Picket.Engine API

Generated from XML documentation for Picket.Engine.

Types

• CompiledRuleSet - Represents a rule set with precompiled Scout regexes and keyword prefilters.
• Finding - Represents a detected secret finding using the Gitleaks-compatible field model.
• FindingPositionKind - Identifies the coordinate system used by a finding’s source positions.
• NativeDetectorMatch - Describes a structured detector match in the current scan-pass input.
• NativeDetectorScanContext - Caches structured parsing products for one scanner pass.
• NativeJsonCredentialDetector - Produces credential spans from a shared streaming JSON index.
• NativeJsonIndex - Indexes JSON string properties in one bounded streaming parse.
• NativeJsonStringProperty - Represents an indexed JSON string property and its source span.
• NativeKubernetesSecretDetector - Produces credential spans from Kubernetes Secret YAML resources.
• NativeNpmCredentialDetector - Produces credential spans from parsed npm configuration assignments.
• NativeNpmrcIndex - Parses bounded npm configuration assignments without interpolation.
• NativeNpmrcProperty - Represents one bounded npm configuration assignment.
• NativeYamlContainerFrame - Tracks one YAML mapping or sequence while consuming parser events.
• NativeYamlIndex - Indexes YAML mappings through the low-level event API without alias expansion.
• NativeYamlMapping - Represents one YAML mapping in the event index.
• NativeYamlScalarValue - Represents one scalar mapping value and its UTF-8 source span.
• RequiredFinding - Represents supporting evidence that satisfied a composite rule requirement.
• ScanRequest - Describes a byte-buffer scan request.
• SecretRandomnessAssessment - Represents a deterministic estimate that secret material resembles a uniformly generated token.
• SecretRandomnessFeatures - Describes the non-secret statistical features used by the Picket randomness model.
• SecretRandomnessFindingProcessor - Attaches native randomness assessments and applies explicit per-rule score thresholds.
• SecretRandomnessScorer - Scores whether byte-oriented secret material resembles a uniformly generated token.
• SecretScanner - Byte-oriented secret scanner.
• ShannonEntropy - Computes Shannon entropy over byte data.
• SourcePosition - Represents a Gitleaks-compatible source line and column.
• StableFindingFingerprint - Creates stable Picket-native finding fingerprints.
• Utf8OffsetTracker - Converts monotonically increasing UTF-16 indices to UTF-8 byte offsets without a per-character map.

CompiledRuleSet

Picket.Engine.CompiledRuleSet

Represents a rule set with precompiled Scout regexes and keyword prefilters.

Constructors

• CompiledRuleSet(RuleSet rules) - Represents a rule set with precompiled Scout regexes and keyword prefilters.

Methods

• Compile(RuleSet rules) - Compiles a source rule set.
• IsGlobalPathAllowed(string path) - Returns a value indicating whether a global Gitleaks path allowlist matches the supplied path.

Properties

• Fingerprint - Gets a stable fingerprint for the rules, allowlists, and rule compilation inputs.
• Rules - Gets the source rules in deterministic evaluation order.
• UsesPathSensitiveMatching - Gets a value indicating whether rule evaluation can depend on the logical source path.

Finding

Picket.Engine.Finding

Represents a detected secret finding using the Gitleaks-compatible field model.

Constructors

Finding(...)

Finding(
    string ruleID,
    string description,
    int startLine,
    int endLine,
    int startColumn,
    int endColumn,
    string match,
    string secret,
    string file,
    string symlinkFile,
    string commit,
    double entropy,
    string author,
    string email,
    string date,
    string message,
    IReadOnlyList<string> tags,
    string fingerprint,
    string line,
    string link,
    string secretSha256,
    string matchSha256,
    string validationState,
    string blobSha256,
    IReadOnlyList<string> decodePath,
    SecretRandomnessAssessment randomness,
    FindingPositionKind positionKind,
    IReadOnlyList<RequiredFinding> requiredFindings
)

Represents a detected secret finding using the Gitleaks-compatible field model.

