secretsgen

Overview ¶

Command secretsgen renders the high-fidelity secret-detection rule set and its documentation from a single source of truth: catalog.json.

For every catalog entry it emits:

• internal/sast/rules/vnx-sec-<id>.rego (the OPA rule)
• a row in website/content/docs/sast-rules/secrets/<category>.md

Rules and docs are therefore guaranteed never to drift. Run via:

just gen-secrets        # go run ./internal/sast/secretsgen

The catalog is build-time only and is NOT embedded in the shipped binary (it lives outside internal/sast/rules, which is the only embedded tree).