CLI Reference
Use Picket commands to scan code, verify and analyze findings, manage rule packs, maintain caches, install hooks, and run Gitleaks-compatible workflows.
Commands
Section titled “Commands”Use the grouped index to jump to the workflow you need.
Scan and triage
Credential revocation
Reports and baselines
Rules
Maintenance
-
picket cache statsSummarize native scan cache entries. -
picket cache pruneDelete native scan cache entries. -
picket cache exportWrite active native scan cache entries to a portable archive. -
picket cache importRestore active native scan cache entries from a portable archive. -
picket hooks installInstall managed pre-commit, pre-push, or pre-receive scanning hooks.
Compatibility
Command Reference
Section titled “Command Reference”picket scan
Section titled “picket scan”picket scan
Scan and triage
- Input
- Optional filesystem path
- Reports
- json, jsonl, csv, junit, html, gitlab, sarif, toon
Native filesystem and source-host scan.
Usage
picket scan [<path>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
path |
Optional | Filesystem path to scan. Defaults to the current directory when omitted. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
-b, --baseline-path |
path |
Optional | Load a baseline report and suppress matching findings. |
--baseline-mode |
exact | portable |
Optional | Compare baseline findings exactly or treat LF and CRLF evidence as equivalent. Requires a native command or --profile picket. |
-c, --config |
path |
Optional | Load a config file. |
-f, --report-format |
json | jsonl | csv | junit | html | gitlab | sarif | toon |
Optional | Select report format. |
-r, --report-path |
path |
Optional | Write a report to this path. |
--profile |
profile |
Optional | Use the named rule/profile mode. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--source |
path |
Optional | Override the source label stored in findings and fingerprints. |
--ignore-path |
path |
Optional | Load additional patterns from an ignore file. The value is a file path, not a glob. |
--no-ignore |
flag |
Optional | Do not apply ignore files. |
--cache-dir |
path |
Optional | Read or write scanner cache data in this directory. |
--cache-mode |
mode |
Optional | Choose whether scan cache entries store raw evidence or secret and match hashes only. |
--checkpoint |
path |
Optional | Persist encrypted native source-scan progress here and resume it when the source snapshot still matches. |
--checkpoint-reset |
flag |
Optional | Discard existing checkpoint state before starting the native source scan. |
--enable-rule |
id |
Optional | Enable an additional rule by ID. |
--verify |
flag |
Optional | Run opt-in live provider verification for supported findings. |
--github-api-endpoint |
uri |
Optional | Override the GitHub API endpoint used by live validation and GitHub source enumeration when no source endpoint is supplied. |
--github-api-proxy |
uri |
Optional | Use this HTTPS proxy for live GitHub API requests. |
--live-tls-mode |
mode |
Optional | Choose the TLS policy for live provider requests. |
--live-rate-limit-ms |
n |
Optional | Set the minimum milliseconds between live provider requests across all providers. Use 0 to disable. |
--live-provider-rate-limit-ms |
n |
Optional | Set the minimum milliseconds between live requests to the same provider. Use 0 to disable. |
--allow-non-public-endpoints |
flag |
Optional | Allow guarded live validation endpoints that are not public internet addresses. |
--github-repository |
owner/name |
Optional | Scan this GitHub repository through native source enumeration. |
--github-organization |
org |
Optional | Scan repositories visible in this GitHub organization through native source enumeration. |
--github-user |
login |
Optional | Scan public repositories for this GitHub user through native source enumeration. |
--github-repository-type |
value |
Optional | Filter organization or user repository listings by GitHub type. |
--github-gist |
id |
Optional | Scan a single GitHub gist by ID. |
--github-gists |
flag |
Optional | Scan the authenticated user's GitHub gists. |
--github-user-gists |
login |
Optional | Scan public GitHub gists for this user. |
--github-token-env |
name |
Optional | Read the GitHub source enumeration token from this environment variable. |
--github-ref |
ref |
Optional | Scan this GitHub branch, tag, or commit. |
--github-pull-request |
id |
Optional | Scan this GitHub pull request head. |
--github-include-issues |
flag |
Optional | Include GitHub issue bodies and comments in native source enumeration. |
--github-issue-state |
state |
Optional | Filter GitHub issues by state. |
--github-include-releases |
flag |
Optional | Include GitHub release bodies and release assets in native source enumeration. |
--github-include-actions-artifacts |
flag |
Optional | Include GitHub Actions artifact ZIP contents in native source enumeration. |
--github-source-api-endpoint |
uri |
Optional | Use this GitHub API endpoint for native source enumeration. |
--gitea-repository |
owner/name |
Optional | Scan this Gitea repository through native source enumeration. |
--gitea-organization |
org |
Optional | Scan repositories in this Gitea organization. |
--gitea-user |
login |
Optional | Scan repositories owned by this Gitea user. |
--gitea-ref |
ref |
Optional | Scan this Gitea branch, tag, or commit. |
--gitea-pull-request |
id |
