From 8d9f5bed4030673e1fd8710f04d9dde9536430f1 Mon Sep 17 00:00:00 2001 From: Mick Grove Date: Wed, 29 Apr 2026 08:58:11 -0700 Subject: [PATCH] =?UTF-8?q?Added=20first-class=20**Postman**=20scanning=20?= =?UTF-8?q?target:=20new=20kingfisher=20scan=20postman=20subcommand=20(and?= =?UTF-8?q?=20equivalent=20--postman-*=20flags)=20fetches=20workspaces,=20?= =?UTF-8?q?collections,=20and=20environments=20via=20the=20Postman=20API?= =?UTF-8?q?=20and=20scans=20them=20for=20hard-coded=20credentials=20in=20r?= =?UTF-8?q?equest=20auth=20blocks,=20pre-request/test=20scripts,=20saved?= =?UTF-8?q?=20example=20responses,=20and=20=E2=80=94=20notably=20=E2=80=94?= =?UTF-8?q?=20secret-typed=20environment=20variables,=20which=20the=20API?= =?UTF-8?q?=20returns=20in=20plaintext=20despite=20the=20UI=20mask.=20Sele?= =?UTF-8?q?ctors:=20--workspace,=20--collection,=20--environment,=20--all,?= =?UTF-8?q?=20with=20optional=20--include-mocks-monitors=20and=20--api-url?= =?UTF-8?q?=20for=20self-hosted=20endpoints.=20Authenticates=20via=20KF=5F?= =?UTF-8?q?POSTMAN=5FTOKEN=20(or=20POSTMAN=5FAPI=5FKEY)=20sent=20as=20X-Ap?= =?UTF-8?q?i-Key;=20honors=20X-RateLimit-RetryAfter=20on=20429s.=20Finding?= =?UTF-8?q?s=20link=20back=20to=20https://go.postman.co/...=20URLs=20in=20?= =?UTF-8?q?reports.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 2 +- README.md | 8 ++++---- docs/assets/icons/postman.svg | 1 + src/cli/commands/inputs.rs | 4 ++++ 4 files changed, 10 insertions(+), 5 deletions(-) create mode 100644 docs/assets/icons/postman.svg diff --git a/CHANGELOG.md b/CHANGELOG.md index 324997c..d643816 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ All notable changes to this project will be documented in this file. -## [unreleased v1.98.0] +## [v1.98.0] - Added first-class **Postman** scanning target: new `kingfisher scan postman` subcommand (and equivalent `--postman-*` flags) fetches workspaces, collections, and environments via the Postman API and scans them for hard-coded credentials in request `auth` blocks, pre-request/test scripts, saved example responses, and — notably — `secret`-typed environment variables, which the API returns in plaintext despite the UI mask. Selectors: `--workspace`, `--collection`, `--environment`, `--all`, with optional `--include-mocks-monitors` and `--api-url` for self-hosted endpoints. Authenticates via `KF_POSTMAN_TOKEN` (or `POSTMAN_API_KEY`) sent as `X-Api-Key`; honors `X-RateLimit-RetryAfter` on 429s. Findings link back to `https://go.postman.co/...` URLs in reports. - Fixed [#359](https://github.com/mongodb/kingfisher/issues/359): added `kingfisher.github.9` to detect the new ~520-character stateless GitHub App installation token format (`ghs__`). The legacy 36-character `ghs_` rule (`kingfisher.github.5`) is retained for older / GHES-issued tokens that are still in circulation. - Added provider endpoint overrides for validation and revocation via global `--endpoint PROVIDER=URL` and `--endpoint-config FILE`, with built-in support for self-hosted GitHub, GitLab, Gitea, Jira, Confluence, and Artifactory instances. diff --git a/README.md b/README.md index 006b556..0aaf40f 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ Kingfisher is an open source secret scanner and **live secret validation** tool It combines Intel's SIMD-accelerated regex engine (Hyperscan) with language-aware parsing to achieve high accuracy at massive scale, and ships with [945 built-in rules](https://mongodb.github.io/kingfisher/rules/builtin-rules/) to detect, **validate**, and triage leaked API keys, tokens, and credentials before they ever reach production. -Kingfisher also ships a **browser-based report viewer** that visualizes and triages findings from Kingfisher **and** from Gitleaks and TruffleHog JSON reports — so you can import scans from other tools and triage them in the same UI. A [hosted copy of the viewer](https://mongodb.github.io/kingfisher/viewer/) is published on the Kingfisher docs site. +Kingfisher also ships a **browser-based report viewer** that visualizes and triages findings from Kingfisher **and** from Gitleaks and TruffleHog JSON reports — so you can import scans from other tools and triage them in the same UI. A [hosted copy of the viewer](https://mongodb.github.io/kingfisher/viewer/) is published on the Kingfisher docs site [or run locally](#3-scan-and-view-results-in-browser) Designed for offensive security engineers and blue-team defenders alike, Kingfisher helps you scan repositories, cloud storage, chat, docs, and CI pipelines to find and verify exposed secrets quickly. @@ -48,9 +48,9 @@ Kingfisher is a high-performance, open source secret detection tool for source c |:-------------:|:----------:|:------:|:------:|:-------------:|:----------:|:------:|:-------------:| | Files / Dirs
Files / Dirs | Local Git
Local Git | GitHub
GitHub | GitLab
GitLab | Azure Repos
Azure Repos | Bitbucket
Bitbucket | Gitea
Gitea |Hugging Face
Hugging Face | -| Docker | Jira | Confluence | Slack | Teams | AWS S3 | Google Cloud | -|:------:|:----:|:-----------:|:-----:|:-----:|:------:|:---:| -| Docker
Docker | Jira
Jira | Confluence
Confluence | Slack
Slack | Microsoft Teams
Teams | AWS S3
AWS S3 | Google Cloud Storage
Cloud Storage | +| Docker | Jira | Confluence | Slack | Teams | Postman | AWS S3 | Google Cloud | +|:------:|:----:|:-----------:|:-----:|:-----:|:-------:|:------:|:---:| +| Docker
Docker | Jira
Jira | Confluence
Confluence | Slack
Slack | Microsoft Teams
Teams | Postman
Postman | AWS S3
AWS S3 | Google Cloud Storage
Cloud Storage | diff --git a/docs/assets/icons/postman.svg b/docs/assets/icons/postman.svg new file mode 100644 index 0000000..a0bb0c0 --- /dev/null +++ b/docs/assets/icons/postman.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/src/cli/commands/inputs.rs b/src/cli/commands/inputs.rs index 9d59258..263b24d 100644 --- a/src/cli/commands/inputs.rs +++ b/src/cli/commands/inputs.rs @@ -467,6 +467,10 @@ impl InputSpecifierArgs { || self.confluence_url.is_some() || self.slack_query.is_some() || self.teams_query.is_some() + || !self.postman_workspaces.is_empty() + || !self.postman_collections.is_empty() + || !self.postman_environments.is_empty() + || self.postman_all || self.s3_bucket.is_some() || self.gcs_bucket.is_some() || !self.docker_image.is_empty()