
kingfisher scan docker ghcr.io/owasp/wrongsecrets/wrongsecrets-master:latest-master

# Scan an image exported with docker save
kingfisher scan docker --archive image.tar

# Run Kingfisher against the current directory without installing it
docker run --rm -v "$PWD":/src ghcr.io/mongodb/kingfisher:latest scan /src

# Run in Docker and serve the report viewer to the host
docker run --rm -v "$PWD":/src -p 127.0.0.1:7890:7890 \
  ghcr.io/mongodb/kingfisher:latest scan /src \
  --view-report --view-report-address 0.0.0.0

For the Docker viewer, open localhost:7890 in your browser.

Scan issues, documents, and messages

These commands use the platform credentials described in the integration guide.

# Jira: sea