mongodb/kingfisher

Review signals: 1 connection review, 3 download and execute, 167 hardcoded secret, 29 known vulnerability. 91 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 4 distinct locations. 21 attributed processes.

Source contains download and execute; review its purpose. 2 distinct locations. 3 findings.

Gitleaks found a possible hardcoded secret; value withheld. 47 distinct locations. 164 findings.

OSV reports a known vulnerability in this dependency version. 19 distinct locations. 29 findings.

88 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Only 200 of 364 findings are stored; the summary counts all of them.

Full safety evidence →

• Scanning a directory with --format json reports the leaked GitHub token and exits 200 when findings are present: Real input produced the expected result: github-pat

  Source: kingfisher scan /path/to/repository --format json

  Input: <guest-path> containing a synthetic GitHub PAT

  Expected: JSON output containing the github-pat finding, exit code 200

  Command: kingfisher scan <guest-path> --git-history none --no-validate --format json

  Observed: …github-pat","id":"betterleaks.github-pat","description":"Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure."},"finding":{"snippet":"<secret>","fingerprint":"4055663260747634681","confidence":"high","entropy":"5.22","validation":{"outcome":"not_attempted","status":"Not Attempted","response":""},"language":"Unknown","line":1,"column_start":15,"column_end":54,"path":"<guest-path>","validate_command":"kingfisher validate --rule 'betterleaks.github-pat' '<secret>

• The --output option writes the JSON report to a file: Real input produced the expected result: github-pat

  Source: --output findings.json

  Input: <guest-path> containing a synthetic GitHub PAT

  Expected: findings.json file containing the github-pat finding

  Command: kingfisher scan <guest-path> --git-history none --no-validate --format json --output <guest-path>

  Observed: …github-pat","id":"betterleaks.github-pat","description":"Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure."},"finding":{"snippet":"<secret>","fingerprint":"4055663260747634681","confidence":"high","entropy":"5.22","validation":{"outcome":"not_attempted","status":"Not Attempted","response":""},"language":"Unknown","line":1,"column_start":15,"column_end":54,"path":"<guest-path>","validate_command":"kingfisher validate --rule 'betterleaks.github-pat' '<secret>

Examples

• Generate a standalone HTML audit report: command completed successfully

  Source: README.md Save and combine reports (--format html --output audit.html)

  Input: <guest-path> (clean directory, no findings)

  Expected: standalone HTML audit report with the Kingfisher Audit Report title, exit code 0

  Command: kingfisher scan <guest-path> --git-history none --no-validate --format html --output <guest-path>

  Observed: window.history.state, "", url); } refresh(); search?.focus(); }); refresh(); }); window.addEventListener("beforeprint", () => { document.querySelectorAll("details.commands").forEach((details) => { details.dataset.wasOpen = details.open ? "true" : "false"; details.open = true; }); }); window.addEventListener("afterprint", () => { document.querySelectorAll("details.commands").forEach((details) => { details.open = details.dataset.wasOpen === "true"; delete details.dataset.wasOpen; }); }); })(); </script> </body> </html>

Local or hosted: both

Install Kingfisher from the README and run a local secret scan with JSON and file output (kingfisher scan ... --format json [--output file]), plus the README HTML audit report

