Secret rules: AI / LLM Providers

OpenAI, Anthropic, Google Gemini, Hugging Face, Cohere, Mistral and other AI provider keys.

72 rules, kind secrets. They run under vulnetix secrets and the secrets stage of vulnetix scan, not under vulnetix sast. Each is generated from one entry in internal/sast/secretsgen/catalog.json.

Detection: keyword means the pattern is tried only on lines that contain one of the listed keywords (case-insensitive); entropy means the matched token must also reach the entry’s minimum Shannon entropy. Every catalog rule skips test files, lockfiles, minified and generated files, and paths under testdata/, fixtures/, vendor/, node_modules/, dist/, build/ and src/test/ (the skip_path list in internal/sast/rules/lib_secrets.rego), and documented example tokens.

Rule ID	Name	Severity	Detection	Keywords	CWE
`VNX-SEC-086`	Cohere API key	Critical	keyword + regex + entropy	`cohere`	CWE-798
`VNX-SEC-087`	Mistral AI API key	Critical	keyword + regex + entropy	`mistral`	CWE-798
`VNX-SEC-251`	OpenAI classic API key (sk-)	Critical	keyword + regex	`sk-` `t3blbkfj`	CWE-798
`VNX-SEC-252`	OpenAI legacy API key (sk- 48 char)	Critical	keyword + regex	`sk-`	CWE-798
`VNX-SEC-253`	OpenAI organization ID (org-)	Medium	keyword + regex	`org-`	CWE-798
`VNX-SEC-254`	OpenAI project ID (proj_)	Medium	keyword + regex	`proj_`	CWE-798
`VNX-SEC-255`	Azure OpenAI API key	Critical	keyword + regex + entropy	`azure` `openai`	CWE-798
`VNX-SEC-256`	Replicate API token (r8_)	Critical	keyword + regex	`r8_`	CWE-798
`VNX-SEC-257`	Together AI API key	Critical	keyword + regex + entropy	`together`	CWE-798
`VNX-SEC-258`	Groq API key (gsk_)	Critical	keyword + regex	`gsk_`	CWE-798
`VNX-SEC-259`	Perplexity API key (pplx-)	Critical	keyword + regex	`pplx-`	CWE-798
`VNX-SEC-260`	DeepSeek API key (sk-)	Critical	keyword + regex + entropy	`deepseek` `sk-`	CWE-798
`VNX-SEC-261`	Stability AI API key (sk-)	Critical	keyword + regex + entropy	`stability` `sk-`	CWE-798
`VNX-SEC-262`	ElevenLabs API key	Critical	keyword + regex + entropy	`elevenlabs` `eleven_labs`	CWE-798
`VNX-SEC-263`	ElevenLabs API key (sk_ prefix)	Critical	keyword + regex	`sk_`	CWE-798
`VNX-SEC-264`	AssemblyAI API key	Critical	keyword + regex + entropy	`assemblyai` `assembly_ai`	CWE-798
`VNX-SEC-265`	Deepgram API key (Token)	Critical	keyword + regex + entropy	`deepgram`	CWE-798
`VNX-SEC-266`	Pinecone API key	Critical	keyword + regex + entropy	`pinecone`	CWE-798
`VNX-SEC-267`	Pinecone API key (pckey_)	Critical	keyword + regex	`pckey_`	CWE-798
`VNX-SEC-268`	Weaviate API key	High	keyword + regex + entropy	`weaviate`	CWE-798
`VNX-SEC-269`	Qdrant API key	High	keyword + regex + entropy	`qdrant`	CWE-798
`VNX-SEC-270`	LangSmith personal API key (lsv2_pt_)	Critical	keyword + regex	`lsv2_pt_`	CWE-798
`VNX-SEC-271`	LangSmith service API key (lsv2_sk_)	Critical	keyword + regex	`lsv2_sk_`	CWE-798
`VNX-SEC-272`	LangChain/LangSmith legacy API key (ls__)	High	keyword + regex	`ls__`	CWE-798
`VNX-SEC-273`	Weights & Biases API key	High	keyword + regex + entropy	`wandb` `weights_biases`	CWE-798
`VNX-SEC-274`	CometML API key	High	keyword + regex + entropy	`comet`	CWE-798
`VNX-SEC-275`	Clarifai personal access token	High	keyword + regex + entropy	`clarifai`	CWE-798
`VNX-SEC-276`	Scale AI API key	High	keyword + regex + entropy	`scale` `live_`	CWE-798
`VNX-SEC-277`	Anyscale API key (esecret_)	Critical	keyword + regex	`esecret_`	CWE-798
`VNX-SEC-278`	Fireworks AI API key (fw_)	Critical	keyword + regex	`fw_`	CWE-798
`VNX-SEC-279`	OctoAI API token	High	keyword + regex + entropy	`octoai`	CWE-798
`VNX-SEC-280`	Voyage AI API key (pa-)	Critical	keyword + regex	`pa-`	CWE-798
`VNX-SEC-281`	Jina AI API key (jina_)	Critical	keyword + regex	`jina_`	CWE-798
`VNX-SEC-282`	AI21 Labs API key	Critical	keyword + regex + entropy	`ai21`	CWE-798
`VNX-SEC-283`	Aleph Alpha API token	High	keyword + regex + entropy	`alephalpha` `aleph_alpha`	CWE-798
