What
The Semgrep adapter ships a small, offline, version-controlled rule pack (semgrep_rules/) that targets patterns Bandit's plain AST matching can't reach (SSRF, Flask SSTI, hard-coded creds, JWT bypass). Add one more high-value rule.
Suggested scope
- Pick a CWE not already covered by Bandit or the existing rules (e.g. CWE-611 XXE, CWE-22 path traversal via a request value, or CWE-94 code injection).
- Add the rule as a local YAML file under
packages/cortexward-scanners/.../semgrep_rules/, resolved via importlib.resources (fully offline — never --config=auto or a registry shorthand).
- Add both a vulnerable and a safe fixture, and extend
TestBundledRules so the rule is empirically verified to fire on the vulnerable one and stay silent on the safe one (the project's rule bar — assert behavior, not just that the YAML parses).
Why it's a good first issue
Well-scoped, additive, and the existing rules + tests are a clear template to copy.
Pointers
- Adapter + rules:
packages/cortexward-scanners/src/cortexward/scanners/semgrep_scanner.py and semgrep_rules/
- Tests:
TestBundledRules in the scanners test suite
What
The Semgrep adapter ships a small, offline, version-controlled rule pack (
semgrep_rules/) that targets patterns Bandit's plain AST matching can't reach (SSRF, Flask SSTI, hard-coded creds, JWT bypass). Add one more high-value rule.Suggested scope
packages/cortexward-scanners/.../semgrep_rules/, resolved viaimportlib.resources(fully offline — never--config=autoor a registry shorthand).TestBundledRulesso the rule is empirically verified to fire on the vulnerable one and stay silent on the safe one (the project's rule bar — assert behavior, not just that the YAML parses).Why it's a good first issue
Well-scoped, additive, and the existing rules + tests are a clear template to copy.
Pointers
packages/cortexward-scanners/src/cortexward/scanners/semgrep_scanner.pyandsemgrep_rules/TestBundledRulesin the scanners test suite