Properties

• Author - Gets the git author, or an empty string.
• BlobSha256 - Gets the source blob SHA-256 hash for native reports, or an empty string.
• Commit - Gets the git commit SHA, or an empty string.
• Date - Gets the git commit date, or an empty string.
• DecodePath - Gets the decode operations that exposed the finding.
• Description - Gets the rule description.
• Email - Gets the git author email, or an empty string.
• EndColumn - Gets the one-based end column.
• EndLine - Gets the one-based end line.
• Entropy - Gets the Shannon entropy of the secret.
• File - Gets the logical file path.
• Fingerprint - Gets the Gitleaks-compatible fingerprint.
• Line - Gets source-line evidence that contains the match.
• Link - Gets the source control link, or an empty string.
• Match - Gets the full matched text.
• MatchSha256 - Gets the original match SHA-256 hash for native reports, or an empty string.
• Message - Gets the git commit message, or an empty string.
• NativeFingerprint - Gets the stable Picket-native fingerprint captured before evidence redaction, or an empty string.
• PositionKind - Gets the coordinate system used by the finding’s source positions.
• Randomness - Gets the native randomness assessment, or when scoring was not enabled.
• RequiredFindings - Gets the supporting findings that satisfied composite rule requirements.
• RuleID - Gets the rule identifier.
• Secret - Gets the secret text.
• SecretSha256 - Gets the original secret SHA-256 hash for native reports, or an empty string.
• StartColumn - Gets the one-based start column.
• StartLine - Gets the one-based start line.
• SymlinkFile - Gets the symlink path, or an empty string.
• Tags - Gets the rule tags.
• ValidationState - Gets the offline validation state for native reports, or an empty string.

FindingPositionKind

Picket.Engine.FindingPositionKind

Identifies the coordinate system used by a finding’s source positions.

Fields

• GitleaksUtf8BytesInclusive - Uses Gitleaks-compatible UTF-8 byte columns and inclusive end positions.
• UnicodeCodePointsExclusive - Uses Unicode code-point columns and exclusive end positions.

NativeDetectorMatch

Picket.Engine.NativeDetectorMatch

Describes a structured detector match in the current scan-pass input.

Constructors

NativeDetectorMatch(...)

NativeDetectorMatch(
    int,
    int,
    int,
    int,
    string,
    string,
    IReadOnlyList<string>,
    IReadOnlyList<string>
)

Describes a structured detector match in the current scan-pass input.

NativeDetectorScanContext

Picket.Engine.NativeDetectorScanContext

Caches structured parsing products for one scanner pass.

NativeJsonCredentialDetector

Picket.Engine.NativeJsonCredentialDetector

Produces credential spans from a shared streaming JSON index.

NativeJsonIndex

Picket.Engine.NativeJsonIndex

Indexes JSON string properties in one bounded streaming parse.

NativeJsonStringProperty

Picket.Engine.NativeJsonStringProperty

Represents an indexed JSON string property and its source span.

Constructors

• NativeJsonStringProperty(string, string, int, int, int, string[], bool) - Represents an indexed JSON string property and its source span.

NativeKubernetesSecretDetector

Picket.Engine.NativeKubernetesSecretDetector

Produces credential spans from Kubernetes Secret YAML resources.

NativeNpmCredentialDetector

Picket.Engine.NativeNpmCredentialDetector

Produces credential spans from parsed npm configuration assignments.

NativeNpmrcIndex

Picket.Engine.NativeNpmrcIndex

Parses bounded npm configuration assignments without interpolation.

NativeNpmrcProperty

Picket.Engine.NativeNpmrcProperty

Represents one bounded npm configuration assignment.

Constructors

• NativeNpmrcProperty(string, string, string, int, int) - Represents one bounded npm configuration assignment.

NativeYamlContainerFrame

Picket.Engine.NativeYamlContainerFrame

Tracks one YAML mapping or sequence while consuming parser events.

Constructors

• NativeYamlContainerFrame(bool, int, int, string) - Tracks one YAML mapping or sequence while consuming parser events.

NativeYamlIndex

Picket.Engine.NativeYamlIndex

Indexes YAML mappings through the low-level event API without alias expansion.

NativeYamlMapping

Picket.Engine.NativeYamlMapping

Represents one YAML mapping in the event index.

Constructors

• NativeYamlMapping(int, int, string) - Represents one YAML mapping in the event index.

NativeYamlScalarValue

Picket.Engine.NativeYamlScalarValue

Represents one scalar mapping value and its UTF-8 source span.

Constructors

• NativeYamlScalarValue(string, string, int, int, bool) - Represents one scalar mapping value and its UTF-8 source span.

