Secret rules: Package Registries
npm, PyPI, RubyGems, NuGet, Artifactory, Crates and other registry tokens.
1 rules, kind secrets. They run under vulnetix secrets and the secrets stage of vulnetix scan, not under vulnetix sast. Each is generated from one entry in internal/sast/secretsgen/catalog.json.
Detection: keyword means the pattern is tried only on lines that contain one of the listed keywords (case-insensitive); entropy means the matched token must also reach the entry’s minimum Shannon entropy. Every catalog rule skips test files, lockfiles, minified and generated files, and paths under testdata/, fixtures/, vendor/, node_modules/, dist/, build/ and src/test/ (the skip_path list in internal/sast/rules/lib_secrets.rego), and documented example tokens.
| Rule ID | Name | Severity | Detection | Keywords | CWE |
|---|---|---|---|---|---|
VNX-SEC-098 |
Crates.io (Rust) API token | Critical | keyword + regex | cio |
CWE-798 |
Suppress one with // nosec <rule-id> on the line, or vulnetix ignore add --rule <rule-id>. See Suppressing findings.