Skip to content

Project Background

Production Use and Integrations

Kingfisher is used in production security workflows and integrated into other open source tools. These public references are not an exhaustive list:

  • MongoDB uses Kingfisher in internal security workflows including pre-commit scanning, CI/CD integration, historical code analysis, and cloud and database validation.
  • Prowler uses Kingfisher as an offline secret-scanning engine with optional live validation.
  • MegaLinter distributes Kingfisher as the REPOSITORY_KINGFISHER linter in its standard and security flavors.

If your organization or project uses Kingfisher and would like to be included, open an issue or pull request.

Lineage and Evolution

Kingfisher began as an internal fork of Nosey Parker, which provided a high-performance foundation for secret detection.

It has since evolved across nearly every subsystem. Major areas of development include:

  • Live validation and provider-specific credential outcome handling.
  • Betterleaks- and Veles-derived detector coverage plus private Kingfisher YAML rules.
  • Blast-radius analysis, visual triage, and supported credential revocation.
  • Baseline management and stable finding fingerprints.
  • Parser-based context verification layered on SIMD-accelerated matching.
  • Remote targets spanning source hosts, cloud storage, containers, collaboration systems, and API development platforms.
  • Extraction from archives, office documents, SQLite databases, and Python bytecode.
  • Structured TOON, JSON, JSONL, SARIF, BSON, and HTML reporting.
  • Cross-platform builds for Linux, macOS, and Windows.

See Architecture for the current implementation and Changelog for release-by-release development.

Roadmap and Contributions

Ongoing work includes broader upstream detector coverage, more scan targets, and deeper safe response capabilities. File a feature request or read CONTRIBUTING.md to propose or implement an improvement.

Security vulnerabilities should be reported according to SECURITY.md. Kingfisher is licensed under the Apache License 2.0.