Documentation
Vulnetix ships built-in SAST rules written in Rego and evaluated by the Open Policy Agent engine. Rules are organised by language and security category. Each rule page explains what the rule detects, why it matters, and how to remediate the finding.
Rules are grouped into four analysis sub-categories that can be enabled or disabled independently:
| Sub-category | Rule kind | Dedicated command | Description |
|---|---|---|---|
| Static analysis | sast | vulnetix sast | General code security rules per language |
| Secret detection | secrets | vulnetix secrets | Hardcoded credentials, API keys, tokens |
| Container analysis | oci | vulnetix containers | Dockerfile / Containerfile misconfigurations |
| IaC analysis | iac | vulnetix iac | Terraform, Nix infrastructure misconfigurations |
All sub-categories run by default with vulnetix scan. Use --no-sast, --no-secrets, --no-containers, or --no-iac to disable individual sub-categories, or use the dedicated commands to run only one. You can also author and load your own rules from any Git repository.
| Rule ID | Name | Severity |
|---|---|---|
| VNX-ANDROID-001 | Android insecure manifest configuration | High |
| VNX-ANDROID-002 | Android WebView JavaScript enabled | High |
| VNX-ANDROID-003 | Android exported component without permission check | High |
| VNX-ANDROID-004 | Android SharedPreferences used for sensitive data storage | High |
| VNX-ANDROID-005 | Android network security config allows plaintext HTTP traffic | High |
| VNX-ANDROID-006 | Android hardcoded API key in strings.xml | High |
| VNX-ANDROID-007 | Android weak cryptography using AES in ECB mode | High |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-BASH-001 | eval with potentially user-controlled input | Critical |
| VNX-BASH-002 | curl or wget output piped directly to shell interpreter | High |
| VNX-BASH-003 | Missing set -euo pipefail in Bash script | Medium |
| VNX-BASH-004 | Unquoted variable used in command or test | Medium |
| VNX-BASH-005 | Hardcoded secret or password in shell script | High |
| VNX-BASH-006 | Global IFS reassignment in shell script | Medium |
| VNX-BASH-007 | Unquoted command substitution in shell script | Medium |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-C-001 | Use of unbounded string copy function (strcpy/strcat/gets) | High |
| VNX-C-002 | Format string injection via non-literal format argument | High |
| VNX-C-003 | OS command injection via system() or popen() | High |
| VNX-C-004 | Use-after-free: pointer used after free() | High |
| VNX-C-005 | Integer overflow in malloc/calloc size arithmetic | High |
| VNX-C-006 | Use of alloca() for dynamic stack allocation | Medium |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-CS-001 | C# SQL injection via string concatenation in SqlCommand | High |
| VNX-CS-002 | C# command injection via Process.Start with user input | High |
| VNX-CS-003 | C# XXE via XmlDocument with XmlResolver enabled | High |
| VNX-CS-004 | C# insecure deserialization via BinaryFormatter or SoapFormatter | Critical |
| VNX-CS-005 | C# missing ValidateAntiForgeryToken on state-changing actions | High |
| VNX-CS-006 | C# insecure random number generator (System.Random for security) | Medium |
| VNX-CS-007 | C# path traversal via Path.Combine with user input | High |
| VNX-CS-008 | C# SSRF via WebClient or HttpClient with user-supplied URL | High |
| VNX-CS-009 | C# use of weak cryptographic algorithm (MD5, SHA1, DES, 3DES) | High |
| VNX-CS-010 | C# hardcoded connection string with credentials | High |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-CRYPTO-001 | MD5 usage detected | Medium |
| VNX-CRYPTO-002 | SHA-1 usage detected | Medium |
| VNX-CRYPTO-003 | AES in ECB mode | High |
| VNX-CRYPTO-004 | Broken or obsolete cipher | High |
| VNX-CRYPTO-005 | TLS certificate validation disabled | High |
