- Live validation: checks whether a candidate secret actually works, so you can ignore dead strings.

- "What can this key do?" / Access Mapping (optional): authenticates and enumerates the credential’s effective access (AWS, GCP, Azure, GitHub, GitLab).

- Local triage UI: opens a local-only report so you can review findings + blast radius without sending code anywhere.

Try it out:

  brew install kingfisher
  #
  kingfisher scan /path/to/code --view-report
  #
  kingfisher scan --git-url https://github.com/org/repo.git --view-report
  #
  kingfisher scan . --access-map --view-report

- false positives/negatives on your repos - which access-map / blast radius target you want next - what the UI should surface first during incident triage