Permissions

When an assistant signs in, or when you sign in the CLI, you choose what it may do. It can only ever do what you can do yourself in that workspace.

Each permission below quotes the consent screen word for word. When you grant one, you confirm what its quote says.

Read lockpick.read

View sites, scans, findings, and repair guidance that you can access.

Pulse scans lockpick.pulse

Start Pulse scans, free quick checks and the free "Re-read this record". I own the sites I ask Lockpick to assess, or I have permission to test them.

Sites lockpick.sites

Add sites, switch the workspace's free site and send a site's package versions when my role permits it. Switching can remove a site from monitoring.

Deep scans lockpick.deep

Prepare Deep scans on sites with proven ownership. I will approve each Deep scan in Lockpick.

Stay signed in offline_access

Keep this connection signed in until it expires or you revoke it.

The CLI asks for the same permissions by name, read, pulse, sites and deep.

What always needs you

• Every scan needs your say-so. A Pulse needs your confirmation that you own the site or may test it. A Deep scan needs proof of ownership and your approval in Lockpick, every time.
• Nothing is changed on your site. Every tool only reads, and the checks are the same limited, read-only checks as the web app.
• Costs are the same as on the web. Reads, quick checks and Re-read this record are free. A Pulse or a Deep scan uses one from your monthly allowance.

Limits

Assistants and CLI keys share limits so nothing runs away. Each key or connection can make 120 requests a minute and 2000 a day, a workspace can start 30 changes a minute, and one person can run 10 quick checks an hour through assistants. When a limit is reached, Lockpick says how long to wait.