{ "run_id": "mongodb--kingfisher-claude-haiku-5-5-1793159140108341706", "checker": { "claims": [ { "claim": "Scanning a directory with --format json reports the leaked GitHub token and exits 200 when findings are present", "command": "kingfisher scan --git-history none --no-validate --format json", "evidence": "\u2026github-pat\",\"id\":\"betterleaks.github-pat\",\"description\":\"Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.\"},\"finding\":{\"snippet\":\"\",\"fingerprint\":\"4055663260747634681\",\"confidence\":\"high\",\"entropy\":\"5.22\",\"validation\":{\"outcome\":\"not_attempted\",\"status\":\"Not Attempted\",\"response\":\"\"},\"language\":\"Unknown\",\"line\":1,\"column_start\":15,\"column_end\":54,\"path\":\"\",\"validate_command\":\"kingfisher validate --rule 'betterleaks.github-pat' '", "expected": "JSON output containing the github-pat finding, exit code 200", "input": " containing a synthetic GitHub PAT", "kind": "claim", "outcome": "Real input produced the expected result: github-pat", "returncode": 200, "source": "kingfisher scan /path/to/repository --format json", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "The --output option writes the JSON report to a file", "command": "kingfisher scan --git-history none --no-validate --format json --output ", "evidence": "\u2026github-pat\",\"id\":\"betterleaks.github-pat\",\"description\":\"Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.\"},\"finding\":{\"snippet\":\"\",\"fingerprint\":\"4055663260747634681\",\"confidence\":\"high\",\"entropy\":\"5.22\",\"validation\":{\"outcome\":\"not_attempted\",\"status\":\"Not Attempted\",\"response\":\"\"},\"language\":\"Unknown\",\"line\":1,\"column_start\":15,\"column_end\":54,\"path\":\"\",\"validate_command\":\"kingfisher validate --rule 'betterleaks.github-pat' '", "expected": "findings.json file containing the github-pat finding", "input": " containing a synthetic GitHub PAT", "kind": "claim", "outcome": "Real input produced the expected result: github-pat", "returncode": 200, "source": "--output findings.json", "source_checked": true, "source_file": "README.md", "verdict": "yes" } ], "cycle_checks": [ { "claim": "Scheduled or looping main behavior", "command": "", "evidence": "Inspected README.md and docs/USAGE.md for cron, schedule, daemon, loop, --once, --now, --watch, --interval and webhook behavior. Kingfisher is a one-shot scan CLI (kingfisher scan exits after one run). The only webhook mention is docs/ALERTS.md chat/webhook alert destinations, which are external notifications and out of scope here.", "expected": "identify the product trigger", "input": "source inspection", "kind": "cycle", "outcome": "Inspected README.md and docs/USAGE.md for cron, schedule, daemon, loop, --once, --now, --watch, --interval and webhook behavior. Kingfisher is a one-shot scan CLI (kingfisher scan exits after one run). The only webhook mention is docs/ALERTS.md chat/webhook alert destinations, which are external notifications and out of scope here.", "source": "repository entry points", "verdict": "yes" } ], "details": { "argv": [ "kingfisher", "scan", "", "--git-history", "none", "--no-validate", "--format", "json", "--output", "" ], "expected_file": "", "file_checked": true, "file_excerpt": "\u2026github-pat\",\"id\":\"betterleaks.github-pat\",\"description\":\"Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.