{ "checker": { "claims": [ { "claim": "Scanning a directory with --format json reports the leaked GitHub token and exits 200 when findings are present", "command": "kingfisher scan --git-history none --no-validate --format json", "evidence": "\u2026github-pat\",\"id\":\"betterleaks.github-pat\",\"description\":\"Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.\"},\"finding\":{\"snippet\":\"\",\"fingerprint\":\"4055663260747634681\",\"confidence\":\"high\",\"entropy\":\"5.22\",\"validation\":{\"outcome\":\"not_attempted\",\"status\":\"Not Attempted\",\"response\":\"\"},\"language\":\"Unknown\",\"line\":1,\"column_start\":15,\"column_end\":54,\"path\":\"\",\"validate_command\":\"kingfisher validate --rule 'betterleaks.github-pat' '", "expected": "JSON output containing the github-pat finding, exit code 200", "input": " containing a synthetic GitHub PAT", "kind": "claim", "outcome": "Real input produced the expected result: github-pat", "returncode": 200, "source": "kingfisher scan /path/to/repository --format json", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "The --output option writes the JSON report to a file", "command": "kingfisher scan --git-history none --no-validate --format json --output ", "evidence": "\u2026github-pat\",\"id\":\"betterleaks.github-pat\",\"description\":\"Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.\"},\"finding\":{\"snippet\":\"\",\"fingerprint\":\"4055663260747634681\",\"confidence\":\"high\",\"entropy\":\"5.22\",\"validation\":{\"outcome\":\"not_attempted\",\"status\":\"Not Attempted\",\"response\":\"\"},\"language\":\"Unknown\",\"line\":1,\"column_start\":15,\"column_end\":54,\"path\":\"\",\"validate_command\":\"kingfisher validate --rule 'betterleaks.github-pat' '", "expected": "findings.json file containing the github-pat finding", "input": " containing a synthetic GitHub PAT", "kind": "claim", "outcome": "Real input produced the expected result: github-pat", "returncode": 200, "source": "--output findings.json", "source_checked": true, "source_file": "README.md", "verdict": "yes" } ], "cycle_checks": [ { "claim": "Scheduled or looping main behavior", "command": "", "evidence": "Inspected README.md and docs/USAGE.md for cron, schedule, daemon, loop, --once, --now, --watch, --interval and webhook behavior. Kingfisher is a one-shot scan CLI (kingfisher scan exits after one run). The only webhook mention is docs/ALERTS.md chat/webhook alert destinations, which are external notifications and out of scope here.", "expected": "identify the product trigger", "input": "source inspection", "kind": "cycle", "outcome": "Inspected README.md and docs/USAGE.md for cron, schedule, daemon, loop, --once, --now, --watch, --interval and webhook behavior. Kingfisher is a one-shot scan CLI (kingfisher scan exits after one run). The only webhook mention is docs/ALERTS.md chat/webhook alert destinations, which are external notifications and out of scope here.", "source": "repository entry points", "verdict": "yes" } ], "details": { "argv": [ "kingfisher", "scan", "", "--git-history", "none", "--no-validate", "--format", "json", "--output", "" ], "expected_file": "", "file_checked": true, "file_excerpt": "\u2026github-pat\",\"id\":\"betterleaks.github-pat\",\"description\":\"Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.\"},\"finding\":{\"snippet\":\"\",\"fingerprint\":\"4055663260747634681\",\"confidence\":\"high\",\"entropy\":\"5.22\",\"validation\":{\"outcome\":\"not_attempted\",\"status\":\"Not Attempted\",\"response\":\"\"},\"language\":\"Unknown\",\"line\":1,\"column_start\":15,\"column_end\":54,\"path\":\"\",\"validate_command\":\"kingfisher validate --rule 'betterleaks.github-pat' ''\",\"blast_radius_command\":\"kingfisher blast-radius --rule 'betterleaks.github-pat' ''\"}}],\"audit\":{\"schema\":\"kingfisher.repository-audit.v1\",\"run_id\":\"d56677ea-aba4-4dde-b260-f47f7a3b593a\",\"started_at\":\"2026-10-28T03:55:03.755308972+00:00\",\"completed_at\":\"2026-10-28T03:55:03.808Z\",\"duration_seconds\":0.053119071,\"summary\":{\"discovered\":1,\"fetch_succeeded\":0,\"fetch_failed\":0,\"scan_succeeded\":1,\"scan_partial\":0,\"scan_failed\":0,\"pending\":0},\"repositories\":[{\"key\":\"local:\",\"repository\":\"\",\"source\":\"local\",\"discovered_at\":\"2026-10-28T03:55:03.762Z\",\"fetch\":{\"status\":\"not_applicable\"},\"scan\":{\"status\":\"completed\",\"started_at\":\"2026-10-28T03:55:03.762Z\",\"completed_at\":\"2026-10-28T03:55:03.808Z\",\"duration_seconds\":0.045856815},\"stats\":{\"findings\":2,\"blobs_scanned\":2,\"bytes_scanned\":153}}]},\"metadata\":{\"generated_at\":\"2026-10-28T03:55:03.809616503+00:00\",\"scan_timestamp\":\"2026-10-28T03:55:03.755308972+00:00\",\"target\":\"\",\"command_line_args\":[\"\",\"scan\",\"\",\"--git-history\",\"none\",\"--no-validate\",\"--format\",\"json\",\"--output\",\"\"],\"kingfisher_version\":\"2.15.0\",\"latest_version_available\":\"2.15.0\",\"update_check_status\":\"ok\",\"summary\":{\"findings\":1,\"active_findings\":0,\"inactive_findings\":0,\"locally_derived_findings\":0,\"invalid_material_findings\":0,\"unknown_validation_findings\":1,\"access_map_identities\":0,\"rules_applied\":488,\"confidence_level\":\"medium\",\"custom_rules_used\":false,\"successful_validations\":0,\"failed_validations\":0,\"skipped_validations\":0,\"blobs_scanned\":2,\"bytes_scanned\":153,\"scan_duration_seconds\":0.053337563}}}\n", "kind": "cli", "needs_browser": false, "needs_credentials": false, "returncode": 200, "scope": "product operation", "stderr": "Kingfisher 2.15.0 is up to date\n INFO kingfisher: Launching with 2 concurrent scan jobs. Use --jobs to override.