diff --git a/CHANGELOG.md b/CHANGELOG.md index 324997c..d643816 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ All notable changes to this project will be documented in this file. -## [unreleased v1.98.0] +## [v1.98.0] - Added first-class **Postman** scanning target: new `kingfisher scan postman` subcommand (and equivalent `--postman-*` flags) fetches workspaces, collections, and environments via the Postman API and scans them for hard-coded credentials in request `auth` blocks, pre-request/test scripts, saved example responses, and — notably — `secret`-typed environment variables, which the API returns in plaintext despite the UI mask. Selectors: `--workspace`, `--collection`, `--environment`, `--all`, with optional `--include-mocks-monitors` and `--api-url` for self-hosted endpoints. Authenticates via `KF_POSTMAN_TOKEN` (or `POSTMAN_API_KEY`) sent as `X-Api-Key`; honors `X-RateLimit-RetryAfter` on 429s. Findings link back to `https://go.postman.co/...` URLs in reports. - Fixed [#359](https://github.com/mongodb/kingfisher/issues/359): added `kingfisher.github.9` to detect the new ~520-character stateless GitHub App installation token format (`ghs__`). The legacy 36-character `ghs_` rule (`kingfisher.github.5`) is retained for older / GHES-issued tokens that are still in circulation. - Added provider endpoint overrides for validation and revocation via global `--endpoint PROVIDER=URL` and `--endpoint-config FILE`, with built-in support for self-hosted GitHub, GitLab, Gitea, Jira, Confluence, and Artifactory instances. diff --git a/README.md b/README.md index 006b556..0aaf40f 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ Kingfisher is an open source secret scanner and **live secret validation** tool It combines Intel's SIMD-accelerated regex engine (Hyperscan) with language-aware parsing to achieve high accuracy at massive scale, and ships with [945 built-in rules](https://mongodb.github.io/kingfisher/rules/builtin-rules/) to detect, **validate**, and triage leaked API keys, tokens, and credentials before they ever reach production. -Kingfisher also ships a **browser-based report viewer** that visualizes and triages findings from Kingfisher **and** from Gitleaks and TruffleHog JSON reports — so you can import scans from other tools and triage them in the same UI. A [hosted copy of the viewer](https://mongodb.github.io/kingfisher/viewer/) is published on the Kingfisher docs site. +Kingfisher also ships a **browser-based report viewer** that visualizes and triages findings from Kingfisher **and** from Gitleaks and TruffleHog JSON reports — so you can import scans from other tools and triage them in the same UI. A [hosted copy of the viewer](https://mongodb.github.io/kingfisher/viewer/) is published on the Kingfisher docs site [or run locally](#3-scan-and-view-results-in-browser) Designed for offensive security engineers and blue-team defenders alike, Kingfisher helps you scan repositories, cloud storage, chat, docs, and CI pipelines to find and verify exposed secrets quickly. @@ -48,9 +48,9 @@ Kingfisher is a high-performance, open source secret detection tool for source c |:-------------:|:----------:|:------:|:------:|:-------------:|:----------:|:------:|:-------------:| | Files / Dirs
Files / Dirs | Local Git
Local Git | GitHub
GitHub | GitLab
GitLab | Azure Repos
Azure Repos | Bitbucket
Bitbucket | Gitea
Gitea |Hugging Face
Hugging Face | -| Docker | Jira | Confluence | Slack | Teams | AWS S3 | Google Cloud | -|:------:|:----:|:-----------:|:-----:|:-----:|:------:|:---:| -| Docker
Docker | Jira
Jira | Confluence
Confluence | Slack
Slack | Microsoft Teams
Teams | AWS S3
AWS S3 | Google Cloud Storage
Cloud Storage | +| Docker | Jira | Confluence | Slack | Teams | Postman | AWS S3 | Google Cloud | +|:------:|:----:|:-----------:|:-----:|:-----:|:-------:|:------:|:---:| +| Docker
Docker | Jira
Jira | Confluence
Confluence | Slack
Slack | Microsoft Teams
Teams | Postman
Postman | AWS S3
AWS S3 | Google Cloud Storage
Cloud Storage | diff --git a/docs/assets/icons/postman.svg b/docs/assets/icons/postman.svg new file mode 100644 index 0000000..a0bb0c0 --- /dev/null +++ b/docs/assets/icons/postman.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/src/cli/commands/inputs.rs b/src/cli/commands/inputs.rs index 9d59258..263b24d 100644 --- a/src/cli/commands/inputs.rs +++ b/src/cli/commands/inputs.rs @@ -467,6 +467,10 @@ impl InputSpecifierArgs { || self.confluence_url.is_some() || self.slack_query.is_some() || self.teams_query.is_some() + || !self.postman_workspaces.is_empty() + || !self.postman_collections.is_empty() + || !self.postman_environments.is_empty() + || self.postman_all || self.s3_bucket.is_some() || self.gcs_bucket.is_some() || !self.docker_image.is_empty()