1.2k stars · Apache-2.0 — the LICENSE file was opened directly on 2026-09-10 and is the standard Apache License 2.0 with no added commercial restriction and no SSPL clause · v2.2.0 (09 Sep, therefore 9 September 2026 — a past bare date), read from /releases/latest
Finds keys left in your code, then checks with the provider which of them still work.
▶Repo detailsthe review · specs · pros & cons · install
What it is
Kingfisher is a command-line secret scanner written in Rust. It carries 485 detection rules, and 246 of them can validate a match by calling the provider.What it is good for. Anyone who has been the only person touching a codebase for a long time, which is exactly the situation where nobody has ever checked. The output is what makes it useful. A plain scanner produces a worry; this produces a to-do list in priority order. It also maps what a live key can reach, using read-only calls, so you can see how bad a particular leak actually is. It runs on one folder, or on a whole GitHub organisation. There is a good use for your own boxes: run it once over the Grasppy repository and once over the ScalpingMate one, before anything else on this list.
- Nothing to keep alive. It is one binary, you run it, it finishes and exits. No database, no server, no port.
- The licence is the plain Apache 2.0, not MongoDB's usual SSPL. Commercial use is allowed with no added conditions.
- It knows about staged files, so it can run as a check before every commit and stop a key ever reaching the history.
- Checking whether a key is live means sending that key to the provider. On your own code that is reasonable. On somebody else's it may not be. Use
--no-validateif you are unsure. - No memory or processor minimum is published. On a small VPS, scan the repository rather than the whole disk.
- A clean result is not a promise. It finds the shapes it has rules for, and a home-made token format may not match any of them.
docker run --rm -v "$PWD":/src ghcr.io/mongodb/kingfisher:latest scan /src