kingfisher
A high-performance open-source secret scanner with live validation, blast radius mapping, and 700+ detection rules for code, Git, CI, cloud, and SaaS platforms.
What is kingfisher?
Kingfisher is an open-source secret scanner that detects leaked API keys, tokens, and credentials in source code, Git history, cloud storage, and SaaS platforms. It solves the problem of credential exposure by combining high-performance pattern matching with live validation against provider APIs to confirm active secrets and assess their potential impact.
Security engineers (both offensive and defensive), DevOps teams, and developers who need to proactively find and remediate exposed credentials in their codebases, CI/CD pipelines, and integrated platforms.
Developers choose Kingfisher for its unique combination of speed, accuracy, and actionable intelligence—it not only finds secrets but validates them live, maps their blast radius, and allows direct revocation, reducing false positives and providing context for rapid triage.
Overview
Detect leaked secrets + live validation. Map blast radius across your stack. Revoke fast. 1,000+ rules.
Use Cases
Best For
- Scanning large code repositories for leaked API keys and tokens
- Validating discovered credentials against provider APIs to confirm active secrets
- Mapping the blast radius of exposed cloud credentials to understand access risks
- Integrating secret detection into CI/CD pipelines and pre-commit hooks
- Auditing SaaS platforms like Jira, Confluence, and Slack for credential leaks
- Revoking compromised secrets directly from the command line
Not Ideal For
- Environments with strict network isolation where live API validation is impossible
- Teams requiring a graphical user interface for real-time monitoring and dashboarding
- Projects needing only basic pattern matching without validation, where simpler tools like GitLeaks suffice
- Organizations using unsupported SaaS platforms not covered in the 39-provider access map
Pros & Cons
Pros
Verifies discovered credentials against provider APIs to confirm active secrets, drastically reducing false positives as highlighted in the feature list.
Maps exposed credentials to cloud identities and resources across 39 providers with --access-map, providing actionable context for risk assessment.
Uses Intel's Hyperscan and multithreading for fast scans on large codebases, with benchmark results showing superior speed in COMPARISON.md.
Scans multiple platforms including GitHub, GitLab, AWS S3, Jira, and Slack directly, with detailed integration guides in INTEGRATIONS.md.
Cons
Requires setting up API tokens for each platform via environment variables, which can be complex and error-prone for teams with many integrations.
Revocation is only supported for a subset of providers like GitHub and AWS, as admitted in the REVOCATION_PROVIDERS.md document, leaving gaps for other services.
Lacks a graphical interface, making it less accessible for non-technical users or for continuous monitoring without additional dashboard tooling.
Frequently Asked Questions
Related Projects
rustscan🤖 The Modern Port Scanner 🤖
feroxbusterA fast, simple, recursive content discovery tool written in Rust.
rayhunterRust tool to detect cell site simulators on an orbic mobile hotspot
rustnetPer-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.