@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/rules/vsg-nextjs-inline-action-write-no-auth.yaml

@@ -0,0 +1,161 @@
+rules:
+  - id: vsg-nextjs-inline-action-write-no-auth
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      This inline "use server" action writes data (Supabase or Prisma) but never checks who is calling it. Server actions are public POST endpoints, so anyone can call them with any arguments.
+      Check the session inside the action before the write (for example supabase.auth.getUser(), auth(), getServerSession() or currentUser()) and reject the call when there is no user.
+    metadata:
+      vsg-blocking: true
+      vsg-title: Inline server action writes data without checking the caller
+      vsg-fix: Call your auth check (supabase.auth.getUser(), auth(), getServerSession() or currentUser()) at the top of the action, throw or return an error when there is no user, and scope the write to that user.
+      cwe: "CWE-862: Missing Authorization"
+      owasp: "A01:2025 - Broken Access Control"
+      category: security
+      confidence: HIGH
+      technology: [nextjs, supabase, prisma]
+    patterns:
+      - pattern-either:
+          - pattern: $SB.from(...).insert(...)
+          - pattern: $SB.from(...).update(...)
+          - pattern: $SB.from(...).upsert(...)
+          - pattern: $SB.from(...).delete(...)
+          - pattern: prisma.$M.create(...)
+          - pattern: prisma.$M.createMany(...)
+          - pattern: prisma.$M.update(...)
+          - pattern: prisma.$M.updateMany(...)
+          - pattern: prisma.$M.upsert(...)
+          - pattern: prisma.$M.delete(...)
+          - pattern: prisma.$M.deleteMany(...)
+      - pattern-inside:
+          pattern-either:
+            - pattern: |
+                async function $F(...) {
+                  "use server"
+                  ...
+                }
+            - pattern: |
+                const $F = async (...) => {
+                  "use server"
+                  ...
+                }
+      - pattern-not-inside:
+          patterns:
+            - pattern-either:
+                - pattern: |
+                    async function $F(...) {
+                      "use server"
+                      ...
+                      <... $FN(...) ...>
+                      ...
+                    }
+                - pattern: |
+                    const $F = async (...) => {
+                      "use server"
+                      ...
+                      <... $FN(...) ...>
+                      ...
+                    }
+            - metavariable-regex:
+                metavariable: $FN
+                regex: ^(.*\.)?(auth|getAuth|getUser|getSession|getClaims|getServerSession|currentUser|get(?!\w*By(Id|Email))\w*User\w*|getCurrentUser\w*|(require|assert|ensure)\w*(User|Auth|Session|Context|Admin|Member|Role|Permission|Owner|Access)\w*|verify\w*(Signature|Webhook|Token|Jwt)\w*|constructEvent|constructEventAsync|validateRequest|jwtVerify|timingSafeEqual\w*|__vsg_discovered__)$
+      # Shared-secret checks (cron and webhook routes): the Authorization header compared with a secret, usually "Bearer <secret>".
+      - pattern-not-inside:
+          pattern-either:
+            - pattern: |
+                async function $F(...) {
+                "use server"
+                  ...
+                  <... $A === `Bearer ${...}` ...>
+                  ...
+                }
+            - pattern: |
+                async function $F(...) {
+                "use server"
+                  ...
+                  <... $A !== `Bearer ${...}` ...>
+                  ...
+                }
+            - pattern: |
+                const $F = async (...) => {
+                "use server"
+                  ...
+                  <... $A === `Bearer ${...}` ...>
+                  ...
+                }
+            - pattern: |
+                const $F = async (...) => {
+                "use server"
+                  ...
+                  <... $A !== `Bearer ${...}` ...>
+                  ...
+                }
+            - patterns:
+                - pattern-either:
+                    - pattern: |
+                        async function $F(...) {
+                        "use server"
+                          ...
+                          <... $R.headers.get($HN) === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        async function $F(...) {
+                        "use server"
+                          ...
+                          <... $R.headers.get($HN) !== $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        async function $F(...) {
+                        "use server"
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        async function $F(...) {
+                        "use server"
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H !== $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        const $F = async (...) => {
+                        "use server"
+                          ...
+                          <... $R.headers.get($HN) === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        const $F = async (...) => {
+                        "use server"
+                          ...
+                          <... $R.headers.get($HN) !== $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        const $F = async (...) => {
+                        "use server"
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        const $F = async (...) => {
+                        "use server"
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H !== $X ...>
+                          ...
+                        }
+                - metavariable-regex:
+                    metavariable: $HN
+                    regex: (?i)^["']authorization["']$