| VNX-CRYPTO-006 | Weak RSA key size | High |
| VNX-CRYPTO-007 | Weak password hashing / insufficient KDF iterations | High |
| VNX-CRYPTO-008 | Timing attack via direct comparison of secrets | High |
| VNX-CRYPTO-009 | Use of cryptographically weak PRNG (rand/srand in C/C++) | High |
| VNX-CRYPTO-010 | Hardcoded IV, nonce, or salt in cryptographic operation | High |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-DOCKER-001 | Dockerfile missing USER directive | Medium |
| VNX-DOCKER-002 | Dockerfile FROM :latest tag | Medium |
| VNX-DOCKER-003 | Secret in Dockerfile ARG or ENV | High |
| VNX-DOCKER-004 | Dockerfile ADD with remote URL | Medium |
| VNX-DOCKER-005 | Dockerfile privileged container flag | High |
| VNX-DOCKER-006 | Dockerfile uses ADD instead of COPY for local files | Low |
| VNX-DOCKER-007 | Dockerfile missing HEALTHCHECK instruction | Low |
| VNX-DOCKER-008 | Dockerfile package manager install without version pinning | Medium |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-GO-001 | Missing go.sum | High |
| VNX-GO-002 | Command injection via exec.Command | High |
| VNX-GO-003 | SQL injection via fmt.Sprintf | Critical |
| VNX-GO-004 | TLS InsecureSkipVerify enabled | High |
| VNX-GO-005 | Go open redirect | Medium |
| VNX-GO-006 | Go server-side request forgery | High |
| VNX-GO-007 | Go path traversal | High |
| VNX-GO-008 | Go weak PRNG for security | Medium |
| VNX-GO-009 | Go text/template used for HTML | High |
| VNX-GO-010 | Go weak cipher usage | High |
| VNX-GO-011 | Go gob deserialization from HTTP request | Medium |
| VNX-GO-012 | Go HTTP response header injection (CRLF) | Medium |
| VNX-GO-013 | Go zip/tar slip via archive entry name | High |
| VNX-GO-014 | Go sync.Mutex Lock() without deferred Unlock() | Medium |
| VNX-GO-015 | Go sync.WaitGroup.Add() called inside goroutine | Medium |
| VNX-GO-016 | Go integer downcast after strconv.Atoi/ParseInt | Medium |
| VNX-GO-017 | Go SQL injection via fmt.Sprintf in db.Exec or db.Query | High |
| VNX-GO-018 | Go arbitrary file write via os.WriteFile with user-controlled path | High |
| VNX-GO-019 | Go server binding to all interfaces (0.0.0.0) without authentication | Medium |
| VNX-GO-020 | Use of template.HTML with potential user input | Medium |
| VNX-GO-021 | Potential XSS via fmt.Fprintf with HTML tags | Medium |
| VNX-GO-022 | Use of eval() or dynamic code execution | High |
| VNX-GO-023 | SQL injection via string concatenation | High |
| VNX-GO-024 | Missing input validation on HTTP request parameters | Medium |
| VNX-GO-025 | Potential open redirect via HTTP redirect | Medium |
| VNX-GO-026 | Missing file type validation on upload | High |
| VNX-GO-027 | Potential path traversal via file path construction | High |
| VNX-GO-028 | Use of weak cryptographic hash for password hashing | High |
| VNX-GO-029 | Hardcoded weak or default password | High |
| VNX-GO-030 | Missing Secure flag on cookie | Medium |
| VNX-GO-031 | Missing signature validation on JWT | High |
| VNX-GO-032 | JWT missing expiration validation | Medium |
| VNX-GO-033 | JWT missing audience validation | Medium |
| VNX-GO-034 | OAuth redirect URI without validation against allowlist | Medium |
| VNX-GO-035 | Missing HttpOnly flag on cookie | Medium |
| VNX-GO-036 | Use of ECB block mode | High |
| VNX-GO-037 | Missing security headers in HTTP response | Medium |
| VNX-GO-038 | Potential mass assignment via struct binding | Medium |
| VNX-GO-039 | Missing rate limiting on login endpoint | Medium |
| VNX-GO-040 | Logging of sensitive data | High |
| VNX-GO-041 | Use of deprecated TLS version | High |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-GQL-001 | GraphQL introspection enabled in production | Medium |
| VNX-GQL-002 | GraphQL query depth/batching enables DoS | Medium |
