Picket.Rules API

Generated from XML documentation for Picket.Rules.

Types

• AllowlistCondition - Describes how checks inside a secret allowlist are combined.
• AllowlistRegexTarget - Describes the finding field tested by allowlist regexes.
• PicketBuiltInDetectorNames - Defines the stable names of Picket’s built-in structured detectors.
• PicketRulePackNames - Provides stable identifiers for the built-in Picket rule packs.
• RuleSet - Immutable collection of secret detection rules.
• SecretAllowlist - Describes Gitleaks-compatible allowlist checks for suppressing findings.
• SecretRequiredRule - Describes a Gitleaks-compatible supporting rule required by a primary rule.
• SecretRule - Describes a byte-oriented secret detection rule.

AllowlistCondition

Picket.Rules.AllowlistCondition

Describes how checks inside a secret allowlist are combined.

Fields

• And - Allows a finding only when every configured check matches.
• Or - Allows a finding when any configured check matches.

AllowlistRegexTarget

Picket.Rules.AllowlistRegexTarget

Describes the finding field tested by allowlist regexes.

Fields

• Line - Tests the full source line containing the finding.
• Match - Tests the full regex match.
• Secret - Tests the captured secret value.

PicketBuiltInDetectorNames

Picket.Rules.PicketBuiltInDetectorNames

Defines the stable names of Picket’s built-in structured detectors.

Methods

• IsKnown(string name) - Returns whether a name identifies a built-in detector.

Fields

• CodexCredentials - Gets the detector for Codex credential JSON documents.
• DockerRegistryCredentials - Gets the detector for Docker registry credential JSON documents.
• GcpServiceAccountKey - Gets the detector for GCP service-account key JSON documents.
• JwkPrivateKey - Gets the detector for private JSON Web Keys.
• KubernetesSecret - Gets the detector for Kubernetes Secret YAML documents.
• McpServerCredentials - Gets the detector for credentials in Model Context Protocol server configurations.
• NpmCredentials - Gets the detector for npm configuration credentials.

PicketRulePackNames

Picket.Rules.PicketRulePackNames

Provides stable identifiers for the built-in Picket rule packs.

Fields

• Default - Identifies Picket’s high-confidence native default rule pack.
• Experimental - Identifies Picket’s opt-in rule pack for detectors that are still being tuned.
• Gitleaks - Identifies the pinned Gitleaks-compatible rule pack.
• Strict - Identifies Picket’s opt-in rule pack for broader, more aggressive detection.

RuleSet

Picket.Rules.RuleSet

Immutable collection of secret detection rules.

Constructors

RuleSet(...)

RuleSet(
    IReadOnlyList<SecretRule> rules,
    IReadOnlyList<SecretAllowlist> allowlists,
    bool regexesPrevalidated
)

Immutable collection of secret detection rules.

Properties

• Allowlists - Gets global allowlists used to suppress findings.
• RegexesPrevalidated - Gets a value indicating whether rule and allowlist regexes are already validated and can be compiled lazily.
• Rules - Gets the rules in deterministic evaluation order.

Fields

• MaxRuleCount - Gets the maximum number of rules accepted in a single rule set.

SecretAllowlist

Picket.Rules.SecretAllowlist

Describes Gitleaks-compatible allowlist checks for suppressing findings.

Constructors

SecretAllowlist(...)

SecretAllowlist(
    string description,
    AllowlistCondition condition,
    IReadOnlyList<string> commits,
    IReadOnlyList<string> pathPatterns,
    AllowlistRegexTarget regexTarget,
    IReadOnlyList<string> regexPatterns,
    IReadOnlyList<string> stopWords
)

Describes Gitleaks-compatible allowlist checks for suppressing findings.

Methods

Create(...)

Create(
    string description,
    AllowlistCondition condition,
    IReadOnlyList<string> commits,
    IReadOnlyList<string> pathPatterns,
    AllowlistRegexTarget regexTarget,
    IReadOnlyList<string> regexPatterns,
    IReadOnlyList<string> stopWords
)

Creates an allowlist and validates that it has at least one check.

