Kingfisher vs Vooda AI

Kingfisher is a free tool for scanning for leaked secrets, checking whether credentials are live, mapping their blast radius, and supporting revocation for some credentials. It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms. Documented integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. The project describes a multithreaded Vectorscan engine and supports Betterleaks TOML and Kingfisher YAML rules. Reports can be human-readable or exported as TOON, JSON, JSONL, SARIF, BSON, or HTML. A local viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports. Revocation is opt-in and depends on a supported provider workflow. Live validation and blast-radius mapping make provider API requests, which should only be used when authorized. Kingfisher runs on Linux, macOS, and Windows, and supports self-hosted use.

Vooda AI is a secrets-detection platform that searches a technology stack for exposed credentials, API keys, and sensitive data. It checks whether credentials are still live and identifies resources they can access. Its detection combines 942 provider-specific rules with entropy analysis, base64 decoding, structured-file parsing, configuration checks, and custom detectors. Vooda scans full Git history and more than 23 non-code sources, including collaboration tools, cloud storage, containers, Postman, and CI/CD logs. It verifies credentials against more than 250 provider APIs; AI confidence scores, team decisions, and false-positive suppression help triage findings. Vooda Radar maps access to repositories, buckets, databases, and IAM policies and assigns an impact score from 0 to 100. Remediation includes provider-specific rotation playbooks and pre-filled pull requests. CI/CD options include GitHub and GitLab templates, container images, pre-commit scanning, and gating. Vooda supports cloud and self-hosted deployment, including air-gapped use with a local AI model and outbound verification disabled. The self-hosted plan is free.