kingfisher

This is also a good reminder to scan CI logs, not just source code. Shameless plug: I work on Kingfisher, an Apache 2.0 OSS secret scanner and validator written in Rust, that can also map blast radius and revoke many creds: <https://github.com/mongodb/kingfisher> It can scan repos, history, and artifacts and validate many findings against provider APIs, as well as revoke many exposed tokens directly from the CLI. Also generates a blast-radius/access-map view so you can see what a leaked credential could reach. Install: brew install kingfisher # or uv tool install kingfisher-bin Scan a local path: kingfisher scan /path/to/scan --access-map --view-report Or scan a GitHub/GitLab repo directly: kingfisher scan https://github.com/path/to/repo.git --access-map --view-report

There's also https://github.com/mongodb/kingfisher

As Radicle is written in Rust, I was hoping for a way to use Kingfisher as a library, but did not find one. So I filed https://github.com/mongodb/kingfisher/issues/189 Of course, it'd always be possible to invoke some binary. But I am still curious about a library.

There's https://github.com/gitleaks/gitleaks and https://github.com/mongodb/kingfisher

I built Kingfisher, an extremely fast Apache 2.0 OSS secret scanner (Rust) that goes beyond simply finding secrets. - Live validation: checks whether a candidate secret actually works, so you can ignore dead strings. - "What can this key do?" / Access Mapping (optional): authenticates and enumerates the credential’s effective access (AWS, GCP, Azure, GitHub, GitLab). - Local triage UI: opens a local-only report so you can review findings + blast radius without sending code anywhere. Try it out: brew install kingfisher # kingfisher scan /path/to/code --view-report # kingfisher scan --git-url https://github.com/org/repo.git --view-report # kingfisher scan . --access-map --view-report I'd love feedback on: - false positives/negatives on your repos - which access-map / blast radius target you want next - what the UI should sur

I'm curious how Kingfisher would do against the proprietary dataset: https://github.com/mongodb/kingfisher Any chance you could try and share results? Full disclosure, I built Kingfisher

Loved this “lead bullets” framing, especially the parts on taint checking, scanners, and pre-processing/sampling logs. One practical add-on to the "Sensitive data scanners" section is verification: can you tell which candidates are actually live creds? We’ve been working on an open source tool, Kingfisher, that pairs fast detection (Hyperscan + Tree-Sitter) with live validation for a bunch of providers (cloud + common SaaS) so you can down-rank false positives and focus on the secrets that really matter. It plugs in at the chokepoints this post suggests: CI, repo/org sweeps, and sampled log archives (stdin/S3) after a Vector/rsyslog hop. Examples: kingfisher scan /path/to/app.log --only-valid kingfisher scan --s3-bucket my-logs --s3-prefix prod/2025/09/ Baselines help keep noise down over time. Repo: https://github.com/mongodb/kingfi