Optional | Scan this Gitea pull request source head. |
--gitea-include-issues |
flag |
Optional | Include Gitea issue bodies and comments in native source enumeration. |
--gitea-issue-state |
open | closed | all |
Optional | Filter Gitea issues by state. |
--gitea-include-releases |
flag |
Optional | Include Gitea release notes and assets in native source enumeration. |
--gitea-include-actions-artifacts |
flag |
Optional | Include Gitea Actions artifact ZIP contents in native source enumeration. |
--gitea-actions-run-id |
id |
Optional | Limit Gitea Actions artifact scanning to this run ID. |
--gitea-generic-package-owner |
owner |
Optional | Scan Gitea generic package files owned by this user or organization. |
--gitea-generic-package-name |
name |
Optional | Limit Gitea generic package scanning to this package name. |
--gitea-generic-package-version |
version |
Optional | Limit Gitea generic package scanning to this package version. |
--gitea-generic-package-file |
file |
Optional | Limit Gitea generic package scanning to this file. |
--gitea-token-env |
name |
Optional | Read the Gitea source enumeration token from this environment variable. |
--gitea-api-endpoint |
uri |
Optional | Use this Gitea API endpoint for native source enumeration. |
--gitlab-project |
path |
Optional | Scan this GitLab project path or numeric project ID through native source enumeration. |
--gitlab-group |
path |
Optional | Scan projects in this GitLab group through native source enumeration. |
--gitlab-ref |
ref |
Optional | Scan this GitLab branch, tag, or commit. |
--gitlab-merge-request |
id |
Optional | Scan this GitLab merge request source head. |
--gitlab-pipeline-id |
id |
Optional | Limit GitLab job log and artifact enumeration to this pipeline ID. |
--gitlab-include-subgroups |
flag |
Optional | Include projects from GitLab subgroups when scanning a group. |
--gitlab-include-snippets |
flag |
Optional | Include GitLab project snippets in native source enumeration. |
--gitlab-include-job-artifacts |
flag |
Optional | Include GitLab job artifact archives in native source enumeration. |
--gitlab-include-job-logs |
flag |
Optional | Include GitLab job trace logs in native source enumeration. |
--gitlab-include-packages |
flag |
Optional | Include GitLab generic package files in native source enumeration. |
--gitlab-token-env |
name |
Optional | Read the GitLab source enumeration token from this environment variable. |
--gitlab-api-endpoint |
uri |
Optional | Use this GitLab API endpoint for native source enumeration. |
--bitbucket-repository |
workspace/repo |
Optional | Scan this Bitbucket repository through native source enumeration. |
--bitbucket-workspace |
workspace |
Optional | Scan repositories in this Bitbucket workspace through native source enumeration. |
--bitbucket-project |
key |
Optional | Limit Bitbucket workspace repository scans to this project key. |
--bitbucket-ref |
ref |
Optional | Scan this Bitbucket branch, tag, or commit. |
--bitbucket-pull-request |
id |
Optional | Scan this Bitbucket pull request source head. |
--bitbucket-include-downloads |
flag |
Optional | Scan Bitbucket repository download artifacts. |
--bitbucket-pipeline-id |
id |
Optional | Limit Bitbucket pipeline log enumeration to this pipeline ID. |
--bitbucket-include-pipeline-logs |
flag |
Optional | Scan Bitbucket pipeline step logs for the selected pipeline. |
--bitbucket-include-snippets |
flag |
Optional | Scan Bitbucket workspace snippet files. |
--bitbucket-token-env |
name |
Optional | Read the Bitbucket source enumeration token or app password from this environment variable. |
--bitbucket-username-env |
name |
Optional | Read the Bitbucket username for app-password authentication from this environment variable. |
--bitbucket-token-kind |
kind |
Optional | Choose bearer-token authentication or app-password basic authentication for Bitbucket requests. |
--bitbucket-api-endpoint |
uri |
Optional | Use this Bitbucket Cloud API endpoint for native source enumeration. |
--bitbucket-data-center-api-endpoint |
uri |
Optional | Use this Bitbucket Data Center REST API endpoint, including its rest/api/1.0 path. |
--bitbucket-data-center-project |
key |
Optional | Scan repositories readable in this Bitbucket Data Center project. |
--bitbucket-data-center-repository |
slug |
Optional | Limit Bitbucket Data Center enumeration to this repository slug. |
--bitbucket-data-center-ref |
ref |
Optional | Scan this Bitbucket Data Center branch, tag, or commit. |
--bitbucket-data-center-pull-request |
id |
Optional | Scan this Bitbucket Data Center pull request source head; requires a repository. |
--bitbucket-data-center-token-env |
name |
Optional | Read the Bitbucket Data Center HTTP access token or Basic credential from this environment variable. |
--bitbucket-data-center-token-kind |
kind |
Optional | Choose bearer-token or Basic authentication for Bitbucket Data Center requests. |
--bitbucket-data-center-username-env |
name |
Optional | Read the Bitbucket Data Center username used for Basic authentication from this environment variable. |
--azure-blob-endpoint |
uri |
Optional | Use this Azure Blob Storage service endpoint for native object-store enumeration. |
--azure-blob-container |
name |
Optional | Scan blobs from this Azure Blob Storage container. |
--azure-blob-prefix |
prefix |
Optional | Limit Azure Blob Storage enumeration to blob names with this prefix. |
