{
"findings": [
{
"rule": {
"name": "Alibaba Access Key Secret",
"id": "betterleaks.alibaba-secret-key"
},
"finding": {
"snippet": "m0qx7h2v4n8c9t3b6p1r5w0kzsdjf",
"fingerprint": "13778709639383676952",
"confidence": "medium",
"entropy": "4.55",
"validation": {
"status": "Inactive Credential",
"response": "{\"RequestId\":\"48F0D2A0-7C0E-5DE2-BC89-39811315C04A\",\"Message\":\"Specified access key is not found.\",\"Recommend\":\"https://api.aliyun.com/troubleshoot?q=InvalidAccessKeyId.NotFound&product=Sts&requestId=48F0D2A0-7C0E-5DE2-BC89-39811315C04A\",\"HostId\":\"sts.aliyuncs.com\",\"Code\":\"InvalidAccessKeyId.NotFound\"}"
},
"language": "Plain Text",
"line": 5,
"column_start": 0,
"column_end": 29,
"path": "/tmp/repo/tmp/secretstuff/alibaba-test.txt"
}
},
{
"rule": {
"name": "Alibaba Access Key Secret",
"id": "betterleaks.alibaba-secret-key"
},
"finding": {
"snippet": "z91trw6fap8kq2xmd4s7h3b0vnclpf",
"fingerprint": "8292190854848911527",
"confidence": "medium",
"entropy": "4.44",
"validation": {
"status": "Inactive Credential",
"response": "Validation skipped - missing dependent rules: betterleaks.alibaba-access-key-id"
},
"language": "Unknown",
"line": 8,
"column_start": 39,
"column_end": 68,
"path": "/tmp/repo/tmp/secretstuff/alibaba/alibaba-validator/.venv/lib/python3.13/site-packages/alibabacloud_tea_util-0.3.13.dist-info/RECORD"
}
},
{
"rule": {
"name": "AWS Access Token",
"id": "betterleaks.aws-access-token"
},
"finding": {
"snippet": "dB9PyxlN/qa8sF0tJ4uM2qZr7eVw6TgHkC0nBpZq",
"fingerprint": "17034522315778178539",
"confidence": "medium",
"entropy": "4.67",
"validation": {
"status": "Active Credential",
"response": "AKIAFAKEKEY123456789 --- ARN: arn:aws:iam::000000000000:user/example_user --- AWS Account Number: 000000000000"
},
"language": "Unknown",
"line": 1,
"column_start": 65,
"column_end": 104,
"path": "/tmp/repo/tmp/secretstuff/utf8.txt "
}
}
],
"access_map": [
{
"provider": "aws",
"account": "prod",
"fingerprint": "17034522315778178539",
"context": {
"identity_id": "arn:aws:iam::123456789012:user/deploy-bot",
"account_id": "123456789012",
"access_type": "iam_user"
},
"permissions_by_severity": {
"admin": [],
"privilege_escalation": ["iam:AssumeRole"],
"risky": ["s3:GetObject"],
"read_only": ["s3:ListBucket"]
},
"provider_metadata": {
"version": null,
"enterprise": null,
"authorization_evidence": {
"principal": {
"id": "arn:aws:iam::123456789012:user/deploy-bot",
"kind": "user",
"canonical_id": "arn:aws:iam::123456789012:user/deploy-bot",
"name": "deploy-bot",
"groups": ["deployers"],
"tags": { "owner": "platform" },
"attributes": { "iam_id": "AIDAEXAMPLE" }
},
"policies": [
{
"id": "arn:aws:iam::123456789012:policy/Deploy:v3:arn:aws:iam::123456789012:group/deployers",
"name": "Deploy",
"kind": "managed",
"attached_to": "arn:aws:iam::123456789012:group/deployers",
"attached_via": "arn:aws:iam::123456789012:user/deploy-bot",
"version": "v3",
"statements": [
{
"id": "deploy#assume",
"sid": "AssumeAdmin",
"effect": "Allow",
"actions": ["sts:AssumeRole"],
"resources": ["arn:aws:iam::123456789012:role/Admin"]
}
]
}
],
"paths": [
{
"direction": "outbound",
"status": "potential",
"hops": [
{
"from": "arn:aws:iam::123456789012:user/deploy-bot",
"to": "arn:aws:iam::123456789012:role/Admin",
"relationship": "can_assume_role"
}
],
"evidence": ["deploy#assume", "trust:Admin#deployers"]
}
],
"limitations": [
"Role paths are inferred from visible IAM policies; Kingfisher does not assume discovered roles."
