A high-performance open-source secret scanner with live validation, blast radius mapping, and 700+ detection rules for code, Git, CI, cloud, and SaaS platforms.
Kingfisher is an open-source secret scanner that detects leaked API keys, tokens, and credentials in source code, Git history, cloud storage, and SaaS platforms. It solves the problem of credential exposure by combining high-performance pattern matching with live validation against provider APIs to confirm active secrets and assess their potential impact.
Security engineers (both offensive and defensive), DevOps teams, and developers who need to proactively find and remediate exposed credentials in their codebases, CI/CD pipelines, and integrated platforms.
Developers choose Kingfisher for its unique combination of speed, accuracy, and actionable intelligence—it not only finds secrets but validates them live, maps their blast radius, and allows direct revocation, reducing false positives and providing context for rapid triage.
Detect leaked secrets + live validation. Map blast radius across your stack. Revoke fast. 950+ rules.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Verifies discovered credentials against provider APIs to confirm active secrets, drastically reducing false positives as highlighted in the feature list.
Maps exposed credentials to cloud identities and resources across 39 providers with --access-map, providing actionable context for risk assessment.
Uses Intel's Hyperscan and multithreading for fast scans on large codebases, with benchmark results showing superior speed in COMPARISON.md.
Scans multiple platforms including GitHub, GitLab, AWS S3, Jira, and Slack directly, with detailed integration guides in INTEGRATIONS.md.
Requires setting up API tokens for each platform via environment variables, which can be complex and error-prone for teams with many integrations.
Revocation is only supported for a subset of providers like GitHub and AWS, as admitted in the REVOCATION_PROVIDERS.md document, leaving gaps for other services.
Lacks a graphical interface, making it less accessible for non-technical users or for continuous monitoring without additional dashboard tooling.