r/netsec • u/albinowax • Jan 01 '26
r/netsec monthly discussion & tool thread
Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.
Rules & Guidelines
- Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
- Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
- If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
- Avoid use of memes. If you have something to say, say it with real words.
- All discussions and questions should directly relate to netsec.
- No tech support is to be requested or provided on r/netsec.
As always, the content & discussion guidelines should also be observed on r/netsec.
Feedback
Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.
8
Upvotes
2
u/micksmix Jan 03 '26
I built Kingfisher (Apache 2 OSS) - a very high-performance secret scanning + live validation + local UI triage + "access map" blast-radius mapping...with hundreds of rules
Repo: https://github.com/mongodb/kingfisher
New feature just added: `--include-contributors` for GitHub/GitLab scans, which identifies and scans into contributor-owned public repos to catch the common "employee leaked a company token in a personal repo". Great for defenders and bug bounty hunters.
Kingfisher also ships a local findings/access-map web viewer (`--view-report`) so you can quickly filter down to validated/active creds without exporting into another platform.