Download Kingfisher
Kingfisher scans stored code and historical commits for exposed credentials. It then checks those credentials against live services to confirm they are active. After validation, it identifies which resources and permissions the credential can reach. Supported secrets can be revoked from the command line. This workflow reduces manual triage and accelerates response to leaked secrets.
Kingfisher covers multiple sources, including Git history, cloud storage buckets, and collaboration platforms. Detection rules come from the Betterleaks catalog and selected Veles detectors. Custom rules in the original YAML format still work. The engine uses Vectorscan for fast pattern matching and includes safeguards against internal network probing through SSRF checks on validators.
The tool maintains a compatibility layer for older rule names and provides repository-aware baselines for suppressing known findings. Alerting supports webhook filters and dry-run previews. Teams can run Kingfisher in CI pipelines or as a standalone scanner. The program is written in Rust and focuses on performance, validation accuracy, and operational safety for credential revocation workflows.
Use Cases for Kingfisher
| Detect credential candidates using Vectorscan engine | Avoid regex fallbacks for large generic patterns |
| Validate exposed credentials against live service providers | Feed confirmed results into blast-radius mapping |
| Map compromised secret reach across systems and roles | Prioritize remediation by actual exposure level |
| Revoke leaked tokens directly from command line | Shorten exposure window without switching consoles |
| Block SSRF targets during credential validation | Check every host including SRV-resolved seeds |
| Keep old rule selectors working via aliases | Show deprecation warning instead of scan failure |
| Suppress known findings with repository-aware baselines | Focus on newly introduced secrets across CI runs |
| Control alert delivery with finding filters | Preview webhook payloads before sending |
| Include rules for Qwen, Solana, and Starknet | Detect Databricks OAuth and Kubernetes tokens |
| Fetch Betterleaks catalog at build time | Keep custom YAML rule format supported |