detect-secrets vs Kingfisher

detect-secrets is a free, open-source Python module for finding secrets in codebases and helping stop new secrets from entering Git changes. It runs on Linux, macOS, and Windows, with self-hosted use documented through pip or Homebrew. Heuristic regular expressions inspect changes for newly committed secrets, alongside entropy and keyword detection. The scan command creates or updates a baseline of potential findings; hook flags new secrets; and audit lets analysts review, label, report, or compare baseline entries. Users can configure it as a pre-commit hook with the pre-commit framework. Built-in plugins and filters can be adjusted, and custom detector plugins and filters can be developed. Exclusions, matching-line or file exclusions, secret-value exclusions, and inline allowlist comments help handle false positives. The package can also be imported into Python scripts to scan files and serialize findings. Word-list filtering and gibberish detection require optional packages, and gibberish detection is disabled by default. The project uses Apache-2.0 licensing.

Kingfisher is a free tool for scanning for leaked secrets, checking whether credentials are live, mapping their blast radius, and supporting revocation for some credentials. It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms. Documented integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. The project describes a multithreaded Vectorscan engine and supports Betterleaks TOML and Kingfisher YAML rules. Reports can be human-readable or exported as TOON, JSON, JSONL, SARIF, BSON, or HTML. A local viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports. Revocation is opt-in and depends on a supported provider workflow. Live validation and blast-radius mapping make provider API requests, which should only be used when authorized. Kingfisher runs on Linux, macOS, and Windows, and supports self-hosted use.