package/dist/security-runtime/rules/vsg-nextjs-route-write-no-auth.yaml

@@ -0,0 +1,193 @@
+rules:
+  - id: vsg-nextjs-route-write-no-auth
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      This Next.js route handler writes data (Supabase or Prisma) but never checks who is calling it, so anyone who can reach the URL can change data.
+      Check the session inside the handler before the write (for example supabase.auth.getUser(), auth(), getServerSession() or currentUser()) and reject the request when there is no user.
+      Middleware alone is not a safe substitute because a route can be reached without it.
+    metadata:
+      vsg-blocking: true
+      vsg-title: Route handler writes data without checking the caller
+      vsg-fix: Call your auth check (supabase.auth.getUser(), auth(), getServerSession() or currentUser()) at the top of the handler, return 401 when there is no user, and scope the write to that user.
+      cwe: "CWE-862: Missing Authorization"
+      owasp: "A01:2025 - Broken Access Control"
+      category: security
+      confidence: HIGH
+      technology: [nextjs, supabase, prisma]
+    patterns:
+      - pattern-either:
+          - pattern: $SB.from(...).insert(...)
+          - pattern: $SB.from(...).update(...)
+          - pattern: $SB.from(...).upsert(...)
+          - pattern: $SB.from(...).delete(...)
+          - pattern: prisma.$M.create(...)
+          - pattern: prisma.$M.createMany(...)
+          - pattern: prisma.$M.update(...)
+          - pattern: prisma.$M.updateMany(...)
+          - pattern: prisma.$M.upsert(...)
+          - pattern: prisma.$M.delete(...)
+          - pattern: prisma.$M.deleteMany(...)
+      - pattern-inside:
+          pattern-either:
+            - pattern: |
+                export async function $F(...) { ... }
+            - pattern: |
+                export function $F(...) { ... }
+            - pattern: |
+                export const $F = async (...) => { ... }
+      - metavariable-regex:
+          metavariable: $F
+          regex: ^(POST|PUT|PATCH|DELETE)$
+      - pattern-not-inside:
+          patterns:
+            - pattern-either:
+                - pattern: |
+                    export async function $F(...) {
+                      ...
+                      <... $FN(...) ...>
+                      ...
+                    }
+                - pattern: |
+                    export function $F(...) {
+                      ...
+                      <... $FN(...) ...>
+                      ...
+                    }
+                - pattern: |
+                    export const $F = async (...) => {
+                      ...
+                      <... $FN(...) ...>
+                      ...
+                    }
+            - metavariable-regex:
+                metavariable: $FN
+                regex: ^(.*\.)?(auth|getAuth|getUser|getSession|getClaims|getServerSession|currentUser|get(?!\w*By(Id|Email))\w*User\w*|getCurrentUser\w*|(require|assert|ensure)\w*(User|Auth|Session|Context|Admin|Member|Role|Permission|Owner|Access)\w*|verify\w*(Signature|Webhook|Token|Jwt)\w*|constructEvent|constructEventAsync|validateRequest|jwtVerify|timingSafeEqual\w*|__vsg_discovered__)$
+      # Shared-secret checks (cron and webhook routes): the Authorization header compared with a secret, usually "Bearer <secret>".
+      - pattern-not-inside:
+          pattern-either:
+            - pattern: |
+                export async function $F(...) {
+                  ...
+                  <... $A === `Bearer ${...}` ...>
+                  ...
+                }
+            - pattern: |
+                export async function $F(...) {
+                  ...
+                  <... $A !== `Bearer ${...}` ...>
+                  ...
+                }
+            - pattern: |
+                export function $F(...) {
+                  ...
+                  <... $A === `Bearer ${...}` ...>
+                  ...
+                }
+            - pattern: |
+                export function $F(...) {
+                  ...
+                  <... $A !== `Bearer ${...}` ...>
+                  ...
+                }
+            - pattern: |
+                export const $F = async (...) => {
+                  ...
+                  <... $A === `Bearer ${...}` ...>
+                  ...
+                }
+            - pattern: |
+                export const $F = async (...) => {
+                  ...
+                  <... $A !== `Bearer ${...}` ...>
+                  ...
+                }
+            - patterns:
+                - pattern-either:
+                    - pattern: |
+                        export async function $F(...) {
+                          ...
+                          <... $R.headers.get($HN) === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export async function $F(...) {
+                          ...
+                          <... $R.headers.get($HN) !== $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export async function $F(...) {
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export async function $F(...) {
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H !== $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export function $F(...) {
+                          ...
+                          <... $R.headers.get($HN) === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export function $F(...) {
+                          ...
+                          <... $R.headers.get($HN) !== $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export function $F(...) {
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export function $F(...) {
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H !== $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export const $F = async (...) => {
+                          ...
+                          <... $R.headers.get($HN) === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export const $F = async (...) => {
+                          ...
+                          <... $R.headers.get($HN) !== $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export const $F = async (...) => {
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H === $X ...>
+                          ...
+                        }
+                    - pattern: |
+                        export const $F = async (...) => {
+                          ...
+                          $H = $R.headers.get($HN)
+                          ...
+                          <... $H !== $X ...>
+                          ...
+                        }
+                - metavariable-regex:
+                    metavariable: $HN
+                    regex: (?i)^["']authorization["']$

