Validation and Analyze Reference

This page is generated from SecretValidationState, SecretValidationResult, embedded native rule metadata, and CredentialAnalyzer output. Values are structural contract data, not live provider responses.

Validation States

State	Report value	Meaning
Unknown	unknown	No offline or live validator produced a provider-specific verdict.
StructurallyValid	structurally-valid	Offline validation matched a known provider structure, checksum, or envelope.
TestCredential	test-credential	Offline validation identified a dummy, placeholder, sample, or test credential.
Invalid	invalid	Offline validation rejected the provider structure or checksum.
Active	active	Live provider verification proved that the credential is active.
Inactive	inactive	Live provider verification proved that the credential is inactive or revoked.
Skipped	skipped	Live provider verification intentionally skipped the finding.
Error	error	Live provider verification ended in a provider, network, policy, or rate-limit error.

Validation Templates

live:github-rest-user-v1Live provider verification

GitHub5 rules

picket-github-app-token, picket-github-fine-grained-personal-access-token, picket-github-oauth-token, picket-github-personal-access-token, picket-github-refresh-token

offline:anthropic-oauth-tokenOffline structural validation

Anthropic2 rules

picket-anthropic-oauth-access-token, picket-anthropic-oauth-refresh-token

offline:aws-access-key-pairOffline structural validation

AWS1 rule

picket-aws-access-key-pair

offline:azure-storage-connection-stringOffline structural validation

Azure1 rule

picket-azure-storage-connection-string

offline:claude-code-session-urlOffline structural validation

Anthropic1 rule

picket-claude-code-session-url

offline:codex-access-tokenOffline structural validation

OpenAI1 rule

picket-openai-codex-access-token

offline:codex-refresh-tokenOffline structural validation

OpenAI1 rule

picket-openai-codex-refresh-token

offline:database-connection-urlOffline structural validation

Database1 rule

picket-database-connection-url

offline:docker-registry-authOffline structural validation

Docker1 rule

picket-docker-registry-auth

offline:gcp-api-keyOffline structural validation

GCP1 rule

picket-google-api-key

offline:gcp-service-account-key-jsonOffline structural validation

GCP1 rule

picket-gcp-service-account-key

offline:github-app-tokenOffline structural validation

GitHub1 rule

picket-github-app-token

offline:github-classic-tokenOffline structural validation

GitHub3 rules

picket-github-oauth-token, picket-github-personal-access-token, picket-github-refresh-token

offline:github-fine-grained-patOffline structural validation

GitHub1 rule

picket-github-fine-grained-personal-access-token

offline:groq-api-keyOffline structural validation

Groq1 rule

picket-groq-api-key

offline:jwk-private-keyOffline structural validation

JWK1 rule

picket-jwk-private-key

offline:kubernetes-secretOffline structural validation

Kubernetes1 rule

picket-kubernetes-secret

offline:mcp-server-credentialOffline structural validation

MCP1 rule

picket-mcp-server-credential

offline:npm-auth-tokenOffline structural validation

npm1 rule

picket-npm-auth-token

offline:npm-basic-authOffline structural validation

npm1 rule

picket-npm-basic-auth

offline:openai-api-keyOffline structural validation

OpenAI1 rule

picket-openai-api-key

offline:sourcegraph-access-tokenOffline structural validation

Sourcegraph1 rule

picket-sourcegraph-access-token

offline:xai-api-keyOffline structural validation

xAI1 rule

picket-xai-api-key

Revocation Templates

revocation:aws-iam-access-keyProvider revocation guidance

AWS1 rule

picket-aws-access-key-pair

revocation:azure-storage-account-keyProvider revocation guidance

Azure1 rule

picket-azure-storage-connection-string

revocation:gcp-api-keyProvider revocation guidance

GCP1 rule

picket-google-api-key

revocation:gcp-service-account-keyProvider revocation guidance

GCP1 rule

picket-gcp-service-account-key

revocation:github-credentials-apiProvider revocation guidance

GitHub5 rules

picket-github-app-token, picket-github-fine-grained-personal-access-token, picket-github-oauth-token, picket-github-personal-access-token, picket-github-refresh-token

Severity and Confidence

Severity	Confidence	Rules	Providers
critical	high	25	AWS, Anthropic, Azure, Database, Docker, GCP, GitHub, Groq, JWK, Kubernetes, MCP, OpenAI, Sourcegraph, npm, xAI
critical	low	1	HTTP
critical	medium	3	Azure, Database, HTTP
high	low	1	HTTP

Analyze Risk Mapping

Validation state	Risk	Identity fallback	Metadata fallback
unknown	high	unknown-offline	unknown-offline
structurally-valid	critical	unknown-offline	unknown-offline
test-credential	low	unknown-offline	unknown-offline
invalid	low	unknown-offline	unknown-offline
active	critical	unknown-live	unknown-live
inactive	medium	unknown-live	unknown-live
skipped	high	unknown-live	unknown-live
error	high	unknown-live	unknown-live

Provider Analysis Metadata

AWSAWS access key pairpicket-aws-access-key-pair

Risk criticalRevocation available2 actions3 guidance items

Evidence keys: fingerprint, location, secretSha256, validationState

AzureAzure Storage account keypicket-azure-storage-connection-string

Risk criticalRevocation available3 actions3 guidance items

Evidence keys: fingerprint, location, secretSha256, validationState

DatabaseDatabase connection URLpicket-database-connection-url

Risk criticalRevocation available3 actions3 guidance items

Evidence keys: fingerprint, location, secretSha256, validationState

GCPGCP API keypicket-google-api-key

Risk criticalRevocation available3 actions3 guidance items

Evidence keys: fingerprint, location, secretSha256, validationState

GCPGCP service account keypicket-gcp-service-account-key

Risk criticalRevocation available3 actions3 guidance items

Evidence keys: fingerprint, location, secretSha256, validationState

GenericPrivate keyprivate-key

Risk criticalNo revocation template3 actions0 guidance items

Evidence keys: fingerprint, location, secretSha256, validationState

GitHubGitHub personal access tokenpicket-github-personal-access-token

Risk criticalRevocation available3 actions3 guidance items

Evidence keys: endpoint, fingerprint, location, provider, secretSha256, validationState

GitLabGitLab personal access tokengitlab-pat

Risk criticalRevocation available3 actions3 guidance items

Evidence keys: fingerprint, gitLabRuleId, location, resourceType, secretSha256, validationState

SourcegraphSourcegraph access tokenpicket-sourcegraph-access-token

Risk criticalRevocation available3 actions3 guidance items

Evidence keys: fingerprint, location, secretSha256, validationState

UnknownSecretexample-unknown-rule

Risk criticalNo revocation template3 actions0 guidance items

Evidence keys: fingerprint, location, secretSha256, validationState

Analysis Report Shape

JSON reports use schema picket.analysis.report.v1. JSON Lines emits one picket.analysis.v1 object per line with the same analysis fields.

Analysis JSON report object

Property	JSON type
schema	string
summary	object
analyses	array<object>

Analysis JSON analyses[] object

Property	JSON type
schema	string
ruleId	string
provider	string
credentialType	string
file	string
startLine	number
startColumn	number
fingerprint	string
secretSha256	string
validationState	string
risk	string
identity	string
scopes	array<string>
reachableResources	array<string>
riskSummary	string
recommendedActions	array<string>
revocationAvailable	boolean
revocationCommands	array<string>
revocationGuidance	array<string>
evidence	array<string>