--azure-blob-token-env |
name |
Optional | Read the Azure Blob bearer token or shared access signature from this environment variable. |
--azure-blob-token-kind |
kind |
Optional | Choose bearer-token authentication or shared access signature query authentication for Azure Blob Storage requests. |
--gcs-bucket |
name |
Optional | Scan objects from this Google Cloud Storage bucket. |
--gcs-endpoint |
uri |
Optional | Use this Google Cloud Storage JSON API endpoint for native object-store enumeration. |
--gcs-prefix |
prefix |
Optional | Limit Google Cloud Storage enumeration to object names with this prefix. |
--gcs-token-env |
name |
Optional | Read the Google Cloud Storage OAuth bearer token from this environment variable. |
--gcs-user-project |
project |
Optional | Set the requester-pays billing project for Google Cloud Storage requests. |
--s3-bucket |
name |
Optional | Scan objects from this S3 bucket. |
--s3-region |
region |
Optional | Use this AWS region for S3 SigV4 request signing. |
--s3-endpoint |
uri |
Optional | Use this S3 or S3-compatible endpoint for native object-store enumeration. |
--s3-prefix |
prefix |
Optional | Limit S3 enumeration to object keys with this prefix. |
--s3-access-key-id-env |
name |
Optional | Read the S3 access key ID from this environment variable. |
--s3-secret-access-key-env |
name |
Optional | Read the S3 secret access key from this environment variable. |
--s3-session-token-env |
name |
Optional | Read the optional S3 session token from this environment variable. |
--azure-devops-organization |
org |
Optional | Use this Azure DevOps Services organization for native source enumeration. |
--azure-devops-endpoint |
uri |
Optional | Use this Azure DevOps Server or organization endpoint for native source enumeration. |
--azure-devops-token-env |
name |
Optional | Read the Azure DevOps PAT or bearer token from this environment variable. |
--azure-devops-token-kind |
kind |
Optional | Choose PAT basic authentication or bearer-token authentication for Azure DevOps requests. |
--azure-devops-project |
name |
Optional | Limit Azure DevOps source enumeration to this project. |
--azure-devops-repository |
name |
Optional | Limit Azure DevOps source enumeration to this repository. |
--azure-devops-branch |
name |
Optional | Scan this Azure Repos branch. |
--azure-devops-pull-request |
id |
Optional | Scan this Azure Repos pull request source head. |
--azure-devops-include-wikis |
flag |
Optional | Include Azure DevOps wiki backing repositories in native source enumeration. |
--azure-devops-build-id |
id |
Optional | Scan artifacts or logs from this Azure Pipelines build ID. |
--azure-devops-include-artifacts |
flag |
Optional | Include Azure Pipelines build artifact contents in native source enumeration. |
--azure-devops-include-logs |
flag |
Optional | Include Azure Pipelines build logs in native source enumeration. |
--azure-devops-release-id |
id |
Optional | Scan build artifacts referenced by this classic Azure DevOps release ID. |
--azure-devops-include-release-artifacts |
flag |
Optional | Include classic Azure DevOps release build artifact contents in native source enumeration. |
--azure-devops-include-packages |
flag |
Optional | Include the latest Azure Artifacts NuGet package versions in native source enumeration. |
--azure-devops-feed |
name-or-id |
Optional | Limit Azure Artifacts package scanning to one feed name or ID. |
--azure-devops-package |
name |
Optional | Limit Azure Artifacts package scanning to one exact NuGet package name. |
--azure-devops-package-version |
version |
Optional | Scan one exact Azure Artifacts NuGet package version; requires --azure-devops-package. |
--azure-devops-max-artifact-megabytes |
n |
Optional | Limit each Azure Pipelines artifact archive download in decimal megabytes; 0 disables the artifact-specific cap. |
--azure-devops-max-log-megabytes |
n |
Optional | Limit each Azure Pipelines log download in decimal megabytes; 0 disables the log-specific cap. |
--azure-devops-max-package-megabytes |
n |
Optional | Set the positive Azure Artifacts package download cap in decimal megabytes; requires package scanning. |
--allow-non-public-source-endpoints |
flag |
Optional | Allow source-host endpoints that resolve to private, loopback, link-local, or otherwise non-public addresses. |
--allow-insecure-source-endpoints |
flag |
Optional | Allow HTTP source-host endpoints for trusted local tests or explicitly accepted self-hosted environments; source credentials may be sent in cleartext. |
--registry-image |
image |
Optional | Scan this OCI or Docker registry image reference, including Docker Hub shorthand. |
--registry-endpoint |
uri |
Optional | Override the OCI Distribution API endpoint derived from the image reference. |
--registry-auth-endpoint |
uri |
Optional | Use this explicitly trusted cross-host bearer-token service instead of the registry challenge realm. |
--registry-token-env |
name |
Optional | Read a pre-issued registry bearer token from this environment variable. |
--registry-username-env |
name |
Optional | Read the registry username for basic authentication from this environment variable. |
--registry-password-env |
name |
Optional | Read the registry password or personal access token for basic authentication from this environment variable. |
--registry-platform |
os/architecture[/variant] |