RequiredFinding

Picket.Engine.RequiredFinding

Represents supporting evidence that satisfied a composite rule requirement.

Constructors

• RequiredFinding(string ruleID, int startLine, string secret) - Represents supporting evidence that satisfied a composite rule requirement.

Properties

• RuleID - Gets the supporting rule identifier.
• Secret - Gets the supporting secret text.
• StartLine - Gets the one-based source line.

ScanRequest

Picket.Engine.ScanRequest

Describes a byte-buffer scan request.

Constructors

ScanRequest(...)

ScanRequest(
    ReadOnlyMemory<byte> input,
    string fileName,
    CompiledRuleSet ruleSet,
    bool ignoreGitleaksAllow,
    string commit,
    int maxDecodeDepth,
    long? maxTargetBytes,
    string symlinkFile,
    bool enableCSharpStringConcatenation,
    bool useGitleaksMaxTargetSemantics,
    Func<bool> isCancellationRequested,
    CancellationToken cancellationToken
)

Describes a byte-buffer scan request.

ScanRequest(...)

ScanRequest(
    ReadOnlyMemory<byte> input,
    string fileName,
    RuleSet ruleSet,
    bool ignoreGitleaksAllow,
    string commit,
    int maxDecodeDepth,
    long? maxTargetBytes,
    string symlinkFile,
    bool enableCSharpStringConcatenation,
    bool useGitleaksMaxTargetSemantics,
    Func<bool> isCancellationRequested,
    CancellationToken cancellationToken
)

Initializes a new scan request and compiles the supplied source rules.

Properties

• BlobSha256 - Gets a precomputed SHA-256 identity for the complete source blob, or an empty string to hash the request input.
• CancellationToken - Gets the cancellation token that stops scanning when cancellation is requested.
• Commit - Gets the git commit SHA used for commit allowlists and fingerprints, or an empty string.
• EnableCSharpStringConcatenation - Gets a value indicating whether native scans evaluate deterministic C# string-literal concatenations as derived input.
• EnableNativeDetectors - Gets a value indicating whether rules may execute built-in native structured detectors.
• EnableRandomnessScoring - Gets a value indicating whether native scans calculate and apply deterministic randomness scores.
• FileName - Gets the logical file name used in reports and fingerprints, or an empty string for stdin compatibility.
• IgnoreGitleaksAllow - Gets a value indicating whether inline gitleaks:allow suppression comments are ignored.
• Input - Gets the input bytes to scan.
• IsCancellationRequested - Gets an optional predicate that stops scanning when it returns .
• MaxDecodeDepth - Gets the maximum recursive decode depth.
• MaxTargetBytes - Gets the maximum content size to scan with content rules, or for no cap.
• PositionKind - Gets the coordinate system used by findings produced by this request.
• RuleSet - Gets the compiled rules used for detection.
• SourceStartColumn - Gets the one-based source column represented by the first input byte.
• SourceStartLine - Gets the one-based source line represented by the first input byte.
• SymlinkFile - Gets the symlink path used in reports, or an empty string.
• UseGitleaksMaxTargetSemantics - Gets a value indicating whether the target-size limit uses Gitleaks’ integer decimal-megabyte comparison.

SecretRandomnessAssessment

Picket.Engine.SecretRandomnessAssessment

Represents a deterministic estimate that secret material resembles a uniformly generated token.

Methods

Create(...)

Create(
    string model,
    double score,
    string classification,
    SecretRandomnessFeatures features,
    IReadOnlyList<string> signals
)

Creates an assessment from persisted non-secret model output.

Properties

• Classification - Gets the threshold-derived classification.
• Features - Gets the non-secret statistical features used by the model.
• Model - Gets the stable model identifier.
• Score - Gets the deterministic model score from zero through one.
• Signals - Gets the stable signal identifiers that explain material score contributions.

SecretRandomnessFeatures

Picket.Engine.SecretRandomnessFeatures

Describes the non-secret statistical features used by the Picket randomness model.

Methods

Create(...)

Create(
    int sampleOffset,
    int sampleLength,
    string alphabet,
    double lengthScore,
    double normalizedEntropy,
    double expectedDistinctRatio,
    double transitionDiversity,
    double longestRunRatio,
    double sequentialPairRatio,
    double repeatedPatternRatio,
    double commonBigramRatio,
    double characterClassBalance,
    double encodedTextSignal,
    double placeholderSignal
)

Creates a feature vector from persisted non-secret metrics.