| VNX-GQL-003 | GraphQL query string injection via string concatenation | High |
| VNX-GQL-004 | GraphQL field suggestion disclosure enabled | Low |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-JAVA-001 | Command injection via Runtime.exec() | High |
| VNX-JAVA-002 | Spring actuator endpoints exposed | Medium |
| VNX-JAVA-003 | SQL injection via string concatenation | Critical |
| VNX-JAVA-004 | XML external entity (XXE) injection | High |
| VNX-JAVA-005 | Insecure deserialization | Critical |
| VNX-JAVA-006 | Insecure TLS trust manager | Critical |
| VNX-JAVA-007 | Java open redirect | Medium |
| VNX-JAVA-008 | Java server-side request forgery | High |
| VNX-JAVA-009 | Java path traversal | High |
| VNX-JAVA-010 | Spring CSRF protection disabled | Medium |
| VNX-JAVA-011 | Java expression language injection | Critical |
| VNX-JAVA-012 | Java LDAP injection | High |
| VNX-JAVA-013 | Java XPath injection | High |
| VNX-JAVA-014 | Java zip slip via ZipEntry getName() | High |
| VNX-JAVA-015 | Java JPQL/HQL injection via string concatenation | High |
| VNX-JAVA-016 | Java weak PRNG (java.util.Random) for security | High |
| VNX-JAVA-017 | Java HTTP response splitting (CRLF) | High |
| VNX-JAVA-018 | Java RSA cipher without OAEP padding | High |
| VNX-JAVA-019 | Java hardcoded cryptographic key literal | Critical |
| VNX-JAVA-020 | Java static IV reuse in block cipher | High |
| VNX-JAVA-021 | Java sensitive data logged (password, token, secret) | Medium |
| VNX-JAVA-022 | Java insecure temporary file creation | Medium |
| VNX-JAVA-023 | Java unrestricted file upload | High |
| VNX-JAVA-024 | Java XML entity expansion (Billion Laughs) | High |
| VNX-JAVA-025 | Java hardcoded password or credential | Critical |
| VNX-JAVA-026 | Java Spring file serving without access control | High |
| VNX-JAVA-027 | Java Spring security headers disabled | Medium |
| VNX-JAVA-028 | SQL injection via string concatenation in Java | High |
| VNX-JAVA-029 | XML External Entity (XXE) via DocumentBuilderFactory | High |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-JWT-001 | JWT signature verification disabled | Critical |
| VNX-JWT-002 | JWT token signed without expiration | Medium |
| VNX-JWT-003 | JWT signing with hardcoded secret | High |
| VNX-JWT-004 | JWT algorithm explicitly set to ’none' | Critical |
| VNX-JWT-005 | Sensitive credential data stored in JWT payload | High |
| VNX-JWT-006 | JWT missing audience or issuer verification | Medium |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-KOTLIN-001 | Kotlin ECB cipher mode — deterministic, unauthenticated encryption | High |
| VNX-KOTLIN-002 | Kotlin RSA key smaller than 2048 bits | High |
| VNX-KOTLIN-003 | Kotlin cookie missing HttpOnly flag | Medium |
| VNX-KOTLIN-004 | Kotlin unencrypted plain socket (cleartext transmission) | High |
| VNX-KOTLIN-005 | Kotlin MD5 or SHA-1 used as cryptographic hash | Medium |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-LLM-001 | LLM prompt injection via user-controlled input | High |
| VNX-LLM-002 | LLM output passed to code execution (RCE) | Critical |
| VNX-LLM-003 | Hardcoded LLM API key | Critical |
| VNX-LLM-004 | User input directly in LLM system prompt | High |
| VNX-LLM-005 | LangChain arbitrary code execution tool enabled | Critical |
| VNX-LLM-006 | LLM output interpolated into SQL query | Critical |
| VNX-LLM-007 | torch.load() without weights_only=True | High |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-NODE-001 | Missing npm lock file | High |
| VNX-NODE-002 | eval() or new Function() in JavaScript | High |
| VNX-NODE-003 | Command injection via child_process | High |
| VNX-NODE-004 | Express app without helmet | Medium |
| VNX-NODE-005 | innerHTML or dangerouslySetInnerHTML usage | Medium |
| VNX-NODE-006 | Prototype pollution via merge | High |
| VNX-NODE-007 | Node.js SQL injection | Critical |
