@gspothq/cli 0.1.1 → 0.2.0

package/configurations/general/prose/manifest.toml

@@ -1,39 +1,28 @@
 allowed_words = ["Vale", "DOM", "DTO", "RPC"]
 
 [configuration]
-title = "Prose"
 always_selected = true
-description = "Vale over every comment and every documentation file, with the gspot style, and the upstream packages."
+description = "Runs Vale with the gspot style and upstream packages over comments and documentation files."
+title = "Prose"
 
 [files]
 extensions = [".md", ".mdx", ".ts", ".tsx", ".mts", ".cts", ".js", ".mjs", ".cjs", ".jsx", ".swift", ".css", ".sh", ".bash", ".zsh", ".py", ".sql", ".pgsql", ".psql"]
 tags = ["shebang:shell"]
 
 [[tool]]
-name = "vale"
-version = "3.21.0"
-mise = "vale"
 brew = "vale"
-winget = "errata-ai.Vale"
-scoop = "vale"
 github = { name = "errata-ai/vale", version = "v3.21.0" }
+mise = "vale"
+name = "vale"
+replace = [".vale.ini", "_vale.ini", "vale.ini"]
+scoop = "vale"
 suppression = { marker = "^<!--\\s*vale\\b", reason = "reason: (?<reason>\\S.*)", forbidden = true }
-[[tool.replace]]
-file = ".vale.ini"
-shared = false
-
-[[tool.replace]]
-file = "_vale.ini"
-shared = false
-
-[[tool.replace]]
-file = "vale.ini"
-shared = false
+version = "3.21.0"
+winget = "errata-ai.Vale"
 
 [[tool_file]]
 target = ".gspot/config/vale.ini"
 tool = "vale"
-rule_keys = ["*.rules", "*.BasedOnStyles"]
 
 [[tool_file]]
 target = ".gspot/config/vale/styles/gspot/acronyms.yml"
@@ -75,12 +64,164 @@ tool = "vale"
 target = ".gspot/config/vale/styles/config/vocabularies/words/accept.txt"
 tool = "vale"
 
-[[check]]
-name = "vale"
+[[tool_file]]
+target = ".gspot/config/vale/styles/LICENSES.md"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/numbered-units.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/future.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/modals.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/product-centric-writing.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/contractions.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/dates.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/hedging.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/since.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/leading-conjunctions.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/date-ordinals.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/suspended-hyphens.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/link-text.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/locations.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/obvious-fields.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/symbols.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/merge-conflict-markers.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/percentage-numbers.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/militaristic-language.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/currency.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/marketing.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/straight-quotes.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/placeholders.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/history.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/dashes.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/ordinal-adverbs.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/interface-verbs.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/punctuated-headings.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/file-paths.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/self-reference.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/jargon.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/session-identifiers.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/url-prepositions.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/version-range.yml"
 tool = "vale"
-example = "The sentence `Release on 03/04/2026.` reports an ambiguous date at the recommended level. Write `Release on March 4, 2026.` when March 4 is the intended date, then rerun. Write legitimate project names in the root allowed_words setting."
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/ampm.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/time-ranges.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/conscious-language.yml"
+tool = "vale"
+
+[[tool_file]]
+target = ".gspot/config/vale/styles/gspot/idioms.yml"
+tool = "vale"
+
+[[check]]
+example = "`Release on 03/04/2026.` reports an ambiguous date. Write `Release on March 4, 2026.` instead."
+help = "Rewrite the sentence the alert names, add a real name and its reason to the root allowed_words setting, or use `gspot ignore prose/vale --rule <rule> --reason \"<why>\"`."
 level = "recommended"
+name = "vale"
 stage = "commit"
-summary = "Checks ambiguous dates, link text, and alternative text with bundled Vale styles at level `recommended`. Level `all` adds the complete style and upstream packages."
-why = "Prose that hedges, markets or wanders is read by everyone who reads the code, and nothing else checks it."
-help = "Rewrite the sentence the alert names, write a real name and its reason in the root allowed_words setting, or use gspot ignore prose/vale --rule `<rule>` --reason \"`<why>`\"."
+summary = "Checks ambiguous dates, link text, and alternative text with the shipped Vale styles at level `recommended`. Level `all` adds the complete style and upstream packages."
+tool = "vale"
+why = "Hedging, marketing, or wandering prose reaches everyone who opens the code, and no other check catches it."

package/configurations/general/prose/rules/WRITING.md

@@ -1,7 +1,11 @@
 # Writing
 
+Read this rule when you write text that people read in files: documentation, comments, messages, and commit messages.
+
+TALKING.md covers what you say to the user.
+
 Write in plain language under `ISO 24495-1`: short sentences and common words. State the action or result early.
-Use familiar words and explain a technical term when the reader needs it.
+Explain a technical term when the reader needs it.
 
