Secret detection rules
The 1092 built-in rules of kind secrets that vulnetix secrets runs, by catalogue category and by rule.
vulnetix secrets runs every built-in rule whose metadata declares "kind": "secrets": 1092 rules at cli@2449840. No secret rule declares a language, so each one reads every text file the scan loads. vulnetix secrets --list-default-rules prints the built-in table, but it lists rules of every kind, not only these.
| Severity | Rules |
|---|---|
| Critical | 412 |
| High | 520 |
| Medium | 159 |
| Low | 1 |
Catalogue rules by category
1010 rules are generated from internal/sast/secretsgen/catalog.json or carry a catalogue category in their help_uri. Each category page lists every rule with its severity and the provider it covers.
| Category | Rules | Covers |
|---|---|---|
| Cloud Providers | 83 | AWS, Azure, GCP, Alibaba, Oracle, DigitalOcean, IBM and other cloud-provider credential detection rules. |
| Source Control & CI/CD | 70 | GitHub, GitLab, Bitbucket, Azure DevOps tokens and CI/CD pipeline credentials. |
| AI / LLM Providers | 72 | OpenAI, Anthropic, Google Gemini, Hugging Face, Cohere, Mistral and other AI provider keys. |
| Payment Processors | 82 | Stripe, PayPal, Square, Braintree, Adyen and other payment-platform credentials. |
| Communication & Messaging | 79 | Slack, Twilio, Discord, Telegram, SendGrid, Mailgun and other messaging credentials. |
| Package Registries | 1 | npm, PyPI, RubyGems, NuGet, Artifactory, Crates and other registry tokens. |
| Monitoring & Observability | 45 | Datadog, New Relic, Sentry, Grafana, PagerDuty and other observability keys. |
| SaaS & Developer APIs | 433 | Atlassian, Notion, Linear, Airtable, Shopify, Figma, Vercel, Netlify and other SaaS tokens. |
| Database Credentials | 49 | PostgreSQL, MySQL, MongoDB, Redis and other connection strings with embedded credentials. |
| Private Keys & Certificates | 14 | RSA, EC, OpenSSH, PGP, WireGuard, age and other private-key material. |
| Crypto & Blockchain | 78 | Ethereum, Bitcoin and other blockchain private keys and wallet credentials. |
| Webhooks & Signed URLs | 4 | Slack/Teams/Discord webhook URLs and signed URLs with embedded secrets. |
Rules with their own page
82 rules are written by hand. They cover the common providers and file formats with checks a catalogue entry cannot express, such as the AWS key pair, Kubernetes Secret manifests, and credentials in Android, Java, .NET and Terraform configuration.
| Rule | Name | Severity |
|---|---|---|
VNX-ANDROID-006 |
Android credential hard-coded in a string resource | High |
VNX-CS-010 |
C# hardcoded connection string with credentials | High |
VNX-DOCKER-003 |
Secret in Dockerfile ARG or ENV | High |
VNX-JAVA-019 |
Java hardcoded cryptographic key literal | Critical |
VNX-JAVA-021 |
Java sensitive data logged (password, token, secret, key) | Medium |
VNX-JAVA-025 |
Java hardcoded password or credential in source code | Critical |
VNX-JWT-003 |
JWT signing with hardcoded secret | High |
VNX-LLM-003 |
Hardcoded LLM API key | Critical |
VNX-SEC-001 |
AWS access key ID | Critical |
VNX-SEC-002 |
Private key committed | Critical |
VNX-SEC-003 |
AWS secret access key | Critical |
VNX-SEC-004 |
GitHub or GitLab token | Critical |
VNX-SEC-005 |
GCP API key | Critical |
VNX-SEC-006 |
Stripe secret key | Critical |
VNX-SEC-007 |
Slack token or webhook | High |
VNX-SEC-008 |
Database connection string with credentials | Critical |
VNX-SEC-009 |
SendGrid API key | High |
VNX-SEC-010 |
Package registry token | Critical |
