willibrandon/picket

Picket

Picket is a MIT-licensed secrets scanner for .NET. It provides a Gitleaks-compatible command surface, a Picket-native scanning surface, Native AOT release binaries, dotnet tool packages, and embeddable AOT-safe libraries for rules, scanning, reporting, and endpoint safety.

Tools

Install the command-line scanner:

dotnet tool install --global Picket

Install the interactive terminal report triage companion:

dotnet tool install --global Picket.Tui.Cli

The release archives are direct Native AOT executable downloads. The dotnet tool packages are RID-specific Native AOT NuGet tool packages selected by the .NET CLI during install for Windows, Linux, and macOS x64/Arm64.

Scan staged, unstaged, and untracked non-ignored Git changes together:

picket scan --git-changes . --report-format jsonl --redact=100

Scan a Hugging Face model, dataset, Space, or bucket with a read-only token stored in an environment variable:

picket scan --huggingface-model owner/model --huggingface-token-env HF_TOKEN --report-format jsonl --redact=100

Scan GitLab issues, comments, releases, and release assets:

picket scan --gitlab-project owner/project --gitlab-include-issues --gitlab-include-releases --gitlab-include-release-assets --gitlab-token-env GITLAB_TOKEN --report-format jsonl --redact=100

CI Integrations

Use the Picket Secret Scanner GitHub Action:

- uses: actions/checkout@v7.0.1
- uses: willibrandon/picket@v0
  with:
    upload-sarif: true

The Action and Azure Pipelines task can also select a Docker archive, OCI archive, or registry image directly, so image-building jobs keep the same Picket reports, redaction, annotations, cache, and failure policy without a separate CLI scan step.