Commands, exit codes and limits.

The short reference. Detection categories, how sanitizing works and the report schema are covered in the full docs on GitHub.

Commands

`stegguard detect`	Scans files or directories for hidden content.	exit 0/1/2
`stegguard decode`	Pulls out hidden payloads it recognizes in text, without changing the input.	exit 0/2
`stegguard sanitize`	Writes a cleaned copy and lists every change it made.	exit 0/2
`stegguard watermark`	Looks for watermark, fingerprint and provenance evidence, including C2PA.	exit 0/2

Exit codes

Command names, long option names, JSON field meanings, and exit codes are public. They only change in a major release.

`0`	The scan finished and nothing was flagged.
`1`	The scan finished and found something. Only detect uses this code.
`2`	Bad arguments, or the scan could not finish (for example, a resource limit was hit).

Resource limits

StegGuard treats every file it scans as untrusted. Each limit can be set with a ScanLimits object or the matching CLI flag.

`max_file_bytes`	Caps a top-level file read	100 MiB
`max_decompressed_bytes`	Caps decompressed PNG and nested content	50 MiB
`max_image_pixels`	Rejects declared image dimensions before allocation	40 million
`max_archive_members`	Caps entries visited in a container	500
`max_nesting_depth`	Stops recursive containers and embedded media	3
`max_scan_seconds`	Provides a cooperative per-scan deadline	30 seconds
`max_findings`	Caps accumulated evidence records	10,000

stegguard detect upload.zip \
  --max-file-bytes 16777216 \
  --max-decompressed-bytes 33554432 \
  --max-archive-members 1000 \
  --max-nesting-depth 2 \
  --max-scan-seconds 10 \
  --max-findings 2000

Platform support

The core is pure Python and targets CPython 3.12 to 3.14. Development happens on Linux x86-64. Other architectures have not been verified yet.

Linux, GitHub-hosted runner	3.12, 3.13, 3.14	Local Linux 3.12 passes; hosted results require GitHub
Windows, GitHub-hosted runner	3.12	Configured; hosted result pending
macOS, GitHub-hosted runner	3.12	Configured; hosted result pending

The compatibility policy, detection-quality notes and report schema are in the repo.

Browse the docs on GitHub →