\"},\"finding\":{\"snippet\":\"\",\"fingerprint\":\"4055663260747634681\",\"confidence\":\"high\",\"entropy\":\"5.22\",\"validation\":{\"outcome\":\"not_attempted\",\"status\":\"Not Attempted\",\"response\":\"\"},\"language\":\"Unknown\",\"line\":1,\"column_start\":15,\"column_end\":54,\"path\":\"\",\"validate_command\":\"kingfisher validate --rule 'betterleaks.github-pat' ''\",\"blast_radius_command\":\"kingfisher blast-radius --rule 'betterleaks.github-pat' ''\"}}],\"audit\":{\"schema\":\"kingfisher.repository-audit.v1\",\"run_id\":\"d56677ea-aba4-4dde-b260-f47f7a3b593a\",\"started_at\":\"2026-10-28T03:55:03.755308972+00:00\",\"completed_at\":\"2026-10-28T03:55:03.808Z\",\"duration_seconds\":0.053119071,\"summary\":{\"discovered\":1,\"fetch_succeeded\":0,\"fetch_failed\":0,\"scan_succeeded\":1,\"scan_partial\":0,\"scan_failed\":0,\"pending\":0},\"repositories\":[{\"key\":\"local:\",\"repository\":\"\",\"source\":\"local\",\"discovered_at\":\"2026-10-28T03:55:03.762Z\",\"fetch\":{\"status\":\"not_applicable\"},\"scan\":{\"status\":\"completed\",\"started_at\":\"2026-10-28T03:55:03.762Z\",\"completed_at\":\"2026-10-28T03:55:03.808Z\",\"duration_seconds\":0.045856815},\"stats\":{\"findings\":2,\"blobs_scanned\":2,\"bytes_scanned\":153}}]},\"metadata\":{\"generated_at\":\"2026-10-28T03:55:03.809616503+00:00\",\"scan_timestamp\":\"2026-10-28T03:55:03.755308972+00:00\",\"target\":\"\",\"command_line_args\":[\"\",\"scan\",\"\",\"--git-history\",\"none\",\"--no-validate\",\"--format\",\"json\",\"--output\",\"\"],\"kingfisher_version\":\"2.15.0\",\"latest_version_available\":\"2.15.0\",\"update_check_status\":\"ok\",\"summary\":{\"findings\":1,\"active_findings\":0,\"inactive_findings\":0,\"locally_derived_findings\":0,\"invalid_material_findings\":0,\"unknown_validation_findings\":1,\"access_map_identities\":0,\"rules_applied\":488,\"confidence_level\":\"medium\",\"custom_rules_used\":false,\"successful_validations\":0,\"failed_validations\":0,\"skipped_validations\":0,\"blobs_scanned\":2,\"bytes_scanned\":153,\"scan_duration_seconds\":0.053337563}}}\n", "kind": "cli", "needs_browser": false, "needs_credentials": false, "returncode": 200, "scope": "product operation", "stderr": "Kingfisher 2.15.0 is up to date\n INFO kingfisher: Launching with 2 concurrent scan jobs. Use --jobs to override.\n INFO kingfisher::rule_loader: Loaded 488 rules\n INFO kingfisher::scanner::rule_loading: Using Vectorscan rule cache cache_dir=\n WARN kingfisher_rules::rules_database: Ignoring unsafe or unavailable rule cache directory cache_dir= err=cache directory route is writable by group or others", "stdout": "{\"findings\":1,\"successful_validations\":0,\"failed_validations\":0,\"skipped_validations\":0,\"rules_applied\":488,\"blobs_scanned\":2,\"bytes_scanned\":153,\"scan_duration\":0.054178047,\"scan_date\":\"2026-10-28T03:55:03.755308972+00:00\",\"kingfisher\":{\"version_used\":\"2.15.0\",\"latest_version\":\"2.15.0\",\"update_check_status\":\"ok\",\"update_check_message\":\"Kingfisher 2.15.0 is up to date\"},\"findings_by_rule\":[[\"Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.\",1]]}", "working": true }, "evidence_strength": "readme_checked", "example_checks": [ { "claim": "Generate a standalone HTML audit report", "command": "kingfisher scan --git-history none --no-validate --format html --output ", "deferred": false, "evidence": "window.history.state, \"\", url);\n }\n refresh();\n search?.focus();\n });\n refresh();\n });\n\n window.addEventListener(\"beforeprint\", () => {\n document.querySelectorAll(\"details.commands\").forEach((details) => {\n details.dataset.wasOpen = details.open ? \"true\" : \"false\";\n details.open = true;\n });\n });\n window.addEventListener(\"afterprint\", () => {\n document.querySelectorAll(\"details.commands\").forEach((details) => {\n details.open = details.dataset.wasOpen === \"true\";\n delete details.dataset.wasOpen;\n });\n });\n})();\n\n\n\n", "expected": "standalone HTML audit report with the Kingfisher Audit Report title, exit code 0", "input": " (clean directory, no findings)", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Save and combine reports (--format html --output audit.html)", "verdict": "yes" } ], "status": "PASS" }, "diagnosis": null }