Kingfisher vs scan4secrets
Kingfisher
github.comscan4secrets
scan4secrets.m14r41.inSide by side
| Figure | Kingfisher | scan4secrets |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Secrets Scanning Software | 7.8 (#12) | 7.3 (#19) |
| License | The repository states that Kingfisher is licensed under Apache License 2.0. | The project is MIT licensed. |
| Purpose | Kingfisher scans for leaked secrets, checks which credentials are live, maps their blast radius, and supports revocation for supported credentials. | The tool scans source trees, running web apps, and CI logs for leaked credentials, code vulnerabilities, and misconfigurations. |
| Reports | It supports human-readable output and TOON, JSON, JSONL, SARIF, BSON, and HTML report formats. | Output formats include SARIF, JSON, JSONL, CSV, HTML, Excel, and PDF. |
Plans
In their own words
Kingfisher
Kingfisher is a free tool for scanning for leaked secrets, checking whether credentials are live, mapping their blast radius, and supporting revocation for some credentials. It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms. Documented integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. The project describes a multithreaded Vectorscan engine and supports Betterleaks TOML and Kingfisher YAML rules. Reports can be human-readable or exported as TOON, JSON, JSONL, SARIF, BSON, or HTML. A local viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports. Revocation is opt-in and depends on a supported provider workflow. Live validation and blast-radius mapping make provider API requests, which should only be used when authorized. Kingfisher runs on Linux, macOS, and Windows, and supports self-hosted use.
scan4secrets
scan4secrets has no write-up on Specifiction yet; its figures are above.