Security and privacy · Edition No. 16 · 10 Sep 2026

mongodb/kingfisher

Finds keys left in your code, then checks with the provider which of them still work.

← Security and privacyRead the whole edition →
04

mongodb/kingfisher

💎 hidden gem

1.2k stars · Apache-2.0 — the LICENSE file was opened directly on 2026-09-10 and is the standard Apache License 2.0 with no added commercial restriction and no SSPL clause · v2.2.0 (09 Sep, therefore 9 September 2026 — a past bare date), read from /releases/latest

Finds keys left in your code, then checks with the provider which of them still work.

Repo detailsthe review · specs · pros & cons · install

What it is

Kingfisher is a command-line secret scanner written in Rust. It carries 485 detection rules, and 246 of them can validate a match by calling the provider.What it is good for. Anyone who has been the only person touching a codebase for a long time, which is exactly the situation where nobody has ever checked. The output is what makes it useful. A plain scanner produces a worry; this produces a to-do list in priority order. It also maps what a live key can reach, using read-only calls, so you can see how bad a particular leak actually is. It runs on one folder, or on a whole GitHub organisation. There is a good use for your own boxes: run it once over the Grasppy repository and once over the ScalpingMate one, before anything else on this list.

Stars1.2k
LicenceApache-2.0 — the LICENSE file was opened directly on 2026-09-10 and is the standard Apache License 2.0 with no added commercial restriction and no SSPL clause
Latestv2.2.0 (09 Sep, therefore 9 September 2026 — a past bare date), read from /releases/latest
Good
  • Nothing to keep alive. It is one binary, you run it, it finishes and exits. No database, no server, no port.
  • The licence is the plain Apache 2.0, not MongoDB's usual SSPL. Commercial use is allowed with no added conditions.
  • It knows about staged files, so it can run as a check before every commit and stop a key ever reaching the history.
Watch for
  • Checking whether a key is live means sending that key to the provider. On your own code that is reasonable. On somebody else's it may not be. Use --no-validate if you are unsure.
  • No memory or processor minimum is published. On a small VPS, scan the repository rather than the whole disk.
  • A clean result is not a promise. It finds the shapes it has rules for, and a home-made token format may not match any of them.
Install
docker run --rm -v "$PWD":/src ghcr.io/mongodb/kingfisher:latest scan /src

Get the next edition in your inbox

A dozen repositories, opened and checked. The licence read, the last release dated, and the ones that did not make it named with the reason. It is the half most lists leave out.

No tracking pixels. One click to leave. The archive stays free either way.

We use your address to send the edition and nothing else. Confirm by email, leave in one click. How we handle it.