`VNX-SEC-284`	NVIDIA NGC API key (nvapi-)	Critical	keyword + regex	`nvapi-`	CWE-798
`VNX-SEC-285`	Hugging Face fine-grained token (hf_oauth/api)	Critical	keyword + regex	`hf_oauth` `hf_api`	CWE-798
`VNX-SEC-286`	Modal token ID (ak-)	High	keyword + regex	`ak-`	CWE-798
`VNX-SEC-287`	Modal token secret (as-)	Critical	keyword + regex	`as-`	CWE-798
`VNX-SEC-288`	Baseten API key	High	keyword + regex + entropy	`baseten`	CWE-798
`VNX-SEC-289`	RunPod API key	Critical	keyword + regex	`rpa_`	CWE-798
`VNX-SEC-290`	Lambda Labs Cloud API key	Critical	keyword + regex + entropy	`lambda` `secret_`	CWE-798
`VNX-SEC-291`	Cerebras API key (csk-)	Critical	keyword + regex	`csk-`	CWE-798
`VNX-SEC-292`	Replicate API token (assignment context)	Critical	keyword + regex + entropy	`replicate` `r8_`	CWE-798
`VNX-SEC-293`	Voyage AI API key (assignment context)	Critical	keyword + regex + entropy	`voyage` `pa-`	CWE-798
`VNX-SEC-294`	Together AI API key (40 hex)	Critical	keyword + regex + entropy	`together`	CWE-798
`VNX-SEC-295`	Fireworks AI API key (fw- dash form)	Critical	keyword + regex	`fw-`	CWE-798
`VNX-SEC-296`	Groq API key (assignment context)	Critical	keyword + regex + entropy	`groq` `gsk_`	CWE-798
`VNX-SEC-297`	Mistral API key (assignment context)	Critical	keyword + regex + entropy	`mistral`	CWE-798
`VNX-SEC-298`	Hugging Face token (assignment context)	Critical	keyword + regex + entropy	`huggingface` `hugging_face` `hf_`	CWE-798
`VNX-SEC-299`	Anthropic API key (assignment context)	Critical	keyword + regex + entropy	`anthropic` `sk-ant-`	CWE-798
`VNX-SEC-300`	Perplexity API key (assignment context)	Critical	keyword + regex + entropy	`perplexity` `pplx-`	CWE-798
`VNX-SEC-301`	DeepSeek API key (sk- standalone)	High	keyword + regex	`sk-`	CWE-798
`VNX-SEC-302`	Cerebras API key (assignment context)	Critical	keyword + regex + entropy	`cerebras` `csk-`	CWE-798
`VNX-SEC-303`	AssemblyAI API key (32 hex assignment)	Critical	keyword + regex + entropy	`assemblyai`	CWE-798
`VNX-SEC-304`	Deepgram API key (Token header)	Critical	keyword + regex + entropy	`token`	CWE-798
`VNX-SEC-305`	LangChain endpoint API key (assignment context)	High	keyword + regex + entropy	`langchain` `lsv2_`	CWE-798
`VNX-SEC-306`	Stability AI API key (assignment context)	Critical	keyword + regex + entropy	`stability` `sk-`	CWE-798
`VNX-SEC-307`	NVIDIA NGC API key (legacy hex)	Critical	keyword + regex + entropy	`ngc_api_key` `ngc`	CWE-798
`VNX-SEC-308`	ElevenLabs API key (assignment context)	Critical	keyword + regex + entropy	`xi_api_key` `elevenlabs`	CWE-798
`VNX-SEC-309`	Qdrant API key (JWT form)	High	keyword + regex + entropy	`qdrant`	CWE-798
`VNX-SEC-310`	CometML API key (assignment context)	High	keyword + regex + entropy	`comet_api_key` `comet`	CWE-798
`VNX-SEC-311`	RunPod API key (assignment context)	Critical	keyword + regex + entropy	`runpod` `rpa_`	CWE-798
`VNX-SEC-312`	Baseten API key (assignment context)	High	keyword + regex + entropy	`baseten`	CWE-798
`VNX-SEC-313`	Jina AI API key (assignment context)	Critical	keyword + regex + entropy	`jina` `jina_`	CWE-798
`VNX-SEC-314`	Anyscale API key (assignment context)	Critical	keyword + regex + entropy	`anyscale` `esecret_`	CWE-798
`VNX-SEC-315`	AI21 Labs API key (assignment context)	Critical	keyword + regex + entropy	`ai21_api_key` `ai21`	CWE-798
`VNX-SEC-316`	Pinecone API key (assignment context)	Critical	keyword + regex + entropy	`pinecone_api_key` `pinecone`	CWE-798
`VNX-SEC-317`	Weaviate API key (assignment context)	High	keyword + regex + entropy	`weaviate_api_key` `weaviate`	CWE-798
`VNX-SEC-318`	OctoAI token (assignment context)	High	keyword + regex + entropy	`octoai`	CWE-798
`VNX-SEC-319`	Lambda Labs API key (lambda. prefix)	Critical	keyword + regex + entropy	`lambda_api_key` `lambda`	CWE-798
`VNX-SEC-320`	Clarifai PAT (assignment context)	High	keyword + regex + entropy	`clarifai_pat` `clarifai`	CWE-798

Suppress one with // nosec <rule-id> on the line, or vulnetix ignore add --rule <rule-id>. See Suppressing findings.