@neralabs/rerail-pack-python 0.1.3 → 0.1.5

package/licenses/ruff/UPSTREAM.md

@@ -387,8 +387,8 @@ Paths are relative to the pack directory, `packs/python/`.
 | `upstream/ruff/fixtures/syntax_errors/yield_scope.py` | `crates/ruff_linter/resources/test/fixtures/syntax_errors/yield_scope.py` | verbatim |
 
 > `recording.json` is a port readiness recording, and no file of this pack, so it is recorded here rather than in the
-> table above: the tool-pack's `recording.lock` names it and a GitHub release holds the bytes (docs/port-readiness.md).
-> It carries excerpts of this upstream's tests (`crates/ruff_linter/src/rules/*/mod.rs`,
+> table above: the tool-pack's `recording.lock` names it by its sha256, and the bytes are an object in S3, not a file in
+> git (docs/port-readiness.md). It carries excerpts of this upstream's tests (`crates/ruff_linter/src/rules/*/mod.rs`,
 > `crates/ruff_linter/src/linter.rs`: their test modules' string literals), redistributed under the licence above,
-> together with Rerail's Apache-2.0; the LICENSE beside this file is this upstream's own, at the pinned commit.
+> together with Rerail's Apache-2.0; `LICENSE` beside this file is this upstream's own, at the pinned commit.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neralabs/rerail-pack-python",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Rerail rule pack: Ruff and Bandit rules ported to Rerail code rules.",
   "license": "Apache-2.0 AND MIT",
   "repository": {

package/rules/bandit-b101-assert-used.json

@@ -3,7 +3,7 @@
   "id": "bandit-b101-assert-used",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Bandit 1.9.4's B101 assert_used: every `assert` statement (Bandit's B101 with its default configuration, which skips no file). Bandit's `# nosec` is honoured (`suppress.nosec`), as its recordings honour it.",
+  "description": "Avoid assert statements in Python code; they are stripped when Python runs with optimization, so any check they perform silently disappears.",
   "scope": {
     "include": [
       "**/*"
@@ -24,7 +24,7 @@
       "violation": {
         "anchor": "witness.span",
         "code": "B101",
-        "message": "Bandit B101 (assert-used)",
+        "message": "Replace this assert with an if check that raises an exception; asserts are stripped when Python runs with -O.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b102-exec-used.json

@@ -3,7 +3,7 @@
   "id": "bandit-b102-exec-used",
   "revision": 2,
   "mode": "steer",
-  "description": "Detect calls to Python's exec function, which executes supplied text as Python code and is risky when that code is not fully trusted. As in Bandit, the callee is a bare name whose qualified name through the file's import aliases is exec: exec itself unless an import aliases it to another name, or a name imported as the module exec. Remove the exec call and implement the intended operation explicitly.",
+  "description": "Avoid exec() calls in Python, including through import aliases; running text as code is dangerous unless that text is fully trusted.",
   "scope": {
     "include": [
       "**/*.py"
@@ -111,7 +111,7 @@
       "violation": {
         "code": "B102",
         "anchor": "witness.span",
-        "message": "This exec call executes supplied text as Python code and is risky when that code is not fully trusted. Remove exec and implement the intended operation explicitly.",
+        "message": "Replace this exec call with code that performs the intended operation directly, unless the executed text is fully trusted.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b110-try-except-pass.json

@@ -3,7 +3,7 @@
   "id": "bandit-b110-try-except-pass",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect exception handlers whose only action is pass, silently discarding errors that can hide failures or attempted disruption. Handle or log the exception, or catch a specific expected exception when suppression is intentional.",
+  "description": "Don't write a bare or catch-all Exception handler whose only statement is pass; log or handle the error, or catch the specific exception you expect.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b112-try-except-continue.json

@@ -3,7 +3,7 @@
   "id": "bandit-b112-try-except-continue",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect exception handlers whose only action is continue, silently discarding errors while retrying a loop. Handle or log the exception, or catch a specific expected exception before continuing.",
+  "description": "Don't write a bare or catch-all Exception handler in a loop whose only statement is continue; log or handle the error, or catch the specific exception you expect.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b113-request-without-timeout.json

@@ -3,7 +3,7 @@
   "id": "bandit-b113-request-without-timeout",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Bandit 1.9.4's B113 request_without_timeout: a `requests` call without `timeout`, or a `requests`/`httpx` call whose `timeout` keyword is `None` (Bandit reads `timeout` as a keyword only). Port of the kernel test b113_requests_without_a_timeout_or_with_none (rerail/native/src/code_rule_dsl/value/rules.rs). Bandit's `# nosec` is honoured (`suppress.nosec`), as its recordings honour it.",
+  "description": "Pass a timeout to requests calls, and never set it to None on requests or httpx calls; without one, a slow server can hang the program indefinitely.",
   "scope": {
     "include": [
       "**/*"
@@ -124,7 +124,7 @@
       "violation": {
         "anchor": "witness.span",
         "code": "B113",
-        "message": "Bandit B113 (request-without-timeout)",
+        "message": "Pass a finite timeout to this HTTP call; without one a slow server can hang the program.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b301-pickle.json

