Gitleaks vs Kingfisher
Gitleaks
github.comKingfisher
github.comSide by side
| Figure | Gitleaks | Kingfisher |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Secrets Scanning Software | 7.8 (#11) | 7.8 (#12) |
| Installation | The project documents installation through Homebrew, Docker, Go, and prebuilt release binaries. | The project documents prebuilt releases, Homebrew, mise, Linux and macOS installers, a Windows installer, PyPI wheels, Docker, and source builds. |
| Integrations | The project documents use as a pre-commit hook and as a GitHub Action. | Documented platform integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. |
| License | The repository is distributed under the MIT License, which permits use, copying, modification, distribution, sublicensing, and sale subject to its terms. | The repository states that Kingfisher is licensed under Apache License 2.0. |
| Purpose | Gitleaks detects secrets such as passwords, API keys, and tokens in Git repositories, files, and stdin. | Kingfisher scans for leaked secrets, checks which credentials are live, maps their blast radius, and supports revocation for supported credentials. |
| Reports | Gitleaks can output reports in JSON, CSV, JUnit, SARIF, or template format. | It supports human-readable output and TOON, JSON, JSONL, SARIF, BSON, and HTML report formats. |
Plans
In their own words
Gitleaks
Gitleaks is free, MIT-licensed software that detects secrets such as passwords, API keys, and tokens in Git repositories, files, and standard input. It runs on Linux, macOS, Windows, and self-hosted systems. Scans can target repositories, directories, individual files, or streamed data. Custom rules can use Go regular expressions, entropy checks, path matching, keywords, and allowlists. A previous report can serve as a baseline so later scans show only new findings. Output is available in JSON, CSV, JUnit, SARIF, or template formats. The project documents pre-commit hook and GitHub Action use, plus CI/CD, pull-request, and supported VCS workflows for GitHub, GitLab, Azure DevOps, Gitea, and Bitbucket. Installation options include Homebrew, Docker, Go, and prebuilt release binaries. A redaction option masks secrets in logs and standard output, with a default redaction value of 100%. The project describes itself as feature complete, with future releases limited to security patches, and its security policy supports only the latest version.
Kingfisher
Kingfisher is a free tool for scanning for leaked secrets, checking whether credentials are live, mapping their blast radius, and supporting revocation for some credentials. It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms. Documented integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. The project describes a multithreaded Vectorscan engine and supports Betterleaks TOML and Kingfisher YAML rules. Reports can be human-readable or exported as TOON, JSON, JSONL, SARIF, BSON, or HTML. A local viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports. Revocation is opt-in and depends on a supported provider workflow. Live validation and blast-radius mapping make provider API requests, which should only be used when authorized. Kingfisher runs on Linux, macOS, and Windows, and supports self-hosted use.