Kingfisher v2.7.0

[v2.7.0]

• Added opt-in bounded verification for ambiguous credential components, with ranked candidates for AWS, BrowserStack, ClickHouse Cloud, MongoDB Atlas, PlanetScale, Razorpay, and Wiz.
• Kept unresolved pairings inconclusive: searches try at most 16 combinations within 30 seconds, and only authoritative validation success selects a pair. Candidate verification requires supported fixed destinations, disables HTTP redirects, and keeps unselected secrets out of reports.

Kingfisher v2.6.0

[v2.6.0]

• Added opt-in GitHub gist scanning #508, plus GitLab and Bitbucket Cloud snippet scanning, with full Git history.
• Reduced peak scan memory: findings now deduplicate on exact cryptographic digests alone (the Bloom prefilter and its dependency were removed), the Git object index stores each object ID once, and raw matcher bookkeeping was slimmed.
• Added opt-in --disk-offload to reduce accumulated finding memory across repositories; it falls back to memory with a warning when temporary storage fills up.
• Fixed HTML report validation filters to match displayed states, including assumed-valid, invalid-material, and skipped-canary findings.

Kingfisher v2.5.0

[v2.5.0]

• Behavior change: scan --branch <ref> now scans all reachable history by default, finding secrets deleted in later commits, including merged history. Use --git-history none to retain snapshot-only scanning; explicit diff options keep their existing scope. Full-history scans may need more time and memory, and history enumeration shares the repository’s --git-repo-timeout budget. #503

Kingfisher v2.4.0

[v2.4.0]

• Fixed scans missing secrets in UTF-16 and UTF-32 files, including little-/big-endian files with or without a BOM.
• Hardened the HTML report viewer with safer imported-data rendering, restricted external links, and a tighter browser security policy.

Kingfisher v2.3.0

[v2.3.0]

• Improved report filtering, grouped selection, command copying, and finding details in the local viewer and standalone HTML reports.
• Fixed probabilistic deduplication dropping unique findings by confirming duplicates with exact keys.
• Recorded terminal scan coverage for streamed non-Git inputs, including Docker images.
• Pinned release Docker images to the requested release version.
• Limited the pretty report's REPOSITORY COVERAGE section to scans that request --audit-log.
• Fixed --no-dedup scans to reuse validation results across duplicate findings and parallel scan phases.
• Fixed dependent-secret validation stalls and duplicate provider requests caused by concurrent waiters.
• Added overlay-derived bare detection for contextual Betterleaks API-key rules (DeepSeek, Kimi, ZAI, and Voyage AI).
• Fixed CredentialUri TLS-mode handling, dependency-aware deduplication, and ambiguous dependency pairing so validation does not guess an endpoint. #500
• Reused dependent validation when credential and dependency values match across source locations.
• Made direct validation reject ambiguous short rule selectors instead of trying an unintended rule. #500

Kingfisher v2.2.0

[v2.2.0]

• Added repository coverage manifests and incremental --audit-log JSONL events, including
  discovery, fetch, scan outcome, Git scope, and per-repository scan statistics.
• Added read-only Google API-key blast-radius probes for Identity Toolkit, Generative Language,
  Translation, and YouTube services.
• Updated Cargo dependencies, including AWS SDK, Git, TLS, and runtime libraries.
• Explicitly enabled HTTP/2 for outbound validation requests to improve connection reuse and multiplexing.
• Refreshed the pinned Betterleaks catalog to commit
  95237cf,
  adding the Voyage AI API-key detector. Built-in coverage is now 485 rules (459 Betterleaks and
  26 Veles), with 246 rules supporting validation. The OSV-SCALIBR Veles audit found no new secret
  detectors since the existing pinned revision.

Kingfisher v2.1.0

[v2.1.0]

• Added GitHub App authentication for GitHub organization scans. Configure
  KF_GITHUB_APP_ID, KF_GITHUB_APP_INSTALLATION_ID, and either
  KF_GITHUB_APP_PRIVATE_KEY or KF_GITHUB_APP_PRIVATE_KEY_PATH to let Kingfisher
  sign short-lived App JWTs and mint a fresh installation token immediately before
  each repository clone, allowing scans to run beyond GitHub's one-hour installation-token
  lifetime. A complete App configuration takes precedence over KF_GITHUB_TOKEN, which
  continues to support personal access tokens and pre-minted installation tokens. #488
• Further improved read-only AWS and GCP blast-radius role-impact analysis, included by default. AWS maps
  direct and one-hop assumable IAM roles; GCP maps impersonatable service accounts, inherited
  roles, and hierarchy scopes. Reachable roles and their policy grants are preserved in JSON,
  TOON, SARIF, and HTML reports/viewers.
• Added direct single-finding blast-radius mapping with kingfisher blast-radius --rule <RULE> <SECRET>, including stdin and component variables. Exposed Blast Radius Cmd in all report formats, aligned pretty output labels, and documented JSON/jq command extraction in the defender workflow.
• Added HTTPS Basic Auth validation for Betterleaks' generic-credential-uri rule. Kingfisher
  sends credentials only after an unauthenticated request receives an explicit Basic challenge;
  plaintext HTTP and endpoints without authoritative authentication evidence remain inconclusive.