Optional | Scan only this os/architecture[/variant] image from a multi-platform index; all platforms are scanned when omitted. |
--registry-max-image-megabytes |
n |
Optional | Limit aggregate unique manifest, config, and layer downloads for the image in decimal megabytes. |
--docker-archive |
path |
Optional | Scan a local Docker image archive produced by docker save. |
--oci-archive |
path |
Optional | Scan a local OCI image-layout archive. |
--results |
value |
Optional | Keep findings with the selected validation result states. |
--only-verified |
flag |
Optional | Keep structurally-valid offline findings and active live-verification findings. |
--exit-code |
n |
Optional | Exit with this code when findings are present. |
-i, --gitleaks-ignore-path |
path |
Optional | Load a Gitleaks ignore file. |
--ignore-gitleaks-allow |
flag |
Optional | Do not honor gitleaks:allow comments. |
--follow-symlinks |
flag |
Optional | Follow symlinks while scanning directories. |
--report-template |
path |
Optional | Render template reports with this template file. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--max-decode-depth |
n |
Optional | Limit recursive decoding passes. |
--max-archive-depth |
n |
Optional | Limit nested archive traversal depth. |
--max-archive-entries |
n |
Optional | Limit files extracted from each archive. |
--max-archive-megabytes |
n |
Optional | Limit uncompressed archive size. |
--max-archive-ratio |
n |
Optional | Limit archive expansion ratio. |
--timeout |
n |
Optional | Stop scanning after this many seconds. Use 0 to disable. |
--diagnostics |
mode[,mode] |
Optional | Write structured diagnostics for the selected modes. |
--diagnostics-dir |
path |
Optional | Write diagnostics artifacts to this directory. |
--redact |
n |
Optional | Redact secret text in reports. n is the percent to hide: 0 shows secrets, 100 writes REDACTED, and 75 keeps about the first 25%. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket verify
Section titled “picket verify”picket verify
Scan and triage
- Input
- Optional report or scan path
- Reports
- json, jsonl, csv, junit, html, gitlab, sarif, toon
- Validation
- Offline or live
Run native verification for detected findings.
Usage
picket verify [<path>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
path |
Optional | Filesystem path to scan. Defaults to the current directory when omitted. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
-b, --baseline-path |
path |
Optional | Load a baseline report and suppress matching findings. |
--baseline-mode |
exact | portable |
Optional | Compare baseline findings exactly or treat LF and CRLF evidence as equivalent. Requires a native command or --profile picket. |
-c, --config |
path |
Optional | Load a config file. |
-f, --report-format |
json | jsonl | csv | junit | html | gitlab | sarif | toon |
Optional | Select report format. |
-r, --report-path |
path |
Optional | Write a report to this path. |
--profile |
profile |
Optional | Use the named rule/profile mode. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--source |
path |
Optional | Override the source label stored in findings and fingerprints. |
--cache-dir |
path |
Optional | Read or write scanner cache data in this directory. |
--cache-mode |
mode |
Optional | Choose whether scan cache entries store raw evidence or secret and match hashes only. |
--offline |
flag |
Optional | Run local structural validation without contacting providers. |
--live |
flag |
Optional | Run opt-in live provider verification for supported findings. |
--github-api-endpoint |
uri |
Optional | Override the GitHub API endpoint used by live validation and GitHub source enumeration when no source endpoint is supplied. |
--github-api-proxy |
uri |
Optional | Use this HTTPS proxy for live GitHub API requests. |
--live-tls-mode |
mode |
Optional | Choose the TLS policy for live provider requests. |
--live-rate-limit-ms |
n |
Optional | Set the minimum milliseconds between live provider requests across all providers. Use 0 to disable. |
--live-provider-rate-limit-ms |
n |
Optional | Set the minimum milliseconds between live requests to the same provider. Use 0 to disable. |
--allow-non-public-endpoints |
flag |
Optional | Allow guarded live validation endpoints that are not public internet addresses. |
--results |
value |
Optional | Keep findings with the selected validation result states. |
--only-verified |
flag |
Optional | Keep structurally-valid offline findings and active live-verification findings. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--max-archive-depth |
n |
Optional | Limit nested archive traversal depth. |
--max-archive-entries |
n |
Optional | Limit files extracted from each archive. |
--max-archive-megabytes |
n |
Optional | Limit uncompressed archive size. |
--max-archive-ratio |
n |
Optional | Limit archive expansion ratio. |
--timeout |
n |
Optional | Stop scanning after this many seconds. Use 0 to disable. |
--diagnostics |
mode[,mode] |
Optional | Write structured diagnostics for the selected modes. |
--diagnostics-dir |
path |
Optional | Write diagnostics artifacts to this directory. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket analyze
Section titled “picket analyze”picket analyze
Scan and triage
- Input
- Optional report or scan path
- Reports
- json, jsonl, text
- Validation
- Offline or live
Write incident-response analysis for detected findings.
