Kingfisher vs Secretlint

Kingfisher is a free tool for scanning for leaked secrets, checking whether credentials are live, mapping their blast radius, and supporting revocation for some credentials. It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms. Documented integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. The project describes a multithreaded Vectorscan engine and supports Betterleaks TOML and Kingfisher YAML rules. Reports can be human-readable or exported as TOON, JSON, JSONL, SARIF, BSON, or HTML. A local viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports. Revocation is opt-in and depends on a supported provider workflow. Live validation and blast-radius mapping make provider API requests, which should only be used when authorized. Kingfisher runs on Linux, macOS, and Windows, and supports self-hosted use.

Secretlint is a free, MIT-licensed, open-source linting tool for finding credentials in projects and helping prevent commits that contain them. Its command-line interface scans files, glob patterns, or standard input. Detection rules are separate modules, and custom rules can be distributed as npm packages. Secret values are masked in lint error messages by default, reducing exposure in terminal output and logs. Secretlint supports Git workflows, including pre-commit integrations with Husky and lint-staged, pre-commit, and Git hooks. Documentation covers GitHub Actions checks and pull-request annotations through the GitHub formatter. Listed integrations also include Mega-Linter, SARIF formatting, a browser extension, and a macOS clipboard app. The WebExtension works with Chrome and Firefox DevTools to help notice credentials in requests and responses. Installation options include Node.js, Docker, or a single executable without Node.js; the Node.js route requires version 22 or later. It detects secrets but does not automatically fix them.