| VNX-NODE-008 | Node.js open redirect | Medium |
| VNX-NODE-009 | Node.js server-side request forgery | High |
| VNX-NODE-010 | Node.js path traversal | High |
| VNX-NODE-011 | Node.js server-side template injection | Critical |
| VNX-NODE-012 | Client-side XSS via innerHTML or v-html | High |
| VNX-NODE-013 | Node.js command injection via child_process | Critical |
| VNX-NODE-014 | NoSQL injection in MongoDB | High |
| VNX-NODE-015 | WebSocket server without origin verification (CSWSH) | Medium |
| VNX-NODE-016 | ReDoS via user-controlled regular expression | Medium |
| VNX-NODE-017 | Insecure deserialization via node-serialize | Critical |
| VNX-NODE-018 | JWT decoded without signature verification | High |
| VNX-NODE-019 | Hardcoded JWT or session secret | High |
| VNX-NODE-020 | Deprecated crypto.createCipher/createDecipher without IV | High |
| VNX-NODE-021 | XXE via libxmljs with noent:true | High |
| VNX-NODE-022 | Shell injection via shelljs exec() | Critical |
| VNX-NODE-023 | Unsafe YAML.load() with untrusted input | High |
| VNX-NODE-024 | postMessage without origin validation | Medium |
| VNX-NODE-025 | Insecure express-session or cookie-session configuration | Medium |
| VNX-NODE-026 | Child process spawn with shell:true | High |
| VNX-NODE-027 | Assignment to innerHTML without sanitization | High |
| VNX-NODE-028 | Missing Content-Security-Policy header | Medium |
| VNX-NODE-029 | Missing HttpOnly flag on cookie | Medium |
| VNX-NODE-030 | TURN server allowing reserved IP addresses | Medium |
| VNX-NODE-031 | Logging of sensitive data | High |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-PHP-001 | Missing composer.lock | High |
| VNX-PHP-002 | Dangerous function in PHP | High |
| VNX-PHP-003 | PHP file inclusion with variable path | Critical |
| VNX-PHP-004 | PHP open redirect | Medium |
| VNX-PHP-005 | PHP server-side request forgery | High |
| VNX-PHP-006 | PHP object injection via unserialize | Critical |
| VNX-PHP-007 | PHP extract on superglobal | High |
| VNX-PHP-008 | PHP phpinfo exposure | Medium |
| VNX-PHP-009 | PHP preg_replace with /e modifier | Critical |
| VNX-PHP-010 | PHP type juggling in comparison | High |
| VNX-PHP-011 | PHP SQL injection via string concatenation | Critical |
| VNX-PHP-012 | PHP reflected XSS via echo/print of user input | High |
| VNX-PHP-013 | PHP XXE via LIBXML_NOENT or LIBXML_DTDLOAD | High |
| VNX-PHP-014 | PHP session fixation via user-controlled session ID | High |
| VNX-PHP-015 | PHP unrestricted file upload via move_uploaded_file | High |
| VNX-PHP-016 | PHP weak hash function (md5/sha1) | Medium |
| VNX-PHP-017 | PHP LDAP injection via user-controlled filter | High |
| VNX-PHP-018 | PHP sensitive debug output disclosure | Medium |
| VNX-PHP-019 | PHP insecure cipher mode (AES-CBC) | Medium |
| VNX-PHP-020 | PHP curl SSL certificate verification disabled | High |
| VNX-PHP-021 | Laravel mass assignment via empty guarded array | High |
| VNX-PHP-022 | PHP open redirect via non-literal redirect destination | Medium |
| VNX-PHP-023 | PHP anonymous LDAP bind without password | High |
| VNX-PHP-024 | PHP mb_ereg_replace with eval modifier | Critical |
| VNX-PHP-025 | PHP deprecated mcrypt encryption functions | High |
| VNX-PHP-026 | PHP session poisoning via user-controlled session key | High |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-PY-001 | Missing Python lock file | High |
| VNX-PY-002 | eval()/exec() usage in Python | High |
| VNX-PY-003 | Insecure deserialization with pickle | High |
| VNX-PY-004 | yaml.load() without SafeLoader | High |
| VNX-PY-005 | Weak PRNG for security operations | Medium |
| VNX-PY-006 | Django DEBUG=True | Medium |
| VNX-PY-007 | subprocess with shell=True | High |
| VNX-PY-008 | Flask debug mode enabled | High |
| VNX-PY-009 | Jinja2 autoescape disabled | High |
