Permissions

When an assistant signs in, or when you sign in the CLI, you choose what it may do. It can only ever do what you can do yourself in that workspace.

Each permission below quotes the consent screen word for word. When you grant one, you confirm what its quote says.

Read lockpick.read

View sites, scans, findings, and repair guidance that you can access.

Pulse scans lockpick.pulse

Start Pulse scans, free quick checks and the free "Re-read this record", set or pause Pulse auto-checks, and share or unshare a Pulse result’s public link. I own the sites I ask Lockpick to assess, or I have permission to test them.

Sites lockpick.sites

Add sites, switch the workspace's free site, send a site's package versions and import which of its findings are accepted or dismissed, when my role permits it. Switching can remove a site from monitoring.

Deep scans lockpick.deep

Prepare Deep scans and Deep auto-checks on sites with proven ownership. I will approve each Deep scan and each Deep auto-check in Lockpick.

Stay signed in offline_access

Keep this connection signed in until it expires or you revoke it.

Identify your account openid

Share your stable Lockpick account identifier. This grants no scan permissions.

Share your email email

Share your email address and whether Lockpick has verified it.

The CLI asks for the same permissions by name, read, pulse, sites and deep.

What always needs you

• Every scan needs your say-so. A Pulse needs your confirmation that you own the site or may test it. A Deep scan needs proof of ownership and your approval in Lockpick, every time.
• Nothing is changed on your site. Every tool only reads, and the checks are the same limited, read-only checks as the web app.
• Costs are the same as on the web. Reads, quick checks and Re-read this record are free. A Pulse or a Deep scan uses one from your monthly allowance.

Limits

Assistants and CLI keys share limits so nothing runs away. Each key or connection can make 120 requests a minute and 2000 a day, a workspace can start 30 changes a minute, and one person can run 10 quick checks an hour through assistants. When a limit is reached, Lockpick says how long to wait.