Mick Grove
74cad26aed
performance improvements and rule improvements
2026-04-17 11:01:46 -07:00
Mick Grove
a27f90d619
performance improvements and rule improvements
2026-04-16 16:57:31 -07:00
Mick Grove
c3d686cfac
performance improvements and access map viewer improvements
2026-04-16 09:56:56 -07:00
Mick Grove
c89e527053
bug fix
2026-04-16 06:44:12 -07:00
Mick Grove
93a9cb796e
updates to new rules
2026-04-15 17:13:10 -07:00
Mick Grove
d2008dc3b7
cleaned up dependency tree
2026-04-13 20:43:09 -07:00
Mick Grove
0d33dff196
changes in response to PR review
2026-04-08 11:09:36 -07:00
Mick Grove
afee0b7181
updated rules
2026-04-07 10:42:44 -07:00
Mick Grove
45a565fa6e
added more rules
2026-04-06 22:18:58 -07:00
Mick Grove
b14522351b
updated in response to ossf scorecard
2026-03-27 23:18:56 -07:00
Mick Grove
afd0eb5713
updated in response to ossf scorecard
2026-03-27 23:07:02 -07:00
Mick Grove
993a76ded1
updated in response to ossf scorecard
2026-03-27 22:57:19 -07:00
Mick Grove
93cd6e940c
updated in response to ossf scorecard
2026-03-27 22:43:50 -07:00
Mick Grove
e0a403607f
updated in response to ossf scorecard
2026-03-27 22:26:35 -07:00
Mick Grove
b04865e174
updated in response to ossf scorecard
2026-03-27 21:38:58 -07:00
Mick Grove
4e9a7364cd
updated in response to ossf scorecard
2026-03-27 21:25:56 -07:00
Mick Grove
411aeefa92
updated in response to ossf scorecard
2026-03-27 17:22:21 -07:00
Mick Grove
1c7341f3ac
updated in response to ossf scorecard
2026-03-27 15:04:14 -07:00
Mick Grove
f681591ee8
changes in response to PR review
2026-03-18 17:19:30 -07:00
Mick Grove
f0a3bee587
added --max-validation-response-length <BYTES>
2026-03-16 22:25:32 -07:00
Mick Grove
fcac8cf1b7
rules updated
2026-03-03 16:47:59 -08:00
Mick Grove
5882468177
Added optional validation rate limiting via --validation-rps (global) and repeatable --validation-rps-rule <RULE_SELECTOR=RPS> (per-rule override) for both scan and validate. Throttling now applies across built-in validator types (HTTP/gRPC plus AWS, GCP, Coinbase, MongoDB, Postgres, MySQL, JDBC, JWT, and Azure Storage). Rule selectors support the short form (for example, github=2 matches kingfisher.github.*) with longest-prefix precedence when multiple selectors apply.
2026-02-12 12:33:59 -08:00
Mick Grove
2d6abb95c9
fixes in response to pr review
2026-02-11 23:44:09 -08:00
Mick Grove
4ab5932d57
- Added Vercel credential rules for new token formats introduced February 2026: vcp_ (personal access), vci_ (integration), vca_ (app access), vcr_ (app refresh), vck_ (AI Gateway API key). All use CRC32/Base62 checksum validation. Legacy 24-char format retained as kingfisher.vercel.1.
...
- Added revocation support for Vercel app tokens (vca_, vcr_) via https://api.vercel.com/login/oauth/token/revoke . Requires VERCEL_APP_CLIENT_ID (or NEXT_PUBLIC_VERCEL_APP_CLIENT_ID) and VERCEL_APP_CLIENT_SECRET.
- Fixed validate/revoke command generation to omit regex named captures (e.g., BODY, CHECKSUM) when they are not used by validation/revocation templates, so rules like Vercel no longer produce unnecessary --var BODY=... arguments.
2026-02-11 13:56:17 -08:00
Mick Grove
265e569c60
- Fixed validation flakiness under service rate limiting by retrying HTTP validations on 429/408 in addition to transient 5xx failures.
...
- Prevented transient HTTP validation failures (429/5xx) from being cached, avoiding cache poisoning that could suppress later successful validations in the same scan.
2026-02-11 11:38:24 -08:00
Mick Grove
4a74e95756
v1.81.0
2026-02-10 19:43:34 -08:00
Mick Grove
e518fb30f2
v1.81.0
2026-02-10 19:24:19 -08:00
Mick Grove
1a40fb3bfd
Fixed AWS access key validation to support temporary/session keys (ASIA prefix) in addition to long-lived keys (AKIA prefix).