| VNX-PY-010 | SSL verification disabled in requests | High |
| VNX-PY-011 | Python SQL injection | Critical |
| VNX-PY-012 | Python server-side template injection | Critical |
| VNX-PY-013 | Python ML/AI insecure deserialization | Critical |
| VNX-PY-014 | Python XML external entity injection | High |
| VNX-PY-015 | Python ReDoS via user-controlled regular expression | Medium |
| VNX-PY-016 | Django mass assignment via request data unpacking | High |
| VNX-PY-017 | MD5 or SHA1 used as password hash | High |
| VNX-PY-018 | Insecure temporary file creation via tempfile.mktemp() | Medium |
| VNX-PY-019 | Paramiko implicit host key trust | High |
| VNX-PY-020 | tarfile.extractall() without path validation (zip slip) | High |
| VNX-PY-021 | Weak or deprecated SSL/TLS protocol version | High |
| VNX-PY-022 | SQL injection via string concatenation in Python | High |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-RUBY-001 | Missing Gemfile.lock | High |
| VNX-RUBY-002 | eval() or system() in Ruby | High |
| VNX-RUBY-003 | Insecure deserialization in Ruby | Critical |
| VNX-RUBY-004 | Ruby SQL injection | Critical |
| VNX-RUBY-005 | Ruby XSS via html_safe or raw | High |
| VNX-RUBY-006 | Ruby mass assignment | High |
| VNX-RUBY-007 | YAML.load() insecure deserialization | Critical |
| VNX-RUBY-008 | Open3.pipeline with dynamic command | High |
| VNX-RUBY-009 | Ruby dynamic method dispatch via send with user input | High |
| VNX-RUBY-010 | OpenSSL certificate verification disabled (VERIFY_NONE) | High |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-RUST-001 | Missing Cargo.lock | High |
| VNX-RUST-002 | Rust unwrap may panic | Low |
| VNX-RUST-003 | Rust unsafe block | Medium |
| VNX-RUST-004 | Rust command injection via process::Command with format! | High |
| VNX-RUST-005 | panic!() or unwrap()/expect() in function returning Result | Medium |
| VNX-RUST-006 | Integer truncation or sign-change cast after parsing | Medium |
| VNX-RUST-007 | Rust integer arithmetic overflow without checked arithmetic | Medium |
| VNX-RUST-008 | Rust path traversal in Actix-web or Axum file-serving handler | High |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-SEC-001 | AWS access key ID | Critical |
| VNX-SEC-002 | Private key committed | Critical |
| VNX-SEC-003 | AWS secret access key | Critical |
| VNX-SEC-004 | GitHub or GitLab token | Critical |
| VNX-SEC-005 | GCP API key | Critical |
| VNX-SEC-006 | Stripe secret key | Critical |
| VNX-SEC-007 | Slack token or webhook | High |
| VNX-SEC-008 | Database connection string with credentials | Critical |
| VNX-SEC-009 | SendGrid API key | High |
| VNX-SEC-010 | Package registry token | Critical |
| VNX-SEC-011 | Hardcoded JWT token | High |
| VNX-SEC-012 | CORS wildcard or origin reflection | High |
| VNX-SEC-013 | Insecure cookie configuration | Medium |
| VNX-SEC-014 | Hardcoded password in variable | High |
| VNX-SEC-015 | JWT algorithm none attack | Critical |
| VNX-SEC-016 | TLS verification disabled in shell command | Medium |
| VNX-SEC-017 | Plaintext protocol URL | Medium |
| VNX-SEC-018 | AI provider API key | Critical |
| VNX-SEC-019 | GCP service account key | Critical |
| VNX-SEC-020 | GitLab access token | Critical |
| VNX-SEC-021 | Twilio API credentials | Critical |
| VNX-SEC-022 | Sensitive data in log statement | Medium |
| VNX-SEC-023 | GitHub Actions expression injection via event data | High |
| VNX-SEC-024 | OAuth token stored in localStorage | Medium |
| VNX-SEC-025 | Azure Storage Account key hardcoded | Critical |
| VNX-SEC-026 | DigitalOcean personal access token hardcoded | Critical |
| VNX-SEC-027 | Hugging Face API token hardcoded | High |
| VNX-SEC-028 | npm access token hardcoded | High |
| VNX-SEC-029 | PyPI upload token hardcoded | High |
| VNX-SEC-030 | Google OAuth client secret hardcoded | High |