cd <guest-path> && pwd && ls -la && id -u && python3 --version && (git -C . rev-parse HEAD 2>&1 | head -1) && echo "CDP=$CDP_URL" && wc -c README.md 2>/dev/null
cd <guest-path> && cat README.md | head -c 7900
cd <guest-path> && grep -n '^#' README.md | head -80 && grep -n -i 'curl\|cargo install\|brew\|pip install\|uv \|telemetry\|--version' README.md | head -40
cd <guest-path> && sed -n 316,362p README.md
cd <guest-path> && grep -n -i 'curl\|install.sh\|uv \|pip\|telemetry\|consent' docs/INSTALLATION.md | head -40; echo ---; which uv brew cargo pipx 2>&1; echo ---; grep -n 'requires-python' pyproject.toml pypi/*/pyproject.toml 2>/dev/null; ls pypi
cd /tmp && uv --version && uv tool install kingfisher-bin 2>&1 | tail -15; echo "rc=$?"; ls -la ~/.local/bin 2>/dev/null | head; which kingfisher
K=<guest-path>; $K --version; mkdir -p <guest-path> && printf 'aws_access_key_id = <secret>\naws_secret = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\n' > <guest-path> && cd <guest-path> && $K scan <guest-path> --git-history none --no-validate --format json 2><guest-path> | head -c 1500; echo; echo "rc=${PIPESTATUS[0]}"; head -c 600 <guest-path>
K=<guest-path>; printf 'github_token = <secret>\n' > <guest-path> && cd <guest-path> && $K scan <guest-path> --git-history none --no-validate --format json 2>/dev/null > <guest-path>; echo rc=$?; /usr/bin/python3 -I -c 'import json;d=json.load(open("<guest-path>"));print(len(d["findings"]));[print(f.get("rule",{}).get("name") if isinstance(f.get("rule"),dict) else f.get("rule_name"), f.get("finding",{}).get("path") if isinstance(f.get("finding"),dict) else "") for f in d["findings"]]' ; head -c 400 <guest-path>
cd <guest-path> && grep -rn -i 'exit code\|exit status\|returncode\|200' docs/USAGE.md docs/INSTALLATION.md README.md 2>/dev/null | head -20; echo ---; head -c 200 <guest-path> | od -c | head -3 >/dev/null; wc -l <guest-path>
cd <guest-path> && sed -n 392,416p README.md; echo ---; <guest-path> scan --help 2>/dev/null | grep -i -n 'output\|--format\|--git-history\|--no-validate' | head
export PATH=<guest-path>; mkdir -p <guest-path> && cd <guest-path> && kingfisher scan <guest-path> --git-history none --no-validate --format json --output <guest-path> 2>/dev/null; echo rc=$?; ls -la <guest-path>; python3 -I -c 'import json,sys
t=open("<guest-path>",encoding="utf-8").read()
print(len(t)); print("github-pat" in t); print(t[:120])'
cd <guest-path> && grep -n -i 'cron\|schedul\|daemon\|webhook\|--once\|--now\|watch mode\|--watch\|interval' README.md | head -20; echo ---; grep -rn -i '\-\-watch\|--interval\|--daemon\|--loop' docs/USAGE.md | head -5; <guest-path> scan --help | grep -i 'watch\|interval\|daemon\|loop\|cron' | head
export PATH=<guest-path>; cd <guest-path> && kingfisher scan <guest-path> --git-history none --no-validate --format html --output <guest-path> >/dev/null 2>&1; echo rc=$?; python3 -I -c 't=open("<guest-path>",encoding="utf-8").read(); print(len(t)); print("Kingfisher" in t, "github-pat" in t or "GitHub Personal Access Token" in t); import re; print(re.findall(r"<title>[^<]*</title>",t)[:1])'; cd <guest-path> && grep -n -c -- '--format html' README.md; grep -n -- '--output findings.json' README.md
cd <guest-path> && rm -f probe-findings.json example-audit.html && rmdir <guest-path> 2>/dev/null; mkdir -p <guest-path> <guest-path> <guest-path> && mkdir -p <guest-path> && ls -laR <guest-path> && ls -la <guest-path>
cat > <guest-path> <<'EOF'
{"kind":"cli","argv":["kingfisher","scan","<guest-path>","--git-history","none","--no-validate","--format","json","--output","<guest-path>"],"cwd":"<guest-path>","env":{"PATH":"<guest-path>"},"expected_returncode":200,"expected_file":"<guest-path>","expected_text":"github-pat"}
EOF
python3 -I -c 'import json;print(json.load(open("<guest-path>"))["argv"][0])'
cat > <guest-path> <<'EOF'
[{"kind":"claim","claim":"Scanning a directory with --format json reports the leaked GitHub token and exits 200 when findings are present","source":"kingfisher scan /path/to/repository --format json","input":"<guest-path> containing a synthetic GitHub PAT","expected":"JSON output containing the github-pat finding, exit code 200","probe_kind":"cli","argv":["kingfisher","scan","<guest-path>","--git-history","none","--no-validate","--format","json"],"expected_returncode":200,"expected_text":"github-pat","env":{"PATH":"<guest-path>"},"cwd":"<guest-path>"},
{"kind":"claim","claim":"The --output option writes the JSON report to a file","source":"--output findings.json","input":"<guest-path> containing a synthetic GitHub PAT","expected":"findings.json file containing the github-pat finding","probe_kind":"cli","argv":["kingfisher","scan","<guest-path>","--git-history","none","--no-validate","--format","json","--output","<guest-path>"],"expected_returncode":200,"expected_file":"<guest-path>","expected_text":"github-pat","env":{"PATH":"<guest-path>"},"cwd":"<guest-path>"}]
EOF
python3 -I -c 'import json;print(len(json.load(open("<guest-path>"))))'
cd <guest-path> && cat > examples.json <<'EOF'