@@ -3,7 +3,7 @@
   "id": "bandit-b301-pickle",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect calls to pickle and related unsafe deserialization APIs.",
+  "description": "Avoid deserializing with pickle, dill, shelve, jsonpickle, or pandas.read_pickle; loading untrusted data this way can execute arbitrary code.",
   "scope": {
     "include": [
       "**/*.py"
@@ -44,7 +44,7 @@
       "violation": {
         "code": "B301",
         "anchor": "witness.span",
-        "message": "Pickle or a related deserialization API can be unsafe when used with untrusted data.",
+        "message": "Load this data with json or another data-only format instead; unpickling untrusted input can run arbitrary code.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b302-marshal.json

@@ -3,7 +3,7 @@
   "id": "bandit-b302-marshal",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect dangerous marshal deserialization calls",
+  "description": "Avoid marshal.load() and marshal.loads(); marshal is not safe against malicious or malformed data, so never use it on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"
@@ -34,7 +34,7 @@
       "violation": {
         "code": "B302",
         "anchor": "witness.span",
-        "message": "Deserialization with the marshal module is possibly dangerous.",
+        "message": "Load this data with json or another data-only format instead of marshal, which is unsafe on untrusted input.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b303-md5.json

@@ -3,7 +3,7 @@
   "id": "bandit-b303-md5",
   "revision": 1,
   "mode": "steer",
-  "description": "An MD2, MD4, MD5 or SHA1 hash from PyCrypto, PyCryptodome or cryptography. `hashlib` is Bandit's B324, which this pack does not include.",
+  "description": "Avoid MD2, MD4, MD5, and SHA1 hashes from PyCrypto, PyCryptodome, or cryptography; they are broken for security, so use SHA-256 or a password hash.",
   "scope": {
     "include": [
       "**/*.py",

package/rules/bandit-b305-cipher-modes.json

@@ -3,7 +3,7 @@
   "id": "bandit-b305-cipher-modes",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect use of the insecure ECB cipher mode",
+  "description": "Avoid the ECB cipher mode; it encrypts identical blocks to identical output and leaks patterns in the data, so use an authenticated mode such as GCM.",
   "scope": {
     "include": [
       "**/*.py"
@@ -33,7 +33,7 @@
       "violation": {
         "code": "B305",
         "anchor": "witness.span",
-        "message": "Use of the insecure ECB cipher mode.",
+        "message": "Replace ECB with an authenticated mode such as GCM; ECB leaks patterns in the data.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b306-mktemp-q.json

@@ -3,7 +3,7 @@
   "id": "bandit-b306-mktemp-q",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect use of insecure tempfile.mktemp",
+  "description": "Use tempfile.mkstemp() or NamedTemporaryFile instead of tempfile.mktemp(); mktemp returns a name another process can claim before you create the file.",
   "scope": {
     "include": [
       "**/*.py"
@@ -40,7 +40,7 @@
       "violation": {
         "code": "B306",
         "anchor": "witness.span",
-        "message": "Use of insecure and deprecated function mktemp.",
+        "message": "Replace tempfile.mktemp with mkstemp or NamedTemporaryFile, which create the file atomically.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b307-eval.json

@@ -3,7 +3,7 @@
   "id": "bandit-b307-eval",
   "revision": 2,
   "mode": "steer",
-  "description": "Detect calls to Python's eval function, which evaluates supplied text as code and may be unsafe. Use ast.literal_eval when only Python literals need to be parsed.",
+  "description": "Avoid eval() calls in Python, including through import aliases; use ast.literal_eval() when you only need to parse literal values.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b308-mark-safe.json

@@ -3,7 +3,7 @@
   "id": "bandit-b308-mark-safe",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect potentially unsafe django mark_safe calls",
+  "description": "Avoid Django's mark_safe(); it turns off autoescaping and can expose cross-site scripting when the content isn't fully trusted.",
   "scope": {
     "include": [
       "**/*.py"
@@ -33,7 +33,7 @@
       "violation": {
         "code": "B308",
         "anchor": "witness.span",
-        "message": "Use of mark_safe may expose cross-site scripting vulnerabilities and should be reviewed.",
+        "message": "Build this HTML with format_html() instead of mark_safe so any untrusted parts get escaped.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b310-urllib-urlopen.json

@@ -3,7 +3,7 @@
   "id": "bandit-b310-urllib-urlopen",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect URL-opening calls that require permitted-scheme review",
+  "description": "Restrict URLs passed to urllib's urlopen, urlretrieve, and URLopener to expected schemes; file: and custom schemes can expose local files.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b311-random.json

@@ -3,7 +3,7 @@
   "id": "bandit-b311-random",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect insecure uses of Python pseudo-random generators",
+  "description": "Avoid the random module's generators for anything security-related; their output is predictable, so use the secrets module for tokens, passwords, and keys.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b312-telnetlib.json