| VNX-SEC-031 | Mailgun API key hardcoded | High |
| VNX-SEC-032 | PGP private key block hardcoded | Critical |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-SWIFT-001 | Swift hardcoded API key or secret in source | High |
| VNX-SWIFT-002 | Swift NSLog with potentially sensitive data | Medium |
| VNX-SWIFT-003 | Swift insecure data storage via UserDefaults for sensitive values | High |
| VNX-SWIFT-004 | Swift TLS certificate validation disabled | High |
| VNX-SWIFT-005 | Swift WKWebView JavaScript auto-open-windows enabled | Medium |
| VNX-SWIFT-006 | Swift insecure random number generator (arc4random/rand) | Medium |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-TF-001 | Terraform AWS S3 bucket with public ACL | High |
| VNX-TF-002 | Terraform AWS security group with unrestricted ingress (0.0.0.0/0) | High |
| VNX-TF-003 | Terraform AWS RDS instance publicly accessible | High |
| VNX-TF-004 | Terraform IAM policy with wildcard Action (*) | High |
| VNX-TF-005 | Terraform AWS EBS volume unencrypted | Medium |
| VNX-TF-006 | Terraform AWS EC2 IMDSv1 enabled (SSRF risk) | Medium |
| VNX-TF-007 | Terraform AWS EKS cluster public API endpoint | Medium |
| VNX-TF-008 | Terraform AWS provider with hardcoded static credentials | Critical |
| Rule ID | Name | Severity |
|---|---|---|
| VNX-HTML-001 | Use of Jinja2 |safe filter | Medium |
These rules use broad pattern matching across multiple languages to detect common CWE vulnerability patterns. They may have higher false positive rates than the language-specific rules above.
| Rule ID | Name | Severity | Languages |
|---|---|---|---|
| VNX-1004 | Excessive Use of Resource | Medium | Go, Java, Node.js, PHP, Python, Ruby |
| VNX-1021 | Improper Restriction of Rendered UI Layers | Medium | Java, Node.js, PHP, Python, Ruby |
| VNX-1025 | Improper Comparison of User-Supplied Input | Medium | Go, Node.js, Python |
| VNX-1037 | Process Injection | Medium | Go, Java, Node.js, PHP, Python, Ruby |
| VNX-1041 | SQL Injection via External Input | Medium | Go, Java, Node.js, PHP, Python |
| VNX-1043 | Non-Thread-Safe Lock | Medium | Go, Java, Python |
| VNX-1044 | File Upload without Size Limit | Medium | Go, Java, Node.js, PHP, Python |
| VNX-1045 | File Upload without Type Restriction | Medium | Go, Java, Node.js, PHP, Python |
| VNX-1046 | Open Redirect to Untrusted Site | Medium | Go, Java, Node.js, PHP, Python |
| VNX-1047 | SSRF without Timeout | Medium | Go, Java, Node.js, PHP, Python |
| VNX-1048 | Sensitive Data in Referrer | Medium | Go, Java, Node.js, PHP, Python |
| VNX-1052 | Excessive Resource Usage | Medium | Go, Java, Node.js, Python |
| VNX-1054 | GUI Input without Validation | Medium | Go, Java, Node.js, PHP, Python |
In addition to the built-in rules above, the following official community packs can be loaded on-demand with --rule:
| Pack | Rules | Languages | Description |
|---|---|---|---|
Vulnetix/opa-py-ruff | 956 | Python | Clean-room OPA/Rego implementations of all Ruff Python linting rules — pyflakes, pycodestyle, flake8-bandit, flake8-bugbear, pyupgrade, and 50+ more linters. Rule IDs use the RUFF- prefix (e.g. RUFF-S101, RUFF-E711). |
Vulnetix/opa-gosec | 60 | Go | gosec security rules for Go |
Vulnetix/opa-fugue-regula | 275 | Terraform, CloudFormation | Fugue Regula IaC security rules |
Vulnetix/opa-aquasecurity-trivy | 107 | Terraform, Kubernetes | Trivy misconfiguration rules |
Vulnetix/opa-checkmarx-kics | 205 | Terraform, Dockerfile, Kubernetes | KICS IaC security queries |
Vulnetix/opa-cigna-tf | 88 | Terraform | Cigna Terraform compliance rules |
Load any pack alongside the built-in rules:
vulnetix scan --rule Vulnetix/opa-py-ruff
# Python-only scan with Ruff rules, no built-in rules
vulnetix sast --rule Vulnetix/opa-py-ruff --disable-default-rules
See Custom Rule Repositories for authoring your own rules.