Hub rules-security

rules-security

v2 public Verified

Security

These rules govern general security best practices, vulnerability prevention, and secure coding standards. They provide a framework for AI agents to develop and maintain secure software systems.

@sigmashakeinc 2 pulls 8 rules published Apr 8, 2026 synced Oct 11, 2026 sigmashakeinc/rules/rulesets/rules-security →
Severity
7 error 1 warn 0 info
demo.cast
These rules govern general security best practices, vulnerability prevention, and secure coding standards. They provide a framework for AI agents to develop and maintain secure software systems.

Rules index

8 governance rules

Indexed from the repository's .rules files, grouped by technology. Expand any rule to read the raw source.

security

ask-disable-ssl-verify error log

SSL/TLS certificate verification is disabled. This makes connections vulnerable to man-in-the-middle attacks. Fix the certificate issue instead of disabling verification.

Rule source requires an active Pro or Enterprise subscription.
no-cors-wildcard-with-credentials error block

CORS wildcard (*) with credentials:true is rejected by browsers and is a security misconfiguration. Specify explicit allowed origins for authenticated APIs.

Rule source requires an active Pro or Enterprise subscription.
no-hardcoded-password error block

Hardcoded password detected. Store credentials in environment variables or a secrets manager — never in source code.

Rule source requires an active Pro or Enterprise subscription.
no-insecure-random error block

Math.random() and Python's random module are not cryptographically secure. Use crypto.randomBytes() (Node.js) or secrets.token_hex() (Python) for security-sensitive values.

Rule source requires an active Pro or Enterprise subscription.
no-md5-sha1-crypto warning log

MD5 and SHA-1 are cryptographically broken and must not be used for security purposes (passwords, signatures, certificates). Use SHA-256 or bcrypt/argon2 for passwords.

Rule source requires an active Pro or Enterprise subscription.
no-path-traversal error log

File operations with user-controlled path components enable path traversal attacks (../../etc/passwd). Validate that the resolved path is within an allowed base directory using path.resolve() and startsWith() checks.

Rule source requires an active Pro or Enterprise subscription.
no-ssrf-unvalidated-url error log

Fetching URLs from user-controlled input enables Server-Side Request Forgery (SSRF). Validate URLs against an allowlist of trusted domains and block requests to private IP ranges (10.x, 172.16-31.x, 192.168.x, 169.254.x).

Rule source requires an active Pro or Enterprise subscription.
no-xml-external-entities error block

Standard XML parsers are vulnerable to XXE (XML External Entity) injection. Use defusedxml (Python) or disable external entities in the parser configuration.

Rule source requires an active Pro or Enterprise subscription.

Version metadata

Published metadata

The hash-locked record of this published ruleset. When source contents change, the maintainer resyncs and the version bumps.

Version
v2
Published
Apr 8, 2026
Source commits
0
Synced
Oct 11, 2026
Hash
01007c2388f41c53887c4f6608fe1873aec1eae4d9c51559133c47fa34f5eb6e
Signature
Verified (publisher key)
Tested with
claude-code@current
Plan
Starter (free)
Visibility
Public

Source history

Recent commits

Latest commits touching rulesets/rules-security/.sigmashake/rules in sigmashakeinc/rules/rulesets/rules-security. The published version only bumps when a maintainer resyncs.

No commit history available.