Arnica Secrets Security vs Kingfisher

Arnica Secrets Security detects and validates hardcoded secrets in code repositories. For newly pushed validated secrets, it can automatically rewrite commits and remove secrets from Git history. Severity considers validation context, including whether credentials belong to a highly privileged or development account. Codebases are scanned daily, with secrets revalidated on code changes and scheduled scans. Integrations include GitHub, GitLab, Azure DevOps, and Bitbucket; alerts can go to Slack or Microsoft Teams, while tickets can be created through Jira or Azure DevOps Boards. Teams can configure regex-based detectors, ignored paths, and policies for scanning and resolution. Arnica says it does not persist source-code snippets containing detected secrets and that customer data is encrypted at rest with tenant separation. Its cloud infrastructure is hosted on AWS, with TLS 1.2 or 1.3 in transit and AES 256 at rest. The Free plan's data ingestion runs every seven days; premium plans run in real time. Prices are per identity per year: Free is free, Business is $300 a year, and Enterprise is $600 a year. A 14-day trial is available.

Kingfisher is a free tool for scanning for leaked secrets, checking whether credentials are live, mapping their blast radius, and supporting revocation for some credentials. It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms. Documented integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. The project describes a multithreaded Vectorscan engine and supports Betterleaks TOML and Kingfisher YAML rules. Reports can be human-readable or exported as TOON, JSON, JSONL, SARIF, BSON, or HTML. A local viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports. Revocation is opt-in and depends on a supported provider workflow. Live validation and blast-radius mapping make provider API requests, which should only be used when authorized. Kingfisher runs on Linux, macOS, and Windows, and supports self-hosted use.