Usage
picket analyze [<path>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
path |
Optional | Filesystem path to scan. Defaults to the current directory when omitted. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
-b, --baseline-path |
path |
Optional | Load a baseline report and suppress matching findings. |
--baseline-mode |
exact | portable |
Optional | Compare baseline findings exactly or treat LF and CRLF evidence as equivalent. Requires a native command or --profile picket. |
-c, --config |
path |
Optional | Load a config file. |
-f, --report-format |
json | jsonl | text |
Optional | Select report format. |
-r, --report-path |
path |
Optional | Write a report to this path. |
--profile |
profile |
Optional | Use the named rule/profile mode. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--source |
path |
Optional | Override the source label stored in findings and fingerprints. |
--cache-dir |
path |
Optional | Read or write scanner cache data in this directory. |
--cache-mode |
mode |
Optional | Choose whether scan cache entries store raw evidence or secret and match hashes only. |
--offline |
flag |
Optional | Run local structural validation without contacting providers. |
--live |
flag |
Optional | Run opt-in live provider verification for supported findings. |
--github-api-endpoint |
uri |
Optional | Override the GitHub API endpoint used by live validation and GitHub source enumeration when no source endpoint is supplied. |
--github-api-proxy |
uri |
Optional | Use this HTTPS proxy for live GitHub API requests. |
--live-tls-mode |
mode |
Optional | Choose the TLS policy for live provider requests. |
--live-rate-limit-ms |
n |
Optional | Set the minimum milliseconds between live provider requests across all providers. Use 0 to disable. |
--live-provider-rate-limit-ms |
n |
Optional | Set the minimum milliseconds between live requests to the same provider. Use 0 to disable. |
--allow-non-public-endpoints |
flag |
Optional | Allow guarded live validation endpoints that are not public internet addresses. |
--results |
value |
Optional | Keep findings with the selected validation result states. |
--only-verified |
flag |
Optional | Keep structurally-valid offline findings and active live-verification findings. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--max-archive-depth |
n |
Optional | Limit nested archive traversal depth. |
--max-archive-entries |
n |
Optional | Limit files extracted from each archive. |
--max-archive-megabytes |
n |
Optional | Limit uncompressed archive size. |
--max-archive-ratio |
n |
Optional | Limit archive expansion ratio. |
--timeout |
n |
Optional | Stop scanning after this many seconds. Use 0 to disable. |
--diagnostics |
mode[,mode] |
Optional | Write structured diagnostics for the selected modes. |
--diagnostics-dir |
path |
Optional | Write diagnostics artifacts to this directory. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket revoke github
Section titled “picket revoke github”picket revoke github
Credential revocation
- Input
- Required credential environment variable names
Submit exposed GitHub credentials for irreversible revocation.
Usage
picket revoke github [options]Options
| Option | Value | Required | Description |
|---|---|---|---|
--credential-env |
name |
Required, repeatable | Read a credential from this environment variable. Repeat for additional credentials; values never appear in command arguments. |
--confirm-revocation |
flag |
Required | Confirm the irreversible revocation request. |
--github-api-endpoint |
uri |
Optional | Use this full GitHub credential revocation endpoint instead of https://api.github.com/credentials/revoke. |
--github-api-proxy |
uri |
Optional | Use this HTTPS proxy for the GitHub credential revocation request. |
--allow-non-public-endpoints |
flag |
Optional | Allow a guarded GitHub revocation endpoint that resolves to a non-public address. |
--timeout |
seconds |
Optional | Stop waiting for the GitHub revocation response after this many seconds. [default: 10] |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket baseline create
Section titled “picket baseline create”picket baseline create
Reports and baselines
- Input
- Optional filesystem path
Write a Gitleaks-compatible baseline JSON report.
