CENSUS BULK-SCAN(1)

NAME
census-bulk-scan - Bulk leak detection: scan suspect files...

SYNOPSIS
census bulk-scan [OPTIONS] SUSPECT_DIR

DESCRIPTION
Bulk leak detection: scan suspect files against org inventory.

    Uses the /scan endpoint (up to 50K hashes per call) to detect files
    that match your organization's attested inventory — potential
    exfiltration indicators.

    Requires an API key with 'scan' scope.

    Examples:
        census bulk-scan /mnt/suspect-drive
        census bulk-scan ./data --manifest inventory.db --json
        census bulk-scan /tmp/exports --workers 4 --source incident-001
        census bulk-scan /data --dry-run # hash only, no API call
        census bulk-scan /data --exit-zero # report only, never fail

OPTIONS

--manifest PATH
    Local manifest for cross-referencing original paths.

--api-key TEXT
    CertiSigma API key (requires scan scope).

--base-url TEXT
    API base URL override.

--json
    Machine-readable JSON output.

--include TEXT
    Only include files matching this glob (repeatable).

--exclude TEXT
    Exclude files matching this glob (repeatable).

--min-size TEXT
    Skip files smaller than this (e.g. 1K, 10M).

--max-size TEXT
    Skip files larger than this (e.g. 100M, 1G). Default: 5G.

--workers INTEGER
    Parallel hashing workers (1 = sequential). Default: 1.

--source TEXT
    Source label for audit logging.

--dry-run
    Hash files and report count — no API call.

--output PATH
    Save results to file (JSON).

--exit-zero
    Always exit 0 (report-only mode for CI pipelines).

--summary
    Show only summary counts, no match details.

--format [text|json|jsonl]
    Output format.

--on-match TEXT
    Run command with match results as JSON on stdin (only if matches > 0).