Kingfisher v2.0.0

[v2.0.0]

• Added Kingfisher-side typed validation for Betterleaks' generic-credential-uri rule without
  changing its detector: PostgreSQL, MySQL/MariaDB, and MongoDB URI captures now use the
  corresponding live validator and feed validated credentials into blast-radius mapping, while
  unsupported URI schemes remain detected with validation not attempted. JDBC strings containing
  a credential-bearing PostgreSQL/MySQL URI are handled through that inner URI, and direct
  CredentialUri validation also dispatches supported jdbc: inputs.
• Removed the Veles Paystack, PyPI, and Square OAuth application-secret adapters. PyPI upload-token and Square access-token detection remain covered by Betterleaks; Paystack and Square OAuth application-secret built-in coverage are no longer included.
• Security: the MongoDB, MySQL, Postgres, and JDBC validators now enforce the same SSRF gate as the HTTP/gRPC/JWT validators. Previously they only rejected loopback/unspecified hosts, so a crafted connection string in scanned content could make Kingfisher open TCP connections to RFC1918, link-local (including 169.254.169.254), CGNAT, and other non-public addresses, turning the scan report into an internal-network reachability oracle. Every host in a Postgres multi-host URL and every MongoDB seed — including hosts resolved via mongodb+srv:// SRV records — is now checked, and blocked targets report a constant message instead of the driver's connection error. Use --allow-internal-ips to opt back in.
• Breaking (library): validate_mongodb, validate_mysql, validate_postgres, and validate_jdbc take an additional allow_internal_ips: bool argument.
• Restored per-rule tls_mode for built-in rules. The imported-rule capability overlay now accepts tls_mode: strict | lax | off, and betterleaks.mongodb-connection-string and betterleaks.jwt declare lax so self-managed clusters and self-hosted IdPs presenting private-CA or self-signed certificates validate again. This remains opt-in on both sides: it takes effect only when the operator also runs --tls-mode lax (or --tls-mode off). The build rejects an unknown tls_mode value, or a tls_mode on a rule with no validator.
• Kingfisher 1.x rule selectors keep working. --rule, --exclude-rule, and rules.disabled entries naming kingfisher.* IDs now resolve to their 2.x replacements through a new alias table, with a one-time deprecation warning naming the selector to migrate to, instead of failing the scan. Exact kingfisher.* IDs still win when the 1.x catalog is loaded via --rules-path, and an unknown kingfisher.* selector is still an error.
• Added a rule-coverage drift guard. crates/kingfisher-rules/data/legacy-rule-aliases.yml maps
  migrated Kingfisher 1.x families with known 2.x replacements, and a test asserts each alias target
  still resolves against the built-in catalog, so an upstream release that drops a replacement fails
  the build instead of silently breaking that compatibility path.
• Restored scan-time access mapping for validated Veles rules (Slack app-level/config tokens, DigitalOcean, SendGrid), which previously reached the rule-ID dispatch and matched nothing.
• Breaking: moved the candidate detector catalog to the Betterleaks rule format, with selected
  Veles detectors filling gaps, giving the community a well-designed shared format and a common
  place to develop generally useful rules.
• Kingfisher now fetches and parses the Betterleaks catalog and selected Veles source files at build
  time; the Kingfisher 1.x YAML custom-rule format remains supported for custom rules.
• Preserved Kingfisher's engine capabilities around validation, blast-radius mapping, and credential revocation while allowing us to focus investment on scan performance, integrations, and analysis workflows.
• All rules now use Vectorscan candidate detection, eliminating unconditional whole-blob regex fallbacks for Betterleaks' large generic credential patterns; Betterleaks path and finding-filter regex helpers are also compiled once with Vectorscan instead of being rebuilt per path or finding.

Kingfisher v1.113.0

[v1.113.0]

• Added repository-aware v2 baselines with safe multi-repository updates, atomic writes, and automatic migration while retaining legacy baseline compatibility.
• Added configurable webhook finding filters, empty-alert suppression, dry-run previews, and access-map impact summaries.
• Breaking: the alert payload field summary.filtered_total was removed; read summary.total (now always the per-sink filtered count) and the new summary.unfiltered_total for the whole-scan count.
• Breaking (library): FindingsStore::access_map_results/set_access_map_results and AccessMapCollector::into_requests are no longer public.
• Added Qwen, Solana, and Starknet detection rules, plus Databricks OAuth client-secret and Kubernetes ServiceAccount token rules.
• Tightened MongoDB Atlas API key detection and stopped the Databricks workspace-host rule from matching azurewebsites.net.
• Fixed Google API-key attribution and validation, including YouTube handling and documented Gemini header authentication; added Google Chat webhook detection and authoritative rule provenance.
• Removed the duplicate Google OAuth rule and clarified Firebase FCM legacy server-key detection and documentation.
• Refreshed built-in rule and revocation coverage documentation.

Kingfisher v1.112.0

[v1.112.0]

• Added offline Ethereum key/BIP-39 detection with explicit local-validation outcomes, inspired by #468 from @audityourcontracts.
• Hardened validation caching and panic handling to avoid secret exposure.
• Fixed remote Git URL scans hanging with --jobs 1. #469