]
}
},
"groups": [
{
"resources": ["arn:aws:s3:::prod-bucket", "arn:aws:s3:::prod-logs"],
"permissions": ["s3:GetObject", "s3:ListBucket"]
},
{ "resources": ["arn:aws:iam::123456789012:role/Admin"], "permissions": ["iam:AssumeRole"] }
]
},
{
"provider": "gcp",
"account": "test-project",
"context": {
"identity_id": "scanner@test-project.iam.gserviceaccount.com",
"project": "test-project",
"access_type": "service_account"
},
"permissions_by_severity": {
"admin": [],
"privilege_escalation": [],
"risky": ["compute.instances.get"],
"read_only": ["compute.instances.list"]
},
"provider_metadata": {
"version": null,
"enterprise": null,
"authorization_evidence": {
"principal": {
"id": "scanner@test-project.iam.gserviceaccount.com",
"kind": "service_account",
"canonical_id": "projects/-/serviceAccounts/scanner@test-project.iam.gserviceaccount.com",
"attributes": { "project_id": "test-project", "disabled": "false" }
},
"policies": [
{
"id": "gcp:folders/456:roles/compute.viewer:0",
"name": "roles/compute.viewer",
"kind": "iam_binding",
"attached_to": "scanner@test-project.iam.gserviceaccount.com",
"scope": "folders/456",
"statements": [
{
"id": "gcp:folders/456:roles/compute.viewer:0#0",
"effect": "Allow",
"actions": ["compute.instances.get", "compute.instances.list"],
"resources": ["folders/456"],
"principals": ["serviceAccount:scanner@test-project.iam.gserviceaccount.com"]
}
]
}
],
"paths": [
{
"direction": "outbound",
"status": "potential",
"hops": [
{
"from": "scanner@test-project.iam.gserviceaccount.com",
"to": "deployer@test-project.iam.gserviceaccount.com",
"relationship": "can_mint_access_token"
}
],
"evidence": ["iam.serviceAccounts.getAccessToken"]
}
],
"hierarchy": [
{ "kind": "project", "id": "projects/test-project" },
{ "kind": "folder", "id": "folders/456" },
{ "kind": "organization", "id": "organizations/123" }
],
"limitations": [
"Resource inventory is limited to the project associated with the credential."
]
}
},
"groups": [
{
"resources": [
"projects/test-project/zones/us-central1-a/instances/primary",
"projects/test-project/zones/us-central1-a/instances/worker-01",
"projects/test-project/zones/us-central1-b/instances/worker-02"
],
"permissions": ["compute.instances.get", "compute.instances.list"]
}
]
}
],
"audit": {
"schema": "kingfisher.repository-audit.v1",
"run_id": "018f3d72-7d32-7c55-91bd-example000001",
"started_at": "2025-11-25T23:37:41.863Z",
"completed_at": "2025-11-25T23:38:04.291Z",
"duration_seconds": 22.428,
"summary": {
"discovered": 2,
"fetch_succeeded": 1,
"fetch_failed": 1,
"scan_succeeded": 1,
"scan_partial": 0,
"scan_failed": 0,
"pending": 0
},
"repositories": [
{
"key": "https://github.com/example/payments",
"repository": "https://github.com/example/payments",
"source": "remote",
"discovered_at": "2025-11-25T23:37:41.900Z",
"fetch": { "status": "completed", "started_at": "2025-11-25T23:37:42.000Z", "completed_at": "2025-11-25T23:37:44.100Z", "duration_seconds": 2.1, "method": "cloned" },
"scan": { "status": "completed", "started_at": "2025-11-25T23:37:44.110Z", "completed_at": "2025-11-25T23:38:03.900Z", "duration_seconds": 19.79 },
"git": { "scope": "all_fetched_git_objects", "tip_ref": "HEAD", "tip_sha": "17dbca8c7bb91fb20f18ac0219a4b12be67309ad", "clone_mode": "bare", "shallow": false, "fetched_commit_count": 1842 },
"stats": { "findings": 3, "blobs_scanned": 14839, "bytes_scanned": 74255112 }
},
{
"key": "https://github.com/example/archived-service",
"repository": "https://github.com/example/archived-service",
"source": "remote",
"discovered_at": "2025-11-25T23:37:41.905Z",
"fetch": { "status": "failed", "started_at": "2025-11-25T23:37:42.010Z", "completed_at": "2025-11-25T23:37:42.710Z", "duration_seconds": 0.7, "error": "repository access denied" },
"scan": { "status": "not_run" }
}
]
},
"stats": {
"total": 259,
"critical": 37,
"validated": 167,
"unique_paths": 21,
"confidence_buckets": {
"High": 37,
"Medium": 222
},
"confidence_order": ["High", "Medium"],
"scan_date": "2025-11-25T15:37:41.863868-08:00",
"kingfisher_version": "1.68.0"
}
}