[{"kind":"example","claim":"Generate a standalone HTML audit report","source":"README.md Save and combine reports (--format html --output audit.html)","input":"<guest-path> containing a synthetic GitHub PAT","expected":"standalone HTML audit report with the Kingfisher Audit Report title, exit code 200","argv":["kingfisher","scan","<guest-path>","--git-history","none","--no-validate","--format","html","--output","<guest-path>"],"cwd":"<guest-path>","env":{"PATH":"<guest-path>"},"expected_returncode":200,"expected_file":"<guest-path>","expected_text":"Kingfisher Audit Report"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README.md and docs/USAGE.md for cron, schedule, daemon, loop, --once, --now, --watch, --interval and webhook behavior. Kingfisher is a one-shot scan CLI (kingfisher scan exits after one run). The only webhook mention is docs/ALERTS.md chat/webhook alert destinations, which are external notifications and out of scope here.","checks":[]}
EOF
python3 -I -c 'import json;[json.load(open("<guest-path>"+f)) for f in ["examples.json","cycles.json"]];print("ok")'
ls -la <guest-path> /inputs/coldpass-preflight.py 2>&1 | head; cd /tmp && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 4000; echo "rc=${PIPESTATUS[0]}"
cd /tmp && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; wc -c <guest-path>; python3 -I -c 'import re
t=open("<guest-path>",encoding="utf-8",errors="replace").read()
print(t[:1500])
for m in re.finditer(r"\"(valid|verdict|error|reason|problem|outcome)\": ?\"[^\"]{0,300}", t):
    print(m.group(0)[:300])
' | head -80
mkdir -p <guest-path> && printf 'name = "sample"\nversion = "1.0"\n' > <guest-path> && cd <guest-path> && PATH=<guest-path> kingfisher scan <guest-path> --git-history none --no-validate --format html --output <guest-path> >/dev/null 2>&1; echo rc=$?; ls <guest-path>; rm -f <guest-path>
cat > <guest-path> <<'EOF'
[{"kind":"example","claim":"Generate a standalone HTML audit report","source":"README.md Save and combine reports (--format html --output audit.html)","input":"<guest-path> (clean directory, no findings)","expected":"standalone HTML audit report with the Kingfisher Audit Report title, exit code 0","argv":["kingfisher","scan","<guest-path>","--git-history","none","--no-validate","--format","html","--output","<guest-path>"],"cwd":"<guest-path>","env":{"PATH":"<guest-path>"},"expected_file":"<guest-path>","expected_text":"Kingfisher Audit Report"}]
EOF
cd /tmp && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; python3 -I -c 'import re
t=open("<guest-path>",encoding="utf-8",errors="replace").read()
print(t[:600])
print(re.findall(r"\"verdict\": ?\"[a-z]+\"", t))
print(re.findall(r"\"status\": ?\"[A-Z]+\"", t))'
cat > <guest-path> <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install Kingfisher from the README and run a local secret scan with JSON and file output (kingfisher scan ... --format json [--output file]), plus the README HTML audit report","operation_scope":"Local files only (no git history, no live credential validation). Guest is Ubuntu on WSL2, Python 3.12.3, uv 0.13.5. No browser was needed, so the CDP endpoint was not used.","steps":["uv tool install kingfisher-bin (README Quick Start, PyPI wrapper; installed kingfisher-bin 2.15.0 to <guest-path>)","kingfisher --version","kingfisher scan <guest-path> --git-history none --no-validate --format json (returned findings, exit 200)","kingfisher scan <guest-path> --git-history none --no-validate --format json --output <guest-path> (README 'Save and combine reports', exit 200, file contains github-pat)","kingfisher scan <guest-path> --git-history none --no-validate --format html --output <guest-path> (README HTML audit report, exit 0)","<env-var>=<guest-path> python3 -I <guest-path> --validate --replay (valid=true)"],"deviations":["README Quick Start install is 'brew install kingfisher' or 'uv tool install kingfisher-bin'. Homebrew is not in the guest, so I used the uv PyPI wrapper. It installs prebuilt kingfisher 2.15.0, not a build of the pinned source commit 5794966a04cda497ca96f802fabce9dfc9b17302. The workspace snapshot has no .git metadata and I did not build the Rust source with cargo.","The guest shell does not have the uv tool bin dir on PATH, so probes and claims set PATH in env to <guest-path>","All scans used --git-history none and --no-validate so the run stayed local, with no network credential checks. Live validation and the Git-history scan were not exercised.","The example uses a clean directory (<guest-path>). My first example scanned the fixture with the GitHub token, which exits 200, and the checker rejected it because README.md does not document that nonzero exit code. The README's own 'Save and combine reports' section was used for the claim and probe.","Fixture secrets are synthetic: a made-up ghp_ token in <guest-path>, and an AWS docs example key that produced no finding.","Rule-cache warning on stderr (cache directory writable by group or others). Scan results were unaffected.","Did not run the repository's cargo/Makefile test suite. Only README-documented operations were checked.","/inputs/coldpass-preflight.py does not exist in this guest, so I ran the documented <guest-path> command instead."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the tested operations. Optional: add a source-build path to the README for pinned-commit verification, and make sure the README documents exit code 200 for findings in the scan quickstart."}
EOF
python3 -I -c 'import json;d=json.load(open("<guest-path>"));print(d["outcome"], d["fault_owner"], len(d["steps"]))'; ls -la <guest-path> <guest-path> 2>&1 | tail -8