Usage
picket baseline create [<path>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
path |
Optional | Filesystem path to scan. Defaults to the current directory when omitted. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
-c, --config |
path |
Optional | Load a config file. |
-r, --report-path |
path |
Optional | Write a report to this path. |
--source |
path |
Optional | Override the source label stored in findings and fingerprints. |
--ignore-path |
path |
Optional | Load additional patterns from an ignore file. The value is a file path, not a glob. |
--no-ignore |
flag |
Optional | Do not apply ignore files. |
--enable-rule |
id |
Optional | Enable an additional rule by ID. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--max-archive-depth |
n |
Optional | Limit nested archive traversal depth. |
--max-archive-entries |
n |
Optional | Limit files extracted from each archive. |
--max-archive-megabytes |
n |
Optional | Limit uncompressed archive size. |
--max-archive-ratio |
n |
Optional | Limit archive expansion ratio. |
--timeout |
n |
Optional | Stop scanning after this many seconds. Use 0 to disable. |
--diagnostics |
mode[,mode] |
Optional | Write structured diagnostics for the selected modes. |
--diagnostics-dir |
path |
Optional | Write diagnostics artifacts to this directory. |
--redact |
n |
Optional | Redact secret text in reports. n is the percent to hide: 0 shows secrets, 100 writes REDACTED, and 75 keeps about the first 25%. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket cache stats
Section titled “picket cache stats”picket cache stats
Maintenance
- Input
- Optional cache source
Summarize native scan cache entries.
Usage
picket cache stats [<source>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
source |
Optional | Source key or path used for cache and rule operations. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
--cache-dir |
path |
Required | Read or write scanner cache data in this directory. |
-c, --config |
path |
Optional | Load a config file. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--cache-mode |
mode |
Optional | Choose whether scan cache entries store raw evidence or secret and match hashes only. |
--max-decode-depth |
n |
Optional | Limit recursive decoding passes. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--ignore-gitleaks-allow |
flag |
Optional | Do not honor gitleaks:allow comments. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket cache prune
Section titled “picket cache prune”picket cache prune
Maintenance
- Input
- Optional cache source
Delete native scan cache entries.
Usage
picket cache prune [<source>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
source |
Optional | Source key or path used for cache and rule operations. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
--cache-dir |
path |
Required | Read or write scanner cache data in this directory. |
-c, --config |
path |
Optional | Load a config file. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--cache-mode |
mode |
Optional | Choose whether scan cache entries store raw evidence or secret and match hashes only. |
--max-decode-depth |
n |
Optional | Limit recursive decoding passes. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--ignore-gitleaks-allow |
flag |
Optional | Do not honor gitleaks:allow comments. |
--other-keys |
flag |
Optional | Prune cache entries for config or source keys other than the selected key. |
--older-than-days |
n |
Optional | Prune cache entries older than this age. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket cache export
Section titled “picket cache export”picket cache export
Maintenance
- Input
- Optional cache source
Write active native scan cache entries to a portable archive.
Usage
picket cache export [<source>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
source |
Optional | Source key or path used for cache and rule operations. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
--cache-dir |
path |
Required | Read or write scanner cache data in this directory. |
-c, --config |
path |
Optional | Load a config file. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--cache-mode |
mode |
Optional | Choose whether scan cache entries store raw evidence or secret and match hashes only. |
--max-decode-depth |
n |
Optional | Limit recursive decoding passes. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--ignore-gitleaks-allow |
flag |
Optional | Do not honor gitleaks:allow comments. |
--output |
path |
Required | Write a portable cache archive to this path. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket cache import
Section titled “picket cache import”picket cache import
Maintenance
- Input
- Optional cache source
Restore active native scan cache entries from a portable archive.
Usage
picket cache import [<source>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
source |
Optional | Source key or path used for cache and rule operations. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
--cache-dir |
path |
Required | Read or write scanner cache data in this directory. |
-c, --config |
path |
Optional | Load a config file. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--cache-mode |
mode |
Optional | Choose whether scan cache entries store raw evidence or secret and match hashes only. |
--max-decode-depth |
n |
Optional | Limit recursive decoding passes. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--ignore-gitleaks-allow |
flag |
Optional | Do not honor gitleaks:allow comments. |
--input |
path |
Required | Read a portable cache archive from this path. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket git
Section titled “picket git”picket git
Compatibility
- Input
- Optional git repository
- Reports
- json, csv, junit, sarif, template
- Mode
- Gitleaks compatibility
Scan git history using the Gitleaks-compatible patch model.