package/dist/security-runtime/rules/vsg-nosql-where-injection.yaml

@@ -0,0 +1,36 @@
+rules:
+  - id: vsg-nosql-where-injection
+    languages: [typescript, javascript]
+    mode: taint
+    severity: ERROR
+    message: >-
+      A MongoDB or Mongoose $where expression is built from request data. $where runs a string of JavaScript inside the database, so an attacker who controls part of the string can read other users' documents, change the query logic, or hang the database with an infinite loop.
+      Query with plain field filters (find({ product: id })) and operators instead of $where, and validate the type of every value taken from the request.
+    metadata:
+      vsg-blocking: true
+      vsg-title: NoSQL injection through a $where expression built from request data
+      vsg-fix: "Replace the $where string with a normal filter such as collection.find({ product: id }) (or an aggregation with $expr), and validate the request value (type and length) before using it. Never concatenate request data into a $where string or function."
+      cwe: "CWE-943: Improper Neutralization of Special Elements in Data Query Logic"
+      owasp: "A05:2025 - Injection"
+      category: security
+      confidence: HIGH
+      technology: [mongodb, mongoose, express, nodejs]
+    pattern-sources:
+      - pattern: $REQ.body
+      - pattern: $REQ.query
+      - pattern: $REQ.params
+      - pattern: $REQ.headers
+      - pattern: $REQ.cookies
+    pattern-sanitizers:
+      - pattern: parseInt(...)
+      - pattern: Number(...)
+      - pattern: parseFloat(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: |
+                  { ..., $where: $SINK, ... }
+              - pattern: |
+                  { ..., "$where": $SINK, ... }
+              - pattern: $Q.$where($SINK)
+          - focus-metavariable: $SINK

package/dist/security-runtime/rules/vsg-python-pickle-load.yaml

@@ -0,0 +1,26 @@
+rules:
+  - id: vsg-python-pickle-load
+    languages: [python]
+    severity: ERROR
+    message: >-
+      pickle.load and pickle.loads run code embedded in the data they read. If the bytes or file can come from a user, the network, a shared drive or any source an attacker can influence, loading them gives the attacker code execution on your machine.
+      Use a data-only format such as JSON, or sign the data with an HMAC and verify it before unpickling.
+    metadata:
+      vsg-blocking: true
+      vsg-title: Unsafe deserialization with pickle
+      vsg-fix: Replace pickle with JSON (or another data-only format). If pickle is unavoidable, verify an HMAC over the bytes with a secret key before calling pickle.loads, and never unpickle data from users or the network.
+      cwe: "CWE-502: Deserialization of Untrusted Data"
+      owasp: "A08:2025 - Software or Data Integrity Failures"
+      category: security
+      confidence: HIGH
+      technology: [python]
+    patterns:
+      - pattern-either:
+          - pattern: $MOD.loads($DATA, ...)
+          - pattern: $MOD.load($DATA, ...)
+          - pattern: $MOD.Unpickler($DATA, ...)
+      - metavariable-regex:
+          metavariable: $MOD
+          regex: ^(pickle|cPickle|_pickle|dill|cloudpickle)$
+      - pattern-not: $MOD.$F("...", ...)
+      - pattern-not: $MOD.$F(b"...", ...)

