Detect and Validate Secrets Anywhere. Map Access. Revoke Fast.

Find leaked secrets. Validate what’s live. Map the blast radius. Revoke fast.

Kingfisher is a fast, free, open-source secret scanner and credential response tool built in Rust. It detects leaked secrets with hundreds of built-in rules, validates which credentials are active, maps access for supported credential types, and revokes supported secrets—all in one Apache-2.0-licensed release:

Detect → Validate → Map → Triage → Revoke

• scan source code, Git history, cloud storage, container images, archives, and developer platforms
• validate which credentials are active
• map a leaked secret's identity, permissions, and reachable resources
• triage findings in a browser, or output as SARIF, JSON, TOON
• revoke supported secrets

Defender workflow: Follow the end-to-end defender workflow for secret detection, validation, notifications, blast-radius mapping, and revocation.

Embed Kingfisher in Rust or Python

Add Kingfisher's fast secret scanning, live credential validation, and revocation to your own applications through a Python module or native Rust library. Everything runs in-process, with no CLI subprocess required.

• Python: Install uv add kingfisher-secret-scanner and import kingfisher_sdk. See the Python SDK guide and runnable examples for scanning, validation, rule inspection, and explicit revocation.
• Rust: Use kingfisher-scanner. See the library guide and runnable examples for scanning and validation, plus revocation via kingfisher-scanner.

Scan Targets

Kingfisher handles local files and directories, Git repositories and history, compressed and office-document archives, SQLite databases, Python bytecode, Docker images, source-hosting organizations, cloud object storage, collaboration tools, and API-development platforms.

For target-specific commands, authentication, scope, and pagination behavior, use the platform integration guide.

Discover, validate, and revoke — open source options

All four tools detect secrets. Kingfisher and Betterleaks 2.0 RC5 also include credential revocation for supported providers.

Built-in capability	Kingfisher	Betterleaks 2.0 RC5	TruffleHog OSS	Gitleaks
(Find) Secret discovery	✅	✅	✅	✅
(Validate) Live credential verification	✅	✅	✅	❌
(Revoke) Credential revocation	✅	✅	❌	❌
License	Apache-2.0	MIT	AGPL-3.0	MIT

✅ Built in · ❌ Not supported as a built-in capability.

Built for Speed and Accuracy

Kingfisher's multithreaded Vectorscan engine recorded the lowest runtime on every repository in the published benchmark suite, from small projects through the Linux kernel and GitLab monorepo. Lower runtimes are better.