VNX-SEC-011 |
Hardcoded JWT token | High |
VNX-SEC-014 |
Hardcoded password in variable | High |
VNX-SEC-018 |
AI provider API key | Critical |
VNX-SEC-019 |
GCP service account key | Critical |
VNX-SEC-020 |
GitLab access token | Critical |
VNX-SEC-021 |
Twilio API credentials | Critical |
VNX-SEC-022 |
Sensitive data in log statement | Medium |
VNX-SEC-025 |
Azure Storage Account key hardcoded | Critical |
VNX-SEC-026 |
DigitalOcean personal access token hardcoded | Critical |
VNX-SEC-027 |
Hugging Face API token hardcoded | High |
VNX-SEC-028 |
npm access token hardcoded | High |
VNX-SEC-029 |
PyPI upload token hardcoded | High |
VNX-SEC-030 |
Google OAuth client secret hardcoded | High |
VNX-SEC-031 |
Mailgun API key hardcoded | High |
VNX-SEC-032 |
PGP private key block hardcoded | Critical |
VNX-SEC-033 |
AWS Bedrock API key (long-lived) | Critical |
VNX-SEC-034 |
Alibaba Cloud access key | Critical |
VNX-SEC-035 |
DigitalOcean personal access token | Critical |
VNX-SEC-036 |
Heroku API key | Critical |
VNX-SEC-037 |
HashiCorp Vault token | Critical |
VNX-SEC-038 |
HashiCorp Terraform Cloud token | Critical |
VNX-SEC-039 |
GitLab personal access token (legacy) | Critical |
VNX-SEC-040 |
GitLab pipeline trigger / deploy / runner token | Critical |
VNX-SEC-041 |
Atlassian API token | Critical |
VNX-SEC-042 |
Slack webhook URL | High |
VNX-SEC-043 |
Twilio API key | Critical |
VNX-SEC-044 |
Microsoft Teams webhook URL | High |
VNX-SEC-045 |
Discord bot token | Critical |
VNX-SEC-046 |
Square access token | Critical |
VNX-SEC-047 |
Shopify access token | Critical |
VNX-SEC-048 |
OpenAI project / service / admin key | Critical |
VNX-SEC-049 |
Anthropic admin API key | Critical |
VNX-SEC-050 |
Google Gemini / Vertex AI / PaLM API key | Critical |
VNX-SEC-051 |
RubyGems API token | Critical |
VNX-SEC-052 |
Artifactory / JFrog API key | Critical |
VNX-SEC-053 |
SonarQube / SonarCloud token | Critical |
VNX-SEC-054 |
Datadog API / APP key | Critical |
VNX-SEC-055 |
New Relic API key | Critical |
VNX-SEC-056 |
Sentry auth token | Critical |
VNX-SEC-057 |
Grafana API / service account token | Critical |
VNX-SEC-058 |
Notion API token | Critical |
VNX-SEC-059 |
Linear API key | Critical |
VNX-SEC-060 |
Airtable personal access token | Critical |
VNX-SEC-061 |
PostgreSQL connection string with credentials | Critical |
VNX-SEC-062 |
MySQL connection string with credentials | Critical |
VNX-SEC-063 |
MongoDB connection string with credentials | Critical |
VNX-SEC-064 |
Redis connection string with credentials | Critical |
VNX-SEC-065 |
HTTP basic authentication header | High |
VNX-SEC-066 |
HTTP bearer authentication header | High |
VNX-SEC-067 |
Curl command with embedded credentials | High |
VNX-SEC-068 |
Ethereum private key | Critical |
VNX-SEC-069 |
age secret key | Critical |
VNX-SEC-070 |
1Password secret key / service account | Critical |
VNX-SEC-071 |
GitLab session cookie | Critical |
VNX-SEC-072 |
Generic high-entropy API key / secret | High |
VNX-SEC-073 |
URL with embedded credentials | High |
VNX-SEC-074 |
Kubernetes Secret manifest with credential data | High |
VNX-SEC-075 |
WireGuard private key | Critical |
VNX-SEC-076 |
Telegram bot API token | Critical |
VNX-SEC-077 |
Mapbox access token | High |
VNX-SEC-078 |
Doppler API token | Critical |
VNX-SEC-079 |
GitHub fine-grained personal access token | Critical |
VNX-SEC-080 |
GitHub OAuth / App / Refresh token | Critical |
VNX-TF-008 |
Terraform AWS provider with hardcoded static credentials | High |