Properties

• Alphabet - Gets the inferred alphabet name.
• CharacterClassBalance - Gets the observed character-class balance relative to the inferred uniform alphabet.
• CommonBigramRatio - Gets the ratio of adjacent ASCII pairs that are common in source identifiers and English text.
• EncodedTextSignal - Gets the bounded signal that the sample is Base64-encoded printable text.
• ExpectedDistinctRatio - Gets the observed distinct-byte count divided by its expectation under a uniform source.
• LengthScore - Gets the logarithmically normalized sample-length feature.
• LongestRunRatio - Gets the longest identical-byte run divided by the sample length.
• NormalizedEntropy - Gets the Shannon entropy normalized for the inferred alphabet and sample length.
• PlaceholderSignal - Gets a value indicating whether the sample contains a known placeholder marker.
• RepeatedPatternRatio - Gets the strongest short-period repetition ratio.
• SampleLength - Gets the sampled byte count.
• SampleOffset - Gets the zero-based byte offset of the token-like sample within the secret.
• SequentialPairRatio - Gets the ratio of adjacent ASCII letter or digit pairs that form ascending or descending sequences.
• TransitionDiversity - Gets the ratio of distinct adjacent byte pairs.

SecretRandomnessFindingProcessor

Picket.Engine.SecretRandomnessFindingProcessor

Attaches native randomness assessments and applies explicit per-rule score thresholds.

Methods

• Apply(IReadOnlyList<Finding> findings, CompiledRuleSet rules) - Enriches findings with deterministic randomness metadata and removes findings below an explicit rule threshold.

SecretRandomnessScorer

Picket.Engine.SecretRandomnessScorer

Scores whether byte-oriented secret material resembles a uniformly generated token.

Methods

• Assess(ReadOnlySpan<byte> value) - Assesses byte-oriented secret material.
• Assess(string value) - Assesses UTF-16 secret text after deterministic UTF-8 encoding.
• ExtractFeatures(ReadOnlySpan<byte> value) - Extracts the non-secret feature vector used by the randomness model.

Fields

• LikelyRandomThreshold - Gets the inclusive score threshold classified as likely random.
• LikelyStructuredThreshold - Gets the inclusive score threshold classified as likely structured.
• ModelVersion - Identifies the coefficients, feature definitions, and calibration corpus used by this model.

SecretScanner

Picket.Engine.SecretScanner

Byte-oriented secret scanner.

Methods

• Scan(ScanRequest) - Scans a byte buffer and returns findings in rule evaluation order.

Fields

• MatchingBehaviorVersion - Gets the stable version of matching behavior that participates in cache and checkpoint identities.

ShannonEntropy

Picket.Engine.ShannonEntropy

Computes Shannon entropy over byte data.

Methods

• Calculate(ReadOnlySpan<byte>) - Calculates Shannon entropy for a byte span.

SourcePosition

Picket.Engine.SourcePosition

Represents a Gitleaks-compatible source line and column.

Constructors

• SourcePosition(int line, int column) - Represents a Gitleaks-compatible source line and column.

Methods

• Equals(SourcePosition other) - Returns a value indicating whether this position equals another position.
• Equals(object)
• FromOffset(ReadOnlySpan<byte> input, int offset) - Maps a zero-based byte offset to a Gitleaks-compatible line and column.
• GetHashCode()
• operator !=(SourcePosition left, SourcePosition right) - Returns a value indicating whether two positions differ.
• operator ==(SourcePosition left, SourcePosition right) - Returns a value indicating whether two positions are equal.

Properties

• Column - Gets the one-based column.
• Line - Gets the one-based line.

StableFindingFingerprint

Picket.Engine.StableFindingFingerprint

Creates stable Picket-native finding fingerprints.

Methods

• Create(Finding finding) - Creates a versioned stable fingerprint for a finding.

Utf8OffsetTracker

Picket.Engine.Utf8OffsetTracker

Converts monotonically increasing UTF-16 indices to UTF-8 byte offsets without a per-character map.

Constructors

• Utf8OffsetTracker(string) - Converts monotonically increasing UTF-16 indices to UTF-8 byte offsets without a per-character map.