Properties

• Commits - Gets commit SHA values that are allowed.
• Condition - Gets the condition used to combine configured checks.
• Description - Gets the human-readable allowlist description.
• PathPatterns - Gets path regex patterns that are allowed.
• RegexPatterns - Gets content regex patterns that are allowed.
• RegexTarget - Gets the finding field tested by regex patterns.
• StopWords - Gets case-insensitive stopwords matched against the secret.

SecretRequiredRule

Picket.Rules.SecretRequiredRule

Describes a Gitleaks-compatible supporting rule required by a primary rule.

Constructors

• SecretRequiredRule(string id, int? withinLines, int? withinColumns) - Describes a Gitleaks-compatible supporting rule required by a primary rule.

Properties

• Id - Gets the required rule identifier.
• WithinColumns - Gets the maximum column distance from the primary finding, or for no column constraint.
• WithinLines - Gets the maximum line distance from the primary finding, or for no line constraint.

SecretRule

Picket.Rules.SecretRule

Describes a byte-oriented secret detection rule.

Constructors

SecretRule(...)

SecretRule(
    string id,
    string description,
    string pattern,
    int secretGroup,
    double entropy,
    string pathPattern,
    IReadOnlyList<SecretAllowlist> allowlists,
    IReadOnlyList<string> keywords,
    IReadOnlyList<string> tags,
    bool skipReport,
    IReadOnlyList<SecretRequiredRule> requiredRules,
    string severity,
    string confidence,
    string rulePack,
    string provider,
    string documentationUrl,
    IReadOnlyList<string> validation,
    IReadOnlyList<string> revocation,
    bool deprecated,
    IReadOnlyList<string> examples,
    IReadOnlyList<string> negativeExamples,
    double randomnessThreshold,
    string detector
)

Describes a byte-oriented secret detection rule.

Methods

Create(...)

Create(
    string id,
    string description,
    string pattern,
    int secretGroup,
    double entropy,
    string pathPattern,
    IReadOnlyList<SecretAllowlist> allowlists,
    IReadOnlyList<string> keywords,
    IReadOnlyList<string> tags,
    bool skipReport,
    IReadOnlyList<SecretRequiredRule> requiredRules,
    string severity,
    string confidence,
    string rulePack,
    string provider,
    string documentationUrl,
    IReadOnlyList<string> validation,
    IReadOnlyList<string> revocation,
    bool deprecated,
    IReadOnlyList<string> examples,
    IReadOnlyList<string> negativeExamples,
    double randomnessThreshold,
    string detector
)

Creates a rule and normalizes optional collection arguments.

Properties

• Allowlists - Gets per-rule allowlists used to suppress findings.
• Confidence - Gets the native confidence value for reports and triage.
• Deprecated - Gets a value indicating whether the rule is deprecated.
• Description - Gets the user-facing rule description.
• Detector - Gets the optional built-in structured detector name.
• DocumentationUrl - Gets the rule documentation or remediation URL.
• Entropy - Gets the minimum Shannon entropy required for the secret. Zero disables entropy filtering.
• Examples - Gets positive examples that must produce findings for this rule during rule QA.
• Id - Gets the stable rule identifier.
• Keywords - Gets case-insensitive keywords used for candidate prefiltering.
• NegativeExamples - Gets negative examples that must not produce findings for this rule during rule QA.
• PathPattern - Gets the optional path regex pattern in the compatibility dialect.
• Pattern - Gets the content regex pattern in the compatibility dialect. Empty means path-only.
• Provider - Gets the owning provider or credential family.
• RandomnessThreshold - Gets the minimum native randomness score required for a finding. Zero disables score filtering.
• RequiredRules - Gets supporting rules required before a primary finding is reported.
• Revocation - Gets stable revocation template identifiers supported by the rule.
• RulePack - Gets the native rule pack that supplied the rule.
• SecretGroup - Gets the capture group that contains the secret. Zero means the whole match.
• Severity - Gets the native severity value for reports and triage.
• SkipReport - Gets a value indicating whether normal findings for this rule are suppressed.
• Tags - Gets rule classification tags.
• Validation - Gets stable validation template identifiers supported by the rule.