CLI Reference

Global Flags

These flags work with all commands:

Flag	Description
--config	Path to config file (default: .redactyl.yml)
--verbose	Enable verbose output
--debug	Enable debug logging
--no-color	Disable colored output
--help	Show help
--version	Show version

redactyl scan

Scan for secrets in files, archives, and containers.

redactyl scan [flags] [paths...]

Output Flags

Flag	Description
--json	Output findings as JSON
--sarif	Output findings as SARIF
--text	Output findings as plain text
--no-tui	Disable interactive TUI
--guide	Include remediation guidance

Scope Flags

Flag	Description
--staged	Scan only staged changes
--history N	Scan last N commits
--base BRANCH	Scan diff against base branch
--exclude PATTERN	Exclude paths matching pattern

Deep Scanning Flags

Flag	Description
--archives	Scan archive files (zip, tar, tgz)
--containers	Scan container images
--helm	Scan Helm charts
--k8s	Scan Kubernetes manifests
--deep	Enable all deep scanning
--image IMAGE	Scan specific container image

Filter Flags

Flag	Description
--severity LEVEL	Minimum severity (low, medium, high, critical)
--detector NAME	Filter by detector name
--baseline FILE	Use baseline file

Examples

# Basic scan
redactyl scan

# Scan with JSON output
redactyl scan --json > findings.json

# Scan staged changes only
redactyl scan --staged

# Deep scan everything
redactyl scan --deep

# Scan remote container image
redactyl scan --image gcr.io/myproject/myapp:latest

# CI/CD mode with SARIF output
redactyl scan --no-tui --sarif > redactyl.sarif.json

redactyl baseline

Manage the baseline of known/accepted findings.

redactyl baseline [command]

Subcommands

Command	Description
list	List baselined findings
add	Add finding to baseline
remove	Remove finding from baseline
clear	Clear all baselined findings

Examples

# List baselined findings
redactyl baseline list

# Add by fingerprint
redactyl baseline add --fingerprint abc123

# Remove from baseline
redactyl baseline remove --fingerprint abc123

# Clear baseline
redactyl baseline clear

redactyl redact

Redact secrets from files.

redactyl redact [flags] [files...]

Flags

Flag	Description
--dry-run	Show what would be redacted
--backup	Create backup before redacting
--pattern PATTERN	Custom redaction pattern
--replacement TEXT	Replacement text (default: [REDACTED])

Examples

# Preview redactions
redactyl redact --dry-run .env

# Redact with backup
redactyl redact --backup config.yaml

# Custom replacement
redactyl redact --replacement "***" secrets.json

redactyl dotenv

Manage .env file secrets.

redactyl dotenv [command]

Subcommands

Command	Description
scan	Scan .env files
rotate	Rotate secrets in .env
export	Export to secret manager

Examples

# Scan all .env files
redactyl dotenv scan

# Rotate a specific key
redactyl dotenv rotate --key API_KEY

# Export to AWS Secrets Manager
redactyl dotenv export --to aws-secrets-manager

redactyl history

Rewrite git history to remove secrets.

redactyl history [command]

Subcommands

Command	Description
scan	Scan git history
clean	Remove secrets from history
verify	Verify history is clean

Flags

Flag	Description
--backup	Create backup refs
--force	Skip confirmation prompts
--dry-run	Show what would change

Examples

# Scan full history
redactyl history scan

# Clean with backup
redactyl history clean --backup

# Verify clean
redactyl history verify

redactyl config

Manage configuration.

redactyl config [command]

Subcommands

Command	Description
init	Create default config file
validate	Validate config file
show	Show effective config

Examples

# Create config file
redactyl config init

# Validate config
redactyl config validate

# Show effective config
redactyl config show

Exit Codes

Code	Meaning
0	Success, no findings
1	Findings detected
2	Error during scan
3	Configuration error