 ## Evidence
 
@@ -10,7 +14,7 @@ A measurement does not guarantee future results. When evidence lacks required fa
 facts to the primary source; never invent behavior to complete a page.
 
 Preserve exact API identifiers, public messages, official product names, and legal license text.
-Keep private reasoning, temporary acceptance notes out of shipped content.
+Keep private reasoning and temporary notes out of shipped content.
 Examples use fictional people, safe values, and `example.com` addresses.
 
 ## Voice

package/configurations/general/repository/manifest.toml

@@ -1,24 +1,24 @@
 [configuration]
-title = "Repository"
 always_selected = true
 description = "Checks the files that Git tracks and their storage."
+title = "Repository"
 
 [[check]]
-name = "large-files"
-example = "A tracked `notes/big.txt` containing 1,100 KiB exceeds the default 1,024 KiB ceiling and reports `size`. Remove accidental content or store a required large file through Git LFS. Generated and vendored classifications must describe the actual file ownership."
+example = "A tracked `notes/big.txt` of 1,100 KiB, over the default limit of 1,024, reports `size`. Delete the file, or store it through Git LFS."
+help = "Track the file with Git LFS, classify it as generated or vendored in .gitattributes, or raise repository.max_file_kilobytes with a reason."
 level = "recommended"
-stage = "commit"
+name = "large-files"
 runs = "once"
-summary = "Checks that every tracked file over the size limit is stored through LFS or declared with a reason."
-why = "A large file in plain git history stays in every clone for good."
-help = "Track the file with git lfs, classify it with gspot set generated `<path>` or gspot set vendored `<path>`, or raise limits.file_kb with a reason."
+stage = "commit"
+summary = "Checks that each tracked file over the size limit goes through Git LFS or has a reason."
+why = "A large file in plain Git history stays in every clone forever."
 
 [[check]]
-name = "tracked-files"
-example = "A tracked .env or node_modules/example/index.js reports tracked-file. Add its path to .gitignore and run git rm --cached on that file, preserving its local contents."
+example = "A tracked `.env` reports `tracked-file`. Add the path to `.gitignore`, then run `git rm --cached .env`, which keeps the file on disk."
+help = "Add the reported file or folder to .gitignore and remove it from the index with `git rm --cached`."
 level = "recommended"
-stage = "commit"
+name = "local-files"
 runs = "once"
-summary = "Checks tracked files against the paths that selected configurations declare untracked."
+stage = "commit"
+summary = "Reports a tracked file at a path that a configuration keeps out of Git."
 why = "Machine-local values and installed packages belong outside shared Git history."
-help = "Add the reported file or folder to .gitignore and remove it from the index with git rm --cached."

package/configurations/general/secrets/manifest.toml

@@ -1,125 +1,104 @@
-
 [configuration]
-title = "Secrets"
 always_selected = true
 description = "Checks environment files and examples, scans staged changes and pushed commits for secrets, and requires reasons for allowed values."
+title = "Secrets"
 
 [files]
-paths = ["**"]
 kinds = ["source", "generated", "vendored", "binary"]
+paths = ["**"]
 
 [[tool]]
-name = "gitleaks"
-version = "8.30.1"
-min_version = "8.25.0"
-mise = "gitleaks"
 brew = "gitleaks"
 github = { name = "gitleaks/gitleaks", version = "v8.30.1" }
-winget = "Gitleaks.Gitleaks"
+min_version = "8.25.0"
+mise = "gitleaks"
+name = "gitleaks"
+replace = [".gitleaks.toml", "gitleaks.toml"]
 scoop = "gitleaks"
+version = "8.30.1"
 version_command = ["version"]
-[[tool.replace]]
-file = ".gitleaks.toml"
-shared = false
-
-[[tool.replace]]
-file = "gitleaks.toml"
-shared = false
+winget = "Gitleaks.Gitleaks"
 