package/dist/security-runtime/rules/vsg-python-requests-verify-false.yaml

@@ -0,0 +1,34 @@
+rules:
+  - id: vsg-python-requests-verify-false
+    languages: [python]
+    severity: WARNING
+    message: >-
+      TLS certificate verification is turned off for this requests call (verify=False). The connection is encrypted but not authenticated, so anyone on the network path can impersonate the server and read or change the traffic, including tokens and passwords.
+      Remove verify=False. If the server uses a private certificate authority, pass verify="/path/to/ca-bundle.pem" instead.
+    metadata:
+      vsg-title: TLS certificate verification disabled (requests verify=False)
+      vsg-fix: Remove verify=False. For a private certificate authority use verify="/path/to/ca-bundle.pem".
+      cwe: "CWE-295: Improper Certificate Validation"
+      owasp: "A07:2025 - Authentication Failures"
+      category: security
+      confidence: HIGH
+      technology: [python, requests]
+    pattern-either:
+      - patterns:
+          - pattern: requests.$M(..., verify=False, ...)
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(get|post|put|patch|delete|head|options|request)$
+      - patterns:
+          - pattern: $S.verify = False
+          - pattern-inside: |
+              $S = requests.Session()
+              ...
+      - patterns:
+          - pattern: $S.$M(..., verify=False, ...)
+          - pattern-inside: |
+              $S = requests.Session()
+              ...
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(get|post|put|patch|delete|head|options|request)$

package/dist/security-runtime/rules/vsg-python-subprocess-shell.yaml

@@ -0,0 +1,23 @@
+rules:
+  - id: vsg-python-subprocess-shell
+    languages: [python]
+    severity: ERROR
+    message: >-
+      A subprocess call runs through the shell (shell=True) with a command that is built at run time. If any part of it comes from a user, a file, the network or an AI model, an attacker can append their own shell commands (command injection).
+      Pass the command as a list of arguments without shell=True, for example subprocess.run(["git", "clone", url], check=True), and validate any value that must be part of a command.
+    metadata:
+      vsg-blocking: true
+      vsg-title: Shell command built from variable input (shell=True)
+      vsg-fix: Replace the string with an argument list and drop shell=True (for example subprocess.run(["tool", arg], check=True)). If a shell is unavoidable, quote every dynamic part with shlex.quote().
+      cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+      owasp: "A05:2025 - Injection"
+      category: security
+      confidence: HIGH
+      technology: [python]
+    patterns:
+      - pattern: subprocess.$F($CMD, ..., shell=True, ...)
+      - metavariable-regex:
+          metavariable: $F
+          regex: ^(run|call|check_call|check_output|Popen|getoutput|getstatusoutput)$
+      - pattern-not: subprocess.$F("...", ..., shell=True, ...)
+      - pattern-not: subprocess.$F([...], ..., shell=True, ...)

package/dist/security-runtime/rules/vsg-stripe-client-price.yaml

@@ -0,0 +1,51 @@
+rules:
+  - id: vsg-stripe-client-price
+    languages: [typescript, javascript]
+    mode: taint
+    severity: ERROR
+    message: >-
+      A price or amount taken from the request (body, JSON, form data or query string) reaches a Stripe charge. The browser controls those values, so anyone can pay 1 cent for any product.
+      Look the price up on the server from a product ID the client sends (your database or a Stripe Price ID you define), and never use a client-sent amount.
+    metadata:
+      vsg-blocking: true
+      vsg-title: Client-supplied price reaches a Stripe charge
+      vsg-fix: Accept only a product or plan identifier from the client, look the price up on the server (your database or a Stripe Price ID you control), and pass that server-side value to Stripe.
+      cwe: "CWE-602: Client-Side Enforcement of Server-Side Security"
+      owasp: "A06:2025 - Insecure Design"
+      category: security
+      confidence: HIGH
+      technology: [nextjs, stripe]
+    options:
+      taint_assume_safe_indexes: true
+    pattern-sources:
+      - pattern: await $REQ.json()
+      - pattern: await $REQ.formData()
+      - pattern: $REQ.body
+      - pattern: $REQ.query
+      - pattern: $REQ.nextUrl.searchParams
+      - pattern: new URL($REQ.url).searchParams
+    pattern-sanitizers:
+      - pattern: await $DB.$M.findUnique(...)
+      - pattern: await $DB.$M.findUniqueOrThrow(...)
+      - pattern: await $DB.$M.findFirst(...)
+      - pattern: await $DB.$M.findFirstOrThrow(...)
+      - pattern: await $DB.$M.findMany(...)
+      - pattern: await $DB.$M.findOne(...)
+      - pattern: await $DB.$M.findById(...)
+      - pattern: await $SB.from(...).select(...)...
+      - pattern: await $STRIPE.prices.retrieve(...)
+      - pattern: await $STRIPE.products.retrieve(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-inside: $STRIPE.checkout.sessions.create(...)
+          - pattern-either:
+              - pattern: |
+                  {..., unit_amount: $SINK, ...}
+              - pattern: |
+                  {..., amount: $SINK, ...}
+          - focus-metavariable: $SINK
+      - patterns:
+          - pattern-inside: $STRIPE.paymentIntents.create(...)
+          - pattern: |
+              {..., amount: $SINK, ...}
+          - focus-metavariable: $SINK

