Skip to content

Back to the catalog

Kingfisher (MongoDB)
mongodb.comarticle

Kingfisher (MongoDB)

MongoDB's official announcement of Kingfisher, an open-source secret scanner written in Rust that detects hard-coded credentials, API keys, and other secrets across Git repos, commit history, and file systems. Unlike traditional scanners, it actively validates detected secrets by testing them against live cloud/API endpoints to filter out dead credentials, runs entirely on-premises, and is forked/extended from the Nosey Parker project with Tree-sitter-based parsing and 700+ detection rules. MongoDB benchmarks it against TruffleHog and GitLeaks for runtime performance and uses it internally for pre-commit hooks, CI/CD scanning, and historical repo audits.

TL;DR MongoDB open-sources Kingfisher, a Rust-based secret scanner that validates detected credentials in real time to cut false positives, benchmarked against TruffleHog and GitLeaks.
Open original ↗

Technologies named here

Techniques named here

  • Real-time secret validation
  • Historical code analysis
  • Credential-stuffing attacks

Related in DevSecOps