Detect and Validate Secrets Anywhere. Map Access. Revoke Fast.

Find leaked secrets. Validate what’s live. Map the blast radius. Revoke fast.

Kingfisher is a blazingly fast, completely free and open source secret scanner built in Rust. It detects leaked secrets across your entire stack with hundreds of built-in rules, validates which credentials are actually live, maps the blast radius of every leak, and revokes exposed secrets in minutes - the full defender workflow in one Apache-2.0-licensed release:

Detect → Validate → Map → Triage → Revoke

• scan source code, Git history, cloud storage, container images, archives, and developer platforms
• validate which credentials are active
• map a leaked secrete's identity, permissions, and reachable resources
• triage findings in a browser, or output as SARIF, JSON, TOON
• revoke supported secrets

Defender workflow: Follow the end-to-end defender workflow for secret detection, validation, notifications, blast-radius mapping, and revocation.

Optionally Embed Kingfisher as a Rust library or Python module

Add Kingfisher's fast secret scanning, live credential validation, and revocation to your own applications through a Python module or native Rust library. Everything runs in-process, with no CLI subprocess required.

• Python: Install uv add kingfisher-secret-scanner and import kingfisher_sdk. See the Python SDK guide and runnable examples for scanning, validation, rule inspection, and explicit revocation.
• Rust: Use kingfisher-scanner. See the library guide and runnable examples for scanning and validation, plus revocation via kingfisher-scanner.

Scan Targets

Kingfisher handles local files and directories, Git repositories and history, compressed and office-document archives, SQLite databases, Python bytecode, Docker images, source-hosting organizations, cloud object storage, collaboration tools, and API-development platforms.

For target-specific commands, authentication, scope, and pagination behavior, use the platform integration guide.

Discover, validate, and revoke — open source options

Of the popular secret scanning tools compared below, only Kingfisher and Betterleaks 2.0 offer built-in credential revocation. All open source, with no paid edition required.

Built-in capability	Kingfisher	Betterleaks 2.0	TruffleHog OSS	Gitleaks
(Find) Secret discovery	✅	✅	✅	✅
(Validate) Live credential verification	✅	✅	✅	❌
(Map) Identity and permission analysis	✅	✅	✅	❌
(Revoke) Credential revocation	✅	✅	❌	❌
License	Apache-2.0	MIT	AGPL-3.0	MIT

✅ Supported · ❌ Not Supported

Built for Speed and Accuracy

Kingfisher's multithreaded Vectorscan engine recorded the lowest runtime on every repository in the published benchmark suite, from small projects through the Linux kernel and GitLab monorepo. Lower runtimes are better.