Download Kingfisher
Kingfisher scans stored code and historical commits for exposed credentials. It then checks those credentials against live services to confirm they are active. After validation, it identifies which resources and permissions the credential can reach. Supported secrets can be revoked from the command line. This workflow reduces manual triage and accelerates response to leaked secrets.
Kingfisher covers multiple sources, including Git history, cloud storage buckets, and collaboration platforms. Detection rules come from the Betterleaks catalog and selected Veles detectors. Custom rules in the original YAML format still work. The engine uses Vectorscan for fast pattern matching and includes safeguards against internal network probing through SSRF checks on validators.
The tool maintains a compatibility layer for older rule names and provides repository-aware baselines for suppressing known findings. Alerting supports webhook filters and dry-run previews. Teams can run Kingfisher in CI pipelines or as a standalone scanner. The program is written in Rust and focuses on performance, validation accuracy, and operational safety for credential revocation workflows.