Usage
picket git [<repo>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
repo |
Optional | Git repository to scan. Defaults to the current directory when omitted. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
-b, --baseline-path |
path |
Optional | Load a baseline report and suppress matching findings. |
-c, --config |
path |
Optional | Load a config file. |
-f, --report-format |
json | csv | junit | sarif | template |
Optional | Select report format. |
-r, --report-path |
path |
Optional | Write a report to this path. |
-i, --gitleaks-ignore-path |
path |
Optional | Load a Gitleaks ignore file. |
--profile |
profile |
Optional | Use the named rule/profile mode. |
--baseline-mode |
exact | portable |
Optional | Compare baseline findings exactly or treat LF and CRLF evidence as equivalent. Requires a native command or --profile picket. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--report-template |
path |
Optional | Render template reports with this template file. |
--enable-rule |
id |
Optional | Enable an additional rule by ID. |
--exit-code |
n |
Optional | Exit with this code when findings are present. |
--ignore-gitleaks-allow |
flag |
Optional | Do not honor gitleaks:allow comments. |
--log-opts |
value |
Optional | Pass git log options for compatibility scans. |
--platform |
value |
Optional | Set compatibility platform metadata. |
--staged |
flag |
Optional | Scan staged changes. |
--pre-commit |
flag |
Optional | Scan the pre-commit diff range. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--max-archive-depth |
n |
Optional | Limit nested archive traversal depth. |
--max-archive-entries |
n |
Optional | Limit files extracted from each archive. |
--max-archive-megabytes |
n |
Optional | Limit uncompressed archive size. |
--max-archive-ratio |
n |
Optional | Limit archive expansion ratio. |
--timeout |
n |
Optional | Stop scanning after this many seconds. Use 0 to disable. |
--diagnostics |
mode[,mode] |
Optional | Write structured diagnostics for the selected modes. |
--diagnostics-dir |
path |
Optional | Write diagnostics artifacts to this directory. |
--redact |
n |
Optional | Redact secret text in reports. n is the percent to hide: 0 shows secrets, 100 writes REDACTED, and 75 keeps about the first 25%. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket dir
Section titled “picket dir”picket dir
Compatibility
- Input
- Required directory path
- Reports
- json, csv, junit, sarif, template
- Mode
- Gitleaks compatibility
Scan a directory or file path.
Usage
picket dir [<path>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
path |
Optional | Directory path to scan. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
-b, --baseline-path |
path |
Optional | Load a baseline report and suppress matching findings. |
-c, --config |
path |
Optional | Load a config file. |
-f, --report-format |
json | csv | junit | sarif | template |
Optional | Select report format. |
-r, --report-path |
path |
Optional | Write a report to this path. |
-i, --gitleaks-ignore-path |
path |
Optional | Load a Gitleaks ignore file. |
--profile |
profile |
Optional | Use the named rule/profile mode. |
--baseline-mode |
exact | portable |
Optional | Compare baseline findings exactly or treat LF and CRLF evidence as equivalent. Requires a native command or --profile picket. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--report-template |
path |
Optional | Render template reports with this template file. |
--enable-rule |
id |
Optional | Enable an additional rule by ID. |
--exit-code |
n |
Optional | Exit with this code when findings are present. |
--ignore-gitleaks-allow |
flag |
Optional | Do not honor gitleaks:allow comments. |
--follow-symlinks |
flag |
Optional | Follow symlinks while scanning directories. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--max-archive-depth |
n |
Optional | Limit nested archive traversal depth. |
--max-archive-entries |
n |
Optional | Limit files extracted from each archive. |
--max-archive-megabytes |
n |
Optional | Limit uncompressed archive size. |
--max-archive-ratio |
n |
Optional | Limit archive expansion ratio. |
--timeout |
n |
Optional | Stop scanning after this many seconds. Use 0 to disable. |
--diagnostics |
mode[,mode] |
Optional | Write structured diagnostics for the selected modes. |
--diagnostics-dir |
path |
Optional | Write diagnostics artifacts to this directory. |
--redact |
n |
Optional | Redact secret text in reports. n is the percent to hide: 0 shows secrets, 100 writes REDACTED, and 75 keeps about the first 25%. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket stdin
Section titled “picket stdin”picket stdin
Compatibility
- Input
- Standard input
- Reports
- json, csv, junit, sarif, template
- Mode
- Gitleaks compatibility
Scan piped input.
Usage
picket stdin [options]Options
| Option | Value | Required | Description |
|---|---|---|---|
-b, --baseline-path |
path |
Optional | Load a baseline report and suppress matching findings. |
-c, --config |
path |
Optional | Load a config file. |
-f, --report-format |
json | csv | junit | sarif | template |
Optional | Select report format. |
-r, --report-path |
path |
Optional | Write a report to this path. |
-i, --gitleaks-ignore-path |
path |
Optional | Load a Gitleaks ignore file. |
--profile |
profile |
Optional | Use the named rule/profile mode. |
--baseline-mode |
exact | portable |
Optional | Compare baseline findings exactly or treat LF and CRLF evidence as equivalent. Requires a native command or --profile picket. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--report-template |
path |
Optional | Render template reports with this template file. |
--enable-rule |
id |
Optional | Enable an additional rule by ID. |
--exit-code |
n |
Optional | Exit with this code when findings are present. |
--ignore-gitleaks-allow |
flag |
Optional | Do not honor gitleaks:allow comments. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--max-decode-depth |
n |
Optional | Limit recursive decoding passes. |
--max-archive-depth |
n |
Optional | Limit nested archive traversal depth. |
--timeout |
n |
Optional | Stop scanning after this many seconds. Use 0 to disable. |
--diagnostics |
mode[,mode] |
Optional | Write structured diagnostics for the selected modes. |
--diagnostics-dir |
path |
Optional | Write diagnostics artifacts to this directory. |
--redact |
n |
Optional | Redact secret text in reports. n is the percent to hide: 0 shows secrets, 100 writes REDACTED, and 75 keeps about the first 25%. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket rules check
Section titled “picket rules check”picket rules check
Rules
- Input
- Optional rule source
Validate a resolved rule pack.
