Close CWE Top 25 / OWASP Top 10 gaps: 12 semgrep rules, actionlint + zizmor, generated coverage matrix by arootroatch · Pull Request #4 · cleancoders/github-actions

feat: union clj-holmes rule sources and add the first custom rule

arootroatch

committed

e796fb1

feat(rules): detect SQL built by string concatenation

arootroatch

committed

89eed72

refactor: move custom rules to semgrep; clj-holmes keeps upstream rules only

arootroatch

committed

b1ff1bd

feat(rules): detect shell and runtime-code-loading sinks

arootroatch

committed

8d5096e

feat(rules): add low-precision triage rules for traversal and fail-open

arootroatch

committed

a35b04e

feat(rules): detect nippy and SnakeYAML deserialization sinks

arootroatch

committed

ef3f978

feat(rules): detect spec/malli explain output in response bodies

arootroatch

committed

c93c20a

feat: add actionlint and zizmor jobs, and fix what they found

arootroatch

committed

0f5d242

feat: generate the scanner coverage matrix from rule metadata

arootroatch

committed

5c937e4

docs: document the new inputs, scanners, and coverage limits

arootroatch

committed

dbd131e

fix(rules): file cc-shell-exec under the command-injection class

arootroatch

committed

0b33e4d

Navigation Menu

Repository navigation

Close CWE Top 25 / OWASP Top 10 gaps: 12 semgrep rules, actionlint + zizmor, generated coverage matrix - #4

Close CWE Top 25 / OWASP Top 10 gaps: 12 semgrep rules, actionlint + zizmor, generated coverage matrix#4
arootroatch merged 15 commits into
masterfrom
security-cwe-owasp

Commits on Jul 27, 2026

feat: union clj-holmes rule sources and add the first custom rule

feat(rules): detect SQL built by string concatenation

refactor: move custom rules to semgrep; clj-holmes keeps upstream rules only

feat(rules): detect shell and runtime-code-loading sinks

feat(rules): add low-precision triage rules for traversal and fail-open

feat(rules): detect nippy and SnakeYAML deserialization sinks

feat(rules): detect spec/malli explain output in response bodies

feat: add actionlint and zizmor jobs, and fix what they found

feat: generate the scanner coverage matrix from rule metadata

docs: document the new inputs, scanners, and coverage limits

fix(rules): file cc-shell-exec under the command-injection class

Commits on Jul 28, 2026

fix: drop vestigial pull-requests: write from security.yml

fix: decide clj-holmes pass/fail ourselves instead of --fail-on-result

refactor: one tested detect job; drop security-skips; clear Node 20 pins

Merge master into security-cwe-owasp