package/dist/security-runtime/rules/vsg-stripe-webhook-no-signature.yaml

@@ -0,0 +1,31 @@
+rules:
+  - id: vsg-stripe-webhook-no-signature
+    languages: [typescript, javascript]
+    severity: ERROR
+    # Test code posts hand-made events on purpose; it is not a deployed webhook.
+    paths:
+      exclude: ["*.test.*", "*.spec.*", "__tests__", "test", "tests"]
+    message: >-
+      This Stripe webhook route handles Stripe events but never calls stripe.webhooks.constructEvent (or constructEventAsync) to verify the stripe-signature header. Anyone can post a fake "checkout.session.completed" event to this URL and get paid features, refunds or account changes for free.
+      Read the raw body with request.text(), verify it with stripe.webhooks.constructEvent(body, signature, webhookSecret), and return 400 when verification throws.
+    metadata:
+      vsg-blocking: true
+      vsg-title: Stripe webhook does not verify the signature
+      vsg-fix: Read the raw body with await request.text(), then call stripe.webhooks.constructEvent(body, request.headers.get("stripe-signature"), process.env.STRIPE_WEBHOOK_SECRET) inside try/catch and return 400 on failure. Only act on the verified event.
+      cwe: "CWE-345: Insufficient Verification of Data Authenticity"
+      owasp: "A08:2025 - Software or Data Integrity Failures"
+      category: security
+      confidence: HIGH
+      technology: [nextjs, stripe]
+    patterns:
+      - pattern: |
+          export async function POST(...) { ... }
+      - pattern-either:
+          - pattern: |
+              export async function POST(...) { ... <... $H.get("stripe-signature") ...>; ... }
+          - pattern: |
+              export async function POST(...) { ... <... $E.data.object ...>; ... }
+      - pattern-not: |
+          export async function POST(...) { ... <... $S.webhooks.constructEvent(...) ...>; ... }
+      - pattern-not: |
+          export async function POST(...) { ... <... $S.webhooks.constructEventAsync(...) ...>; ... }