Usage
picket rules check [<source>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
source |
Optional | Source key or path used for cache and rule operations. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
-c, --config |
path |
Optional | Load a config file. |
--profile |
profile |
Optional | Use the named rule/profile mode. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--print-config |
flag |
Optional | Print the resolved config. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket rules test
Section titled “picket rules test”picket rules test
Rules
- Input
- Rule ID and sample input
- Reports
- json, jsonl, csv, junit, html, gitlab, sarif, toon
Scan sample text with a single rule.
Usage
picket rules test <rule-id> [<input>] [options]Arguments
| Argument | Required | Description |
|---|---|---|
rule-id |
Required | Rule identifier to test. |
input |
Optional | Literal sample text scanned by the selected rule. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
-c, --config |
path |
Optional | Load a config file. |
-f, --report-format |
json | jsonl | csv | junit | html | gitlab | sarif | toon |
Optional | Select report format. |
-r, --report-path |
path |
Optional | Write a report to this path. |
--profile |
profile |
Optional | Use the named rule/profile mode. |
--rule-pack |
name |
Optional, repeatable | Add an opt-in built-in rule pack. Values: picket-strict or picket-experimental. Repeat to add both. |
--source |
path |
Optional | Override the source label stored in findings and fingerprints. |
--path |
path |
Optional | Set the synthetic path used for sample input. |
--print-config |
flag |
Optional | Print the resolved config. |
--ignore-gitleaks-allow |
flag |
Optional | Do not honor gitleaks:allow comments. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--max-decode-depth |
n |
Optional | Limit recursive decoding passes. |
--max-archive-depth |
n |
Optional | Limit nested archive traversal depth. |
--timeout |
n |
Optional | Stop scanning after this many seconds. Use 0 to disable. |
--redact |
n |
Optional | Redact secret text in reports. n is the percent to hide: 0 shows secrets, 100 writes REDACTED, and 75 keeps about the first 25%. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket hooks install
Section titled “picket hooks install”picket hooks install
Maintenance
- Input
- Optional hook name
Install managed pre-commit, pre-push, or pre-receive scanning hooks.
Usage
picket hooks install [<pre-commit|pre-push|pre-receive|all>] [options]Defaults
Installs pre-commit when no hook name is provided and uses --redact=100 in generated hooks.
Arguments
| Argument | Required | Description |
|---|---|---|
pre-commit | pre-push | pre-receive | all |
Optional | Hook to install. Defaults to pre-commit when omitted. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
--repo |
path |
Optional | Install hooks for this repository, honoring core.hooksPath. |
--force |
flag |
Optional | Overwrite an existing hook not managed by Picket. |
--command |
path |
Optional | Embed this Picket command or executable path in generated hook scripts. |
-c, --config |
path |
Optional | Load a config file. |
-b, --baseline-path |
path |
Optional | Load a baseline report and suppress matching findings. |
--max-target-megabytes |
n |
Optional | Skip files larger than this size. |
--redact |
n |
Optional | Set the redaction percentage used for baseline matching. Hook summaries always omit secret values. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket view
Section titled “picket view”picket view
Reports and baselines
- Input
- Required report path
Summarize or open a local report.
Usage
picket view <report> [options]Formats
Picket JSON/JSONL, Gitleaks JSON, TruffleHog JSON/JSONL, GitLab code-quality JSON, SARIF, HTML
Arguments
| Argument | Required | Description |
|---|---|---|
report |
Required | Report file to summarize or open. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
--open |
flag |
Optional | Open an HTML report in the default browser. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket tui
Section titled “picket tui”picket tui
Reports and baselines
- Input
- Optional report path
Interactive report triage and scan workspace.
Usage
picket tui [<report>] [options]Formats
Picket JSON/JSONL, Gitleaks JSON, TruffleHog JSON/JSONL, GitLab code-quality JSON, SARIF, HTML
Arguments
| Argument | Required | Description |
|---|---|---|
report |
Optional | Report file to summarize or open. |
Options
| Option | Value | Required | Description |
|---|---|---|---|
--flow |
flag |
Optional | Run the interactive report triage console as inline terminal steps. |
--scan |
flag |
Optional | Open the native scan workspace instead of loading an existing report. |
-t, --tab |
1-6 |
Optional | Start on a TUI tab by number: 1 Dashboard, 2 Scan, 3 Findings, 4 Rules, 5 Files, or 6 Logs. |
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |
picket version
Section titled “picket version”picket version
Compatibility
- Input
- None
Print version information.
Usage
picket version [options]Options
| Option | Value | Required | Description |
|---|---|---|---|
-?, -h, --help |
flag |
Optional | Show help and usage information |
-l, --log-level |
level |
Optional | Set the log level. |
-v, --verbose |
flag |
Optional | Enable verbose logging. |
--no-color |
flag |
Optional | Disable colored console output. |
--no-banner |
flag |
Optional | Suppress the startup banner. |