 [[tool]]
-name = "trufflehog"
-crash_pattern = '"level"\s*:\s*"error"'
-version = "3.97.5"
-mise = "trufflehog"
 brew = "trufflehog"
+crash_pattern = '"level"\s*:\s*"error"'
 github = { name = "trufflesecurity/trufflehog", version = "v3.97.5" }
+mise = "trufflehog"
+name = "trufflehog"
+version = "3.97.5"
 
 [[tool]]
-name = "dotenv-linter"
-version = "4.0.0"
-mise = "github:dotenv-linter/dotenv-linter"
 brew = "dotenv-linter"
 cargo = "dotenv-linter"
 github = { name = "dotenv-linter/dotenv-linter", version = "v4.0.0" }
+mise = "github:dotenv-linter/dotenv-linter"
+name = "dotenv-linter"
+version = "4.0.0"
 
 [[tool_file]]
-source = "gitleaks.toml"
 target = ".gspot/config/gitleaks.toml"
 tool = "gitleaks"
 
 [[check]]
-name = "gitleaks-staged"
-example = "A staged credential reports a secret finding. Remove the credential from source, load it from the configured environment owner, and stage the fix. If the credential has been exposed, rotate it at its provider."
-level = "recommended"
-stage = "commit"
-runs = "once"
-when = { git = true }
 command = ["gitleaks", "git", "--staged", "--no-banner", "--redact", "--exit-code", "1", "--config", "{tool_file:gitleaks}", "--report-format", "json", "--report-path", "-", "{root}"]
+example = "A staged credential reports a finding. Load it from an environment variable instead, and rotate it if it already leaked."
+help = "Remove the value and load it from the environment. For a reviewed public value, use `gspot ignore` with its reported fingerprint and a reason."
+level = "recommended"
+name = "gitleaks-staged"
 output = { format = "json", fields = { file = "File", line = "StartLine", column = "StartColumn", rule = "Fingerprint", message = "Description" } }
+runs = "once"
+stage = "commit"
 summary = "Scans the staged change for keys, tokens, and passwords before the commit exists."
-why = "A secret that reaches a commit stays in history after the line is deleted, and every clone holds it."
-help = "Remove the value and load it from the environment. For a reviewed public value, use gspot ignore with its reported fingerprint and a reason."
+when = { git = true }
+why = "A secret that reaches a commit stays in history after you delete the line, and every clone holds it."
 
 [[check]]
-name = "gitleaks-pushed"
-example = "A credential in an earlier commit still reports after it is deleted from the working tree. Rotate the credential and remove it from the affected history, coordinating any rewrite of shared commits. Rerun the history scan."
+example = "A credential in an earlier commit still reports after you delete it from the working tree. Rotate it, then remove it from history, and coordinate any rewrite of shared commits."
+help = "Rewrite the commit that holds the value and rotate the secret. For a reviewed historical example, use `gspot ignore secrets/gitleaks-pushed --rule <fingerprint> --reason \"...\"`."
 level = "recommended"
-stage = "push"
-runs = "history"
-when = { git = true }
-tool = "gitleaks"
+name = "gitleaks-pushed"
 output = { format = "json", file_type = "history", fields = { file = "File", line = "StartLine", column = "StartColumn", rule = "Fingerprint", message = "Description" } }
+runs = "history"
+stage = "push"
 summary = "Scans every commit about to be pushed for keys, tokens, and passwords."
+tool = "gitleaks"
+when = { git = true }
 why = "A commit made past the hook still reaches the shared branch unless the push checks it."
-help = "Rewrite the commit that holds the value and rotate the secret. For a reviewed historical example, use gspot ignore secrets/gitleaks-pushed --rule `<fingerprint>` --reason \"...\"."
-
-[[check]]
-name = "gitleaks-files"
-example = "In a folder with no git, a credential in a source file reports a secret finding. Remove the credential from source and load it from the configured environment owner. If the credential has been exposed, rotate it at its provider."
-level = "recommended"
-stage = "commit"
-runs = "once"
-when = { git = false }
-command = ["gitleaks", "dir", "--no-banner", "--redact", "--exit-code", "1", "--config", "{tool_file:gitleaks}", "--report-format", "json", "--report-path", "-", "."]
-output = { format = "json", fields = { file = "File", line = "StartLine", column = "StartColumn", rule = "Fingerprint", message = "Description" } }
-summary = "Scans every file of a folder that has no git for keys, tokens, and passwords."
-why = "Without git there is no staged change to scan, so the files themselves are the only place a secret can be caught."
-help = "Remove the value and load it from the environment. For a reviewed public value, use gspot ignore with its reported fingerprint and a reason."
 
