valgen-validations provides validators for the build-time valgen code generator. See the engine's SECURITY.md for the full trust model; the key points:

validations.New() builds the standard validators with explicit configuration; its Generators() returns a plain slice you feed to the top-level engine (gen.New(...).Run()). Your generator main chains exactly the set and config it trusts; there is no init()-based auto-registration and no global mutator:

func main() {
	gens := validations.New().
		Nullable("github.com/guregu/null", "String", // custom presence wrapper, explicit
			validations.Nullable{Present: "%s.Valid", Absent: "!%s.Valid", Read: "%s.String"}).
		ErrorBuilder(myBuilder). // custom error type, explicit
		Generators()
	gens = append(gens, mypkg.PasswordGen{}) // custom validator, explicit

	if err := gen.New(gens...).Run(); err != nil {
		log.Fatal(err)
	}
}

The three former injection vectors are all closed: the validator set, the nullable-wrapper config, and the error builder are configured only through this builder chain — none has a global mutator. So a compromised transitive dependency's init() cannot inject a generator, a wrapper, or a malicious error expression into your generated output.

The default generator command (cmd/valgen-validations) accepts flags for non-code settings only — directory, patterns, tags, output name, mode, namespace, and selecting one of the three baked-in error builders. Flags never change which validators run or supply arbitrary code, so they do not widen the trust surface; code-level customization still requires an explicit generator main as above.

Importing any Go package still runs its init() at generation time on your build/CI machine (inherent to Go). It cannot reach your generated output, but you should still pin/vendor generator dependencies, run go generate in a hermetic CI environment, review the valgen_gen.go diff, and add a regenerate + git diff --exit-code guard to CI.

Your application imports only the runtime validations package (for Violation) and the generated code — it never imports the gen package, so there is no generator code in your shipped binary.

Report security issues privately via GitHub Security Advisories on this repository.