/opt/chainguard/checkov/bin/detect-secrets-hook

usage: detect-secrets-hook [-h] [-v] [--version] [-C <path>] [-c NUM_CORES] [--json]
                           [--baseline FILENAME] [--list-all-plugins] [-p PLUGIN]
                           [--base64-limit [BASE64_LIMIT]] [--hex-limit [HEX_LIMIT]]
                           [--disable-plugin DISABLE_PLUGIN] [-n | --only-verified]
                           [--exclude-lines EXCLUDE_LINES] [--exclude-files EXCLUDE_FILES]
                           [--exclude-secrets EXCLUDE_SECRETS] [-f FILTER]
                           [--disable-filter DISABLE_FILTER]
                           [filenames ...]

positional arguments:
  filenames             Filenames to check.

options:
  -h, --help            show this help message and exit
  -v, --verbose         Verbose mode.
  --version             Display version information.
  -C <path>             Run as if detect-secrets was started in <path>, rather than in the current
                        working directory.
  -c NUM_CORES, --cores NUM_CORES
                        Specify the number of cores to use for parallel processing. Defaults to
                        using the max cores on the current host.
  --json                Print detect-secrets-hook output as JSON
  --baseline FILENAME   Explicitly ignore secrets through a baseline generated by `detect-secrets
                        scan`

plugin options:
  Configure settings for each secret scanning ruleset. By default, all plugins are enabled
  unless explicitly disabled.

  --list-all-plugins    Lists all plugins that will be used for the scan.
  -p PLUGIN, --plugin PLUGIN
                        Specify path to custom secret detector plugin.
  --base64-limit [BASE64_LIMIT]
                        Sets the entropy limit for high entropy strings. Value must be between 0.0
                        and 8.0, defaults to 4.5.
  --hex-limit [HEX_LIMIT]
                        Sets the entropy limit for high entropy strings. Value must be between 0.0
                        and 8.0, defaults to 3.0.
  --disable-plugin DISABLE_PLUGIN
                        Plugin class names to disable. e.g. Base64HighEntropyString

filter options:
  Configure settings for filtering out secrets after they are flagged by the engine.

  -n, --no-verify       Disables additional verification of secrets via network call.
  --only-verified       Only flags secrets that can be verified.
  --exclude-lines EXCLUDE_LINES
                        If lines match this regex, it will be ignored.
  --exclude-files EXCLUDE_FILES
                        If filenames match this regex, it will be ignored.
  --exclude-secrets EXCLUDE_SECRETS
                        If secrets match this regex, it will be ignored.
  -f FILTER, --filter FILTER
                        Specify path to custom filter. May be a python module path (e.g.
                        detect_secrets.filters.common.is_invalid_file) or a local file path (e.g.
                        file://path/to/file.py::function_name).
  --disable-filter DISABLE_FILTER
                        Specify filter to disable. e.g.
                        detect_secrets.filters.common.is_invalid_file