 [[check]]
-name = "trufflehog"
-example = "A committed credential that its provider confirms as active reports a verified secret. Revoke or rotate it at the provider and remove it from the affected history."
+example = "A committed credential that its provider confirms as active reports a verified secret. Rotate it at the provider, and remove it from history."
+exit_codes = [183]
+help = "Rotate the secret at its provider, then rewrite the commit that holds it."
 level = "recommended"
-stage = "push"
-runs = "history"
+name = "trufflehog-pushed"
 needs = ["network"]
-when = { git = true }
-tool = "trufflehog"
-exit_codes = [183]
 output = { format = "trufflehog", file_type = "history" }
+runs = "history"
+stage = "push"
 summary = "Verifies candidate secrets in the pushed commits against the service that issued them."
-why = "A verified secret is live right now, which makes it the finding to act on first."
-help = "Rotate the secret at its provider, then rewrite the commit that holds it."
+tool = "trufflehog"
+when = { git = true }
+why = "A verified secret still works, so fix that finding first."
 
 [[check]]
-name = "dotenv-linter"
-example = "A dotenv file defining the same key twice reports a duplicate entry. Keep the intended assignment and remove the duplicate, preserving secret values outside version control."
-level = "recommended"
-stage = "commit"
 command = ["dotenv-linter", "check", "--plain", "--skip-updates", "{files}"]
-fix = ["dotenv-linter", "fix", "--plain", "--no-backup", "{files}"]
+example = "A dotenv file that defines one key twice reports a duplicate. Keep one line, and delete the other."
 files = { filenames = [".env", ".dev.vars"], paths = [".env.*", "**/.env.*", ".dev.vars.*", "**/.dev.vars.*"] }
+fix = ["dotenv-linter", "fix", "--plain", "--no-backup", "{files}"]
+help = "Run `gspot check --fix`, or fix the line dotenv-linter names."
+level = "recommended"
+name = "dotenv-linter"
 output = { format = "regex", pattern = "^(?<file>[^:]+):(?<line>\\d+) (?<rule>[A-Za-z]+): (?<message>.*)$" }
+stage = "commit"
 summary = "Checks every tracked environment file: key format, duplicates, quoting, ordering, and trailing spaces."
-why = "A tracked environment file is a template other people copy; a malformed line there is copied into every machine."
-help = "Run gspot check --fix, or fix the line dotenv-linter names."
+why = "Other people copy a tracked environment file, so a malformed line in it spreads to every machine."
 
 [[check]]
-name = "env-examples"
-example = "Source code reading `API_URL` while the example environment file omits that key reports a missing example entry. Add `API_URL=` to `.env.example` and document the required value without committing credentials."
+example = "Code that reads `API_URL` while `.env.example` lacks that key reports a finding. Add `API_URL=` to `.env.example` with a note on the value, and no credential."
+help = "Add the key to `.env.example` or a file under `secrets.env_examples`, or stop reading it."
 level = "recommended"
-stage = "push"
+name = "env-examples"
 runs = "scope"
-summary = "When an example environment file exists, checks static uppercase keys read through process.env, import.meta.env, Bun.env, Deno.env.get, Python os APIs, and declared reader functions in JavaScript, TypeScript, Python, and component files."
-why = "A variable missing from the example file is the one a new machine lacks on its first run."
-help = "Add the key to the example file (.env.example or the files under secrets.env_examples), or stop reading it."
+stage = "push"
+summary = "Checks that an existing env example lists each static uppercase key that code reads through process.env, import.meta.env, Bun.env, Deno.env.get, the Python os module, or an environment function."
+why = "A variable missing from the env example breaks the first run on a new machine."