2026-02-06 17:05:32 -08:00
Mick Grove
5253204c2a
preparing for v1.78.0
2026-02-02 23:22:08 -08:00
Mick Grove
63f1d515ae
preparing for v1.78.0
2026-02-02 18:39:24 -08:00
Mick Grove
76be1df60c
Refactored into multiple crates. Added the 'validate' subcommand
2026-01-28 10:27:24 -08:00
Mick Grove
38a0dd9e26
Switched compression dependencies to pure-Rust bzip2/lzma implementations and pared zip features to avoid C-based codecs for bz2/xz handling.
2026-01-23 10:45:08 -08:00
Mick Grove
b4feb86f47
- Fixed validation deduplication for rules with nested unnamed captures (e.g. (?<REGEX>...(ABC|DEF)...)) to use the primary capture for grouping, ensuring each unique match triggers a separate validation request.
...
- Added trace-level (-vv) logging for internal validation dedup keys and grouping to aid debugging.
2026-01-21 13:13:43 -08:00
Mick Grove
7237a931d5
v1.73.0
2026-01-01 22:24:57 -08:00
Mick Grove
587dfc5892
- Fixed deduplication for dependency-provider rules so dependent validations run per blob
...
- Updated Artifactory rule entropy and added new artifactory rule
2025-12-21 22:07:45 -08:00
Mick Grove
078fa16e6a
- Reduced per-match memory usage by compacting stored source locations and interning repeated capture names.
...
- Stored optional validation response bodies as boxed strings to avoid allocating empty payloads and to streamline validator caches.
- Parallelized git cloning based on the configured job count and begin scanning repositories as soon as each clone finishes to reduce end-to-end scan times.
- Combined per-repository results into a single aggregate summary after scans complete.
- Added initial access-map support and report viewer html file. Currently beta features.
2025-12-04 22:02:30 -08:00
Mick Grove
c6b10f0b47
- Skip reporting MongoDB and Postgres findings when their connection strings cannot be parsed, even when validation is disabled.
...
- Improve MySQL detection by broadening URI coverage and adding live validation that skips clearly invalid connection strings.
2025-11-16 23:25:42 -08:00
Mick Grove
f9d75eaadd
- Skip reporting MongoDB and Postgres findings when their connection strings cannot be parsed, even when validation is disabled.
...
- Improve MySQL detection by broadening URI coverage and adding live validation that skips clearly invalid connection strings.
2025-11-15 08:11:25 -08:00
Mick Grove
2ed94f75d7
added jdbc rule and validator
2025-11-12 22:25:33 -08:00
Mick Grove
d6c1dfc9d0
updated allocator
2025-11-11 13:24:06 -08:00
Mick Grove
dca955a95c
v1.63.0
2025-11-10 18:47:51 -08:00
Mick Grove
da2fb6700d
changes in response to code review
2025-11-09 09:16:50 -08:00
Mick Grove
7eb7be72cd
fixing rules
2025-11-08 15:03:53 -08:00
Mick Grove
8aac161603
fixing rules
2025-11-08 10:48:00 -08:00
Mick Grove
ccbbbad5bc
Added checksum comparisons to pattern_requirements, new suffix, crc32, and base62 Liquid filters, and verbose logging so mismatched checksums are skipped with context rather than reported as findings.
2025-11-07 16:31:24 -08:00
Mick Grove
cb22388bd1
updated smoke_branch tests
2025-10-26 11:53:29 -07:00
Mick Grove
03d7364888
- Added first-class Hugging Face scanning support, including CLI enumeration, token authentication, and integration with remote scans.
...
- Condensed GitError formatting to report the exit status and the first informative lines from stdout/stderr, producing concise git clone failure logs.
- Added support for scanning Google Cloud Storage buckets via --gcs-bucket, including optional prefixes and service-account authentication.
- Added --skip-aws-account (now accepting comma-separated values) and --skip-aws-account-file to bypass live AWS validation for known canary/honey-token account IDs without triggering alerts. Kingfisher now ships with several canary AWS account IDs pre-seeded in the skip list and now reports matching findings as "Not Attempted" with the "Response" containing "(skip list entry)" so its clear that validation was intentionally skipped and why.
2025-10-15 22:47:40 -07:00
Mick Grove
654f1ef41f
Added a new CLI flag, --user-agent-suffix to allow developers to append additional information to the user-agent
2025-09-18 14:11:54 -07:00
Mick Grove
895dac63b8
updated user-agent
2025-09-10 16:13:28 -07:00
Mick Grove
3bfcc074f4
updated user-agent
2025-09-10 16:08:33 -07:00
