Secret detection rules
The built-in rules of kind secrets: hand-written rules with their own pages, and the catalog-generated rules grouped by provider category.
1092 built-in rules have kind secrets. They are evaluated by vulnetix secrets and by vulnetix scan; vulnetix sast does not run them. Secret rules declare no languages, so every one reads every text file.
Hand-written rules
82 rules with their own page, listed in the rules index with kind secrets. They cover the common providers with context checks (an SDK reference near the key, documented example keys excluded) that a catalog entry cannot express.
Catalog rules by category
1010 rules generated by go run ./internal/sast/secretsgen (just gen-secrets) from internal/sast/secretsgen/catalog.json.
| Category | Rules | Covers |
|---|---|---|
| Cloud Providers | 83 | AWS, Azure, GCP, Alibaba, Oracle, DigitalOcean, IBM and other cloud-provider credential detection rules. |
| Source Control & CI/CD | 70 | GitHub, GitLab, Bitbucket, Azure DevOps tokens and CI/CD pipeline credentials. |
| AI / LLM Providers | 72 | OpenAI, Anthropic, Google Gemini, Hugging Face, Cohere, Mistral and other AI provider keys. |
| Payment Processors | 82 | Stripe, PayPal, Square, Braintree, Adyen and other payment-platform credentials. |
| Communication & Messaging | 79 | Slack, Twilio, Discord, Telegram, SendGrid, Mailgun and other messaging credentials. |
| Package Registries | 1 | npm, PyPI, RubyGems, NuGet, Artifactory, Crates and other registry tokens. |
| Monitoring & Observability | 45 | Datadog, New Relic, Sentry, Grafana, PagerDuty and other observability keys. |
| SaaS & Developer APIs | 433 | Atlassian, Notion, Linear, Airtable, Shopify, Figma, Vercel, Netlify and other SaaS tokens. |
| Database Credentials | 49 | PostgreSQL, MySQL, MongoDB, Redis and other connection strings with embedded credentials. |
| Private Keys & Certificates | 14 | RSA, EC, OpenSSH, PGP, WireGuard, age and other private-key material. |
| Crypto & Blockchain | 78 | Ethereum, Bitcoin and other blockchain private keys and wallet credentials. |
| Webhooks & Signed URLs | 4 | Slack/Teams/Discord webhook URLs and signed URLs with embedded secrets. |