package/configurations/general/secrets/rules/SECRETS.md

@@ -1,5 +1,7 @@
 # Secrets
 
+Read this rule when code reads, stores, or logs a secret.
+
 - Never hardcode API keys, tokens, passwords, or secrets anywhere in the codebase.
 - Read secrets from the environment or a secret store in one configuration module. A secret has
   no fallback or default value.
@@ -7,7 +9,7 @@
 - Builds copy public build-time variables such as `NEXT_PUBLIC_*` and `VITE_*` into the bundle. They hold
   nothing secret.
 - Examples, documentation, templates, and sample files hold placeholders, never real secrets.
-- Keep actual local overrides in an ignored file.
+- Keep local overrides in an ignored file.
 - Never log secrets, tokens, passwords, cookies, authorization headers, or connection strings.
 - A published package lists its files explicitly; an ignored file can still leak through the
   defaults of a packaging tool.

package/configurations/general/security/manifest.toml

@@ -1,77 +1,54 @@
-allowed_words = ["Semgrep", "CodeQL"]
+allowed_words = ["Semgrep"]
+
 [configuration]
-title = "Security"
 always_selected = true
-description = "Static analysis for security patterns with Semgrep over every file a selected language claims, and CodeQL for configured project languages."
+description = "Runs Semgrep security rules over every file a language configuration claims."
+title = "Security"
 
 [files]
-languages = true
 extensions = [".plist"]
+languages = true
 
 [[tool]]
+brew = "semgrep"
+builds = ["macos", "linux"]
+min_version = "1.100.0"
+mise = "pipx:semgrep"
 name = "semgrep"
-version_command = ["--disable-version-check", "--version"]
+pypi = "semgrep"
+replace = [".semgrepignore"]
 suppression = { marker = "\\bnosemgrep\\b", reason = "reason: (?<reason>\\S.*)", forbidden = true }
 version = "1.178.0"
-min_version = "1.100.0"
-pypi = "semgrep"
-mise = "pipx:semgrep"
-brew = "semgrep"
-builds = ["macos", "linux"]
-[[tool.replace]]
-file = ".semgrepignore"
-shared = false
-
-[[tool]]
-name = "codeql"
-version = "2.24.3"
-brew = "codeql"
-github = { name = "github/codeql-cli-binaries", version = "v2.24.3" }
-# The CLI ships for x64 Linux only; its bundled Java does not run on arm64.
-builds = ["macos", "linux-x64", "windows"]
-# Query versions paired with github/codeql tag codeql-cli/v2.24.3.
-query_packs = { actions = "0.6.21", cpp = "1.5.12", csharp = "1.6.3", go = "1.5.7", java = "1.10.8", javascript = "2.3.3", python = "1.7.8", ruby = "1.5.8", rust = "0.1.28", swift = "1.2.17" }
+version_command = ["--disable-version-check", "--version"]
 
 [[tool_file]]
+per_scope = true
 target = ".semgrepignore"
 tool = "semgrep"
-per_scope = true
 
 [[check]]
-name = "semgrep"
-example = "Code matching a selected local Semgrep rule reports that rule ID and source location. For a rule banning dynamic evaluation, replace `eval(userInput)` with explicit parsing and permitted operations, then rerun the same rule set."
-level = "recommended"
-stage = "push"
-exit_codes = [1, 3]
 command = ["semgrep", "scan", "--strict", "--error", "--metrics", "off", "--disable-version-check", "--no-rewrite-rule-ids", "--quiet", "--json", "{files}"]
+example = "`eval(userInput)` matches a rule against dynamic evaluation and reports its ID and location. Parse the input instead, and allow only known operations."
+exit_codes = [1, 3]
+help = "Change the code the way the message says. Turn one rule off for a path with `gspot ignore security/semgrep --rule <id> --paths <glob> --reason \"<why>\"`."
+level = "recommended"
+name = "semgrep"
 output = { format = "semgrep" }
-summary = "Runs the Semgrep rule packs of the selected configurations, and the repository's own rules, over the changed files."
+stage = "push"
+summary = "Runs the Semgrep packs of each configuration, and the repository rules, over changed files."
 why = "An injection or a logged secret reads like ordinary code, and a pattern rule finds it before a reviewer has to."
-help = "Change the code the way the message says. Turn one rule off for a path with gspot ignore security/semgrep --rule `<id>` --paths `<glob>` --reason \"`<why>`\"."
 
