Close CWE Top 25 / OWASP Top 10 gaps: 12 semgrep rules, actionlint + zizmor, generated coverage matrix - #4

Merged

arootroatch merged 15 commits into

security-cwe-owasp

Jul 28, 2026

Commits on Jul 27, 2026

feat: union clj-holmes rule sources and add the first custom rule
arootroatch
committed
e796fb1
feat(rules): detect SQL built by string concatenation
arootroatch
committed
89eed72
refactor: move custom rules to semgrep; clj-holmes keeps upstream rules only
arootroatch
committed
b1ff1bd
feat(rules): detect shell and runtime-code-loading sinks
arootroatch
committed
8d5096e
feat(rules): add low-precision triage rules for traversal and fail-open
arootroatch
committed
a35b04e
feat(rules): detect nippy and SnakeYAML deserialization sinks
arootroatch
committed
ef3f978
feat(rules): detect spec/malli explain output in response bodies
arootroatch
committed
c93c20a
feat: add actionlint and zizmor jobs, and fix what they found
arootroatch
committed
0f5d242
feat: generate the scanner coverage matrix from rule metadata
arootroatch
committed
5c937e4
docs: document the new inputs, scanners, and coverage limits
arootroatch
committed
dbd131e
fix(rules): file cc-shell-exec under the command-injection class
arootroatch
committed
0b33e4d