Update rule metadata

[hashicorp-vault-sonar-prod]

Rule Metadata Update Summary

Sonarpedia	Rules to update	Rules updated
./sonarpedia.json	245	1
Total	245	1

Rule API Version: 2.19.0.5763

This PR was automatically generated to update rule metadata across all supported languages.

[sonar-review-alpha]

Summary

S2092 rule metadata update: Out of 245 rules available for synchronization, this PR updates a single rule — the cookie security check (S2092). The rule has been reclassified from SECURITY_HOTSPOT to VULNERABILITY, with an updated title ("Cookies should have the 'secure' flag"). The rule documentation was restructured to follow SonarSource's updated template format, replacing "Sensitive/Compliant" sections with "Why is this an issue? / How to fix it?" flow with expanded attack scenario details. The metadata change includes a "former-hotspot" tag to mark the transition. The sonarpedia.json timestamp was updated to reflect the sync date (2026-04-09).

What reviewers should know

Key files to review:

• S2092.json — Metadata changes: type changed from SECURITY_HOTSPOT → VULNERABILITY, title updated, "former-hotspot" tag added
• S2092.html — Documentation restructured with new section headings and expanded security impact explanation; comment labels changed from "Sensitive" to "Noncompliant"

What to watch for:

• The vulnerability type change may affect how the rule is reported/prioritized in SonarQube UI
• The "former-hotspot" tag indicates this rule no longer requires security review-level remediation (it's now a straightforward vulnerability)
• Documentation changes are structural only — no logic or severity changes to the underlying rule implementation itself

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[sonar-review-alpha]

Conclusion: The metadata changes look correct — the reclassification from SECURITY_HOTSPOT to VULNERABILITY is appropriate since missing a secure flag on a cookie is a definitive issue (no false-positive review needed). One documentation gap needs attention before merge.

🗣️ Give feedback