 [[check]]
-name = "semgrep-registry"
-example = "Code matching a configured Semgrep registry rule reports its upstream rule ID. Correct the operation identified by that rule and rerun with network access. The configured rule set determines which patterns are findings."
-level = "recommended"
-stage = "manual"
+command = ["semgrep", "scan", "--strict", "{each:--config:tools.semgrep.registry_packs}", "--error", "--metrics", "off", "--disable-version-check", "--quiet", "--json", "{files}"]
+example = "Code that matches a registry rule reports its upstream ID. Fix the code at that location, then rerun with network access."
 exit_codes = [1, 3]
+help = "Change the code the way the message says, or turn the rule off for a path with `gspot ignore security/semgrep-registry --rule <id> --reason \"<why>\"`."
+level = "recommended"
+name = "semgrep-registry"
 needs = ["network"]
-when = { setting = "tools.semgrep.registry_packs" }
-command = ["semgrep", "scan", "--strict", "{each:--config:tools.semgrep.registry_packs}", "--error", "--metrics", "off", "--disable-version-check", "--quiet", "--json", "{files}"]
-tool = "semgrep"
 output = { format = "semgrep" }
-summary = "Runs the public Semgrep registry packs named in tools.semgrep.registry_packs, which the registry serves over the network."
-why = "The registry packs cover the common vulnerability classes, and their license keeps them out of this package."
-help = "Change the code the way the message says, or turn the rule off for a path with gspot ignore security/semgrep-registry --rule `<id>` --reason \"`<why>`\"."
-
-[[check]]
-name = "codeql"
-example = "A query constructed by concatenating request input into SQL reports a SQL-injection finding when the selected language query pack detects the flow. Use a parameterized database query and rerun with the language build prerequisites satisfied."
-level = "recommended"
 stage = "manual"
-runs = "once"
-tool = "codeql"
-when = { setting = "tools.codeql.languages" }
-summary = "Builds a CodeQL database for every language in tools.codeql.languages and runs the security suite over it."
-why = "Data-flow analysis follows a value from a request to a query across files, which a pattern rule cannot."
-help = "Change the code the result names. Record a false positive with gspot ignore security/codeql --rule `<id>` --paths `<glob>` --reason \"`<why>`\"."
+summary = "Downloads and runs the public Semgrep packs in `tools.semgrep.registry_packs`."
+tool = "semgrep"
+when = { setting = "tools.semgrep.registry_packs" }
+why = "The registry packs cover the common vulnerability classes, and their license keeps them out of this package."

package/configurations/general/security/rules/SECURITY.md

@@ -1,11 +1,13 @@
 # Security
 
+Read this rule when code handles input, authentication, redirects, or downloads.
+
 ## Input
 
 - Validate every value that enters from outside the program before use: request bodies, query strings,
   path parameters, headers, cookies, environment, files, provider responses, queue messages,
-  command-line arguments. A type annotation does not validate input.
-- Bound every input: size, length, count, depth, rate.
+  and command-line arguments. A type annotation does not validate input.
+- Bound every input: size, length, count, depth, and rate.
 - Reject unknown fields in request bodies that create or change data.
 
 ## Never build code or paths from input
@@ -33,17 +35,17 @@
 ## Authentication and authorization
 
 - Identity comes from a verified server-side session or token. A client-supplied user ID, role,
-  or tenant provides data, never authority.
+  or tenant counts as data, never authority.
 - Authorize every operation that reads or changes data, through each HTTP, RPC, job,
   and webhook entry point. Recheck access to the resource even when a parent already checked it.
 - Compare secrets, signatures, and tokens in constant time.
-- Generate tokens, nonces, and reset codes with the platform's cryptographic random source.
+- Generate tokens, nonces, and reset codes with the system's cryptographic random source.
 - Hash passwords with a current, slow, salted algorithm through a maintained library. Use one
   failure message for unknown user and wrong password.
 - Verify webhook signatures against the raw body before decoding, and handle replay with an
   idempotency key.
-- Cookies that carry sessions: `HttpOnly`, `Secure`, `SameSite`, explicit `Max-Age`, non-default
-  name. Writes never happen on `GET`. A cookie session needs CSRF protection on every
+- Cookies that carry sessions: `HttpOnly`, `Secure`, `SameSite`, explicit `Max-Age`, and a
+  non-default name. Writes never happen on `GET`. A cookie session needs cross-site request forgery (CSRF) protection on every
   state-changing request.
 
 ## Builds