\n INFO kingfisher::rule_loader: Loaded 488 rules\n INFO kingfisher::scanner::rule_loading: Using Vectorscan rule cache cache_dir=\n WARN kingfisher_rules::rules_database: Ignoring unsafe or unavailable rule cache directory cache_dir= err=cache directory route is writable by group or others", "stdout": "{\"findings\":1,\"successful_validations\":0,\"failed_validations\":0,\"skipped_validations\":0,\"rules_applied\":488,\"blobs_scanned\":2,\"bytes_scanned\":153,\"scan_duration\":0.054178047,\"scan_date\":\"2026-10-28T03:55:03.755308972+00:00\",\"kingfisher\":{\"version_used\":\"2.15.0\",\"latest_version\":\"2.15.0\",\"update_check_status\":\"ok\",\"update_check_message\":\"Kingfisher 2.15.0 is up to date\"},\"findings_by_rule\":[[\"Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.\",1]]}", "working": true }, "evidence_strength": "readme_checked", "example_checks": [ { "claim": "Generate a standalone HTML audit report", "command": "kingfisher scan --git-history none --no-validate --format html --output ", "deferred": false, "evidence": "window.history.state, \"\", url);\n }\n refresh();\n search?.focus();\n });\n refresh();\n });\n\n window.addEventListener(\"beforeprint\", () => {\n document.querySelectorAll(\"details.commands\").forEach((details) => {\n details.dataset.wasOpen = details.open ? \"true\" : \"false\";\n details.open = true;\n });\n });\n window.addEventListener(\"afterprint\", () => {\n document.querySelectorAll(\"details.commands\").forEach((details) => {\n details.open = details.dataset.wasOpen === \"true\";\n delete details.dataset.wasOpen;\n });\n });\n})();\n\n\n\n", "expected": "standalone HTML audit report with the Kingfisher Audit Report title, exit code 0", "input": " (clean directory, no findings)", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Save and combine reports (--format html --output audit.html)", "verdict": "yes" } ], "status": "PASS" }, "deviations": [ "README Quick Start install is 'brew install kingfisher' or 'uv tool install kingfisher-bin'. Homebrew is not in the guest, so I used the uv PyPI wrapper. It installs prebuilt kingfisher 2.15.0, not a build of the pinned source commit 5794966a04cda497ca96f802fabce9dfc9b17302. The workspace snapshot has no .git metadata and I did not build the Rust source with cargo.", "The guest shell does not have the uv tool bin dir on PATH, so probes and claims set PATH in env to ", "All scans used --git-history none and --no-validate so the run stayed local, with no network credential checks. Live validation and the Git-history scan were not exercised.", "The example uses a clean directory (). My first example scanned the fixture with the GitHub token, which exits 200, and the checker rejected it because README.md does not document that nonzero exit code. The README's own 'Save and combine reports' section was used for the claim and probe.", "Fixture secrets are synthetic: a made-up ghp_ token in , and an AWS docs example key that produced no finding.", "Rule-cache warning on stderr (cache directory writable by group or others). Scan results were unaffected.", "Did not run the repository's cargo/Makefile test suite. Only README-documented operations were checked.", "/inputs/coldpass-preflight.py does not exist in this guest, so I ran the documented command instead." ], "fault_owner": null, "main_blocker": null, "operation": "Install Kingfisher from the README and run a local secret scan with JSON and file output (kingfisher scan ... --format json [--output file]), plus the README HTML audit report", "operation_scope": "Local files only (no git history, no live credential validation). Guest is Ubuntu on WSL2, Python 3.12.3, uv 0.13.5. No browser was needed, so the CDP endpoint was not used.", "outcome": "working", "plain_failure": null, "steps": [ "uv tool install kingfisher-bin (README Quick Start, PyPI wrapper; installed kingfisher-bin 2.15.0 to )", "kingfisher --version", "kingfisher scan --git-history none --no-validate --format json (returned findings, exit 200)", "kingfisher scan --git-history none --no-validate --format json --output (README 'Save and combine reports', exit 200, file contains github-pat)", "kingfisher scan --git-history none --no-validate --format html --output (README HTML audit report, exit 0)", "= python3 -I --validate --replay (valid=true)" ], "stuck_step": null, "suggested_fix": "None required for the tested operations. Optional: add a source-build path to the README for pinned-commit verification, and make sure the README documents exit code 200 for findings in the scan quickstart." }