Kingfisher review
A broad, free scanner for exposed credentials across code, cloud, containers, and developer platforms.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Kingfisher is an Apache-2.0 open-source secret scanner from MongoDB for developers, security engineers, and incident responders. It scans source code, Git history, local files, archives, cloud storage, container images, and supported developer platforms for exposed credentials. Windows, macOS, and Linux are supported, with local and hosted browser report viewers for filtering, deduplication, and export. Its scope suits teams that want one scanning tool across repositories, developer workflows, cloud storage, and incident response.
Breadth is the main differentiator. Kingfisher supports GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, Jira, Confluence, Slack, Microsoft Teams, Postman, AWS S3, Google Cloud Storage, and Docker. It combines Betterleaks- and Veles-based detection rules with credential validation, identity and permission mapping, reachable-resource analysis, and blast-radius views. Security teams can also use provider-specific revocation workflows, while custom TOML, YAML, and YML rules extend detection for internal credential formats.
The published model is free and open source, with no separate paid or enterprise tier. Teams can run scans locally, in CI, against branch diffs or pull requests, and through Git pre-commit hooks that block commits containing new secrets. That makes Kingfisher a strong fit for organizations comfortable operating command-line and CI workflows, especially when broad coverage matters more than a tiered SaaS experience. Teams seeking a paid enterprise tier or revocation coverage beyond supported providers should consider a different product.
Kingfisher pros and cons
- Where it wins
- Scans code, history, files, archives, cloud storage, and containers
- Validates credentials and maps permissions, resources, and blast radius
- Supports CI, pull requests, pre-commit hooks, and custom rules
- Where it doesn't
- Revocation workflows apply only to supported credential providers
- Command-line workflows may require security and developer expertise
- No separate paid or enterprise tier for centralized commercial support
Kingfisher fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update