package/dist/security-runtime/rules/vsg-stripe-webhook-pages-no-signature.yaml

@@ -0,0 +1,51 @@
+rules:
+  - id: vsg-stripe-webhook-pages-no-signature
+    languages: [typescript, javascript]
+    severity: ERROR
+    # Test code posts hand-made events on purpose; it is not a deployed webhook.
+    paths:
+      exclude: ["*.test.*", "*.spec.*", "__tests__", "test", "tests"]
+    message: >-
+      This Stripe webhook API route handles Stripe events but never calls stripe.webhooks.constructEvent (or constructEventAsync) to verify the stripe-signature header. Anyone can post a fake "checkout.session.completed" event to this URL and get paid features, refunds or account changes for free.
+      Read the raw body (disable the body parser), verify it with stripe.webhooks.constructEvent(rawBody, signature, webhookSecret), and return 400 when verification throws.
+    metadata:
+      vsg-blocking: true
+      vsg-title: Stripe webhook does not verify the signature
+      vsg-fix: Disable the body parser for this route, read the raw body, then call stripe.webhooks.constructEvent(rawBody, req.headers["stripe-signature"], process.env.STRIPE_WEBHOOK_SECRET) inside try/catch and respond 400 on failure. Only act on the verified event.
+      cwe: "CWE-345: Insufficient Verification of Data Authenticity"
+      owasp: "A08:2025 - Software or Data Integrity Failures"
+      category: security
+      confidence: HIGH
+      technology: [nextjs, stripe]
+    patterns:
+      - pattern-either:
+          - pattern: |
+              export default async function $H($REQ, $RES) { ... }
+          - pattern: |
+              export default function $H($REQ, $RES) { ... }
+      - pattern-either:
+          - pattern: |
+              export default async function $H($REQ, $RES) { ... <... "stripe-signature" ...>; ... }
+          - pattern: |
+              export default function $H($REQ, $RES) { ... <... "stripe-signature" ...>; ... }
+          - pattern: |
+              export default async function $H($REQ, $RES) { ... <... $E.data.object ...>; ... }
+          - pattern: |
+              export default function $H($REQ, $RES) { ... <... $E.data.object ...>; ... }
+      # A Pages API handler takes the request and the response. Without this the first pattern matches any function with two parameters
+      # (Opengrep ignores "export default"), so a helper such as mirrorStripeEvent(supabase, event) that receives an already verified
+      # event was reported as an unverified webhook.
+      - metavariable-regex:
+          metavariable: $REQ
+          regex: ^_?(req|request)$
+      - metavariable-regex:
+          metavariable: $RES
+          regex: ^_?(res|response)$
+      - pattern-not: |
+          export default async function $H($REQ, $RES) { ... <... $S.webhooks.constructEvent(...) ...>; ... }
+      - pattern-not: |
+          export default function $H($REQ, $RES) { ... <... $S.webhooks.constructEvent(...) ...>; ... }
+      - pattern-not: |
+          export default async function $H($REQ, $RES) { ... <... $S.webhooks.constructEventAsync(...) ...>; ... }
+      - pattern-not: |
+          export default function $H($REQ, $RES) { ... <... $S.webhooks.constructEventAsync(...) ...>; ... }

package/dist/security-runtime/rules/vsg-supabase-service-role-in-client.yaml

@@ -0,0 +1,27 @@
+rules:
+  - id: vsg-supabase-service-role-in-client
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A Supabase service-role key is referenced in a "use client" file. Client components are bundled and sent to every visitor, and the service-role key bypasses Row Level Security, so anyone could read and write your whole database.
+      Use the anon key in the browser and keep the service-role key in server-only code (route handlers, server actions, server components).
+    metadata:
+      vsg-blocking: true
+      vsg-title: Supabase service-role key referenced in client code
+      vsg-fix: Remove the service-role key from this client file, use the anon key with Row Level Security in the browser, move privileged work to a server-only route handler or server action, and rotate the service-role key because it may already have shipped to browsers.
+      cwe: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+      owasp: "A01:2025 - Broken Access Control"
+      category: security
+      confidence: HIGH
+      technology: [nextjs, supabase]
+    patterns:
+      - pattern-inside: |
+          "use client"
+          ...
+      - pattern-either:
+          - pattern: process.env.$NAME
+          - pattern: process.env[$NAME]
+          - pattern: import.meta.env.$NAME
+      - metavariable-regex:
+          metavariable: $NAME
+          regex: (?i).*service[_-]?role

package/dist/security-runtime/rules/vsg-supabase-service-role-public-env.yaml

@@ -0,0 +1,24 @@
+rules:
+  - id: vsg-supabase-service-role-public-env
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A Supabase service-role key is read from a public environment variable (NEXT_PUBLIC_, EXPO_PUBLIC_, VITE_ and similar prefixes). Frameworks inline these variables into the browser or app bundle, and the service-role key bypasses Row Level Security, so anyone could read and write your whole database.
+      Keep the service-role key in a server-only variable without a public prefix and use the anon key in client code.
+    metadata:
+      vsg-blocking: true
+      vsg-title: Supabase service-role key behind a public environment variable
+      vsg-fix: Rename the variable so it has no public prefix, read it only in server-only code, use the anon key in client code, and rotate the service-role key because it may already have shipped to browsers or devices.
+      cwe: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+      owasp: "A01:2025 - Broken Access Control"
+      category: security
+      confidence: HIGH
+      technology: [nextjs, expo, supabase]
+    patterns:
+      - pattern-either:
+          - pattern: process.env.$NAME
+          - pattern: process.env[$NAME]
+          - pattern: import.meta.env.$NAME
+      - metavariable-regex:
+          metavariable: $NAME
+          regex: (?i)^["'`]?(NEXT_PUBLIC|EXPO_PUBLIC|VITE|REACT_APP|GATSBY|NUXT_PUBLIC|PUBLIC)_[A-Z0-9_]*SERVICE[_-]?ROLE