@@ -3,7 +3,7 @@
   "id": "bandit-b312-telnetlib",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect insecure telnetlib.Telnet calls",
+  "description": "Avoid opening telnetlib.Telnet connections; Telnet sends credentials and data unencrypted, so use SSH or another encrypted protocol.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b313-xml-bad-celementtree.json

@@ -3,7 +3,7 @@
   "id": "bandit-b313-xml-bad-celementtree",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect vulnerable xml.etree.cElementTree parsing calls",
+  "description": "Use defusedxml instead of xml.etree.cElementTree to parse XML; the standard parser is open to entity-expansion and other XML attacks on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b314-xml-bad-elementtree.json

@@ -3,7 +3,7 @@
   "id": "bandit-b314-xml-bad-elementtree",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect vulnerable xml.etree.ElementTree parsing calls",
+  "description": "Use defusedxml instead of xml.etree.ElementTree to parse XML; the standard parser is open to entity-expansion and other XML attacks on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b315-xml-bad-expatreader.json

@@ -3,7 +3,7 @@
   "id": "bandit-b315-xml-bad-expatreader",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect vulnerable xml.sax.expatreader parser creation",
+  "description": "Use defusedxml instead of creating parsers with xml.sax.expatreader; the standard parser is open to entity-expansion and other XML attacks on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b316-xml-bad-expatbuilder.json

@@ -3,7 +3,7 @@
   "id": "bandit-b316-xml-bad-expatbuilder",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect vulnerable xml.dom.expatbuilder parsing calls",
+  "description": "Use defusedxml instead of xml.dom.expatbuilder to parse XML; the standard parser is open to entity-expansion and other XML attacks on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b317-xml-bad-sax.json

@@ -3,7 +3,7 @@
   "id": "bandit-b317-xml-bad-sax",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect vulnerable xml.sax parsing calls",
+  "description": "Use defusedxml instead of xml.sax to parse XML; the standard parser is open to entity-expansion and other XML attacks on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b318-xml-bad-minidom.json

@@ -3,7 +3,7 @@
   "id": "bandit-b318-xml-bad-minidom",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect unsafe xml.dom.minidom parsing calls",
+  "description": "Use defusedxml instead of xml.dom.minidom to parse XML; the standard parser is open to entity-expansion and other XML attacks on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b319-xml-bad-pulldom.json

@@ -3,7 +3,7 @@
   "id": "bandit-b319-xml-bad-pulldom",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect unsafe xml.dom.pulldom parsing calls",
+  "description": "Use defusedxml instead of xml.dom.pulldom to parse XML; the standard parser is open to entity-expansion and other XML attacks on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b321-ftplib.json

@@ -3,7 +3,7 @@
   "id": "bandit-b321-ftplib",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect insecure ftplib.FTP construction",
+  "description": "Avoid opening ftplib.FTP connections; FTP sends credentials and data unencrypted, so use SFTP, SCP, or another encrypted protocol.",
   "scope": {
     "include": [
       "**/*.py"
@@ -33,7 +33,7 @@
       "violation": {
         "code": "B321",
         "anchor": "witness.span",
-        "message": "FTP is unencrypted and insecure; use SSH, SFTP, SCP, or another encrypted protocol.",
+        "message": "Replace this FTP connection with SFTP, SCP, or another encrypted protocol; FTP sends credentials in clear text.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b323-unverified-context.json

@@ -3,7 +3,7 @@
   "id": "bandit-b323-unverified-context",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect creation of unverified SSL contexts",
+  "description": "Don't create SSL contexts with ssl._create_unverified_context(); it turns off certificate and hostname verification and allows man-in-the-middle attacks.",
   "scope": {
     "include": [
       "**/*.py"
@@ -33,7 +33,7 @@
       "violation": {
         "code": "B323",
         "anchor": "witness.span",
-        "message": "Creating an unverified SSL context disables certificate validation and hostname checks.",
+        "message": "Use ssl.create_default_context() instead, which verifies certificates and hostnames.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b401-import-telnetlib.json

@@ -3,7 +3,7 @@
   "id": "bandit-b401-import-telnetlib",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of the insecure telnetlib module.",
+  "description": "Remove imports of telnetlib; Telnet sends credentials and data unencrypted, so use SSH or another encrypted protocol.",
   "scope": {
     "include": [
       "**/*.py"
@@ -34,7 +34,7 @@
       "violation": {
         "code": "B401",
         "anchor": "witness.span",
-        "message": "A telnet-related module is being imported. Telnet is insecure; use SSH or another encrypted protocol.",
+        "message": "Remove this telnetlib import and use SSH or another encrypted protocol instead.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b402-import-ftplib.json

@@ -3,7 +3,7 @@
   "id": "bandit-b402-import-ftplib",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of the insecure ftplib module.",
+  "description": "Remove imports of ftplib; FTP sends credentials and data unencrypted, so use SFTP, SCP, or another encrypted protocol.",
   "scope": {
     "include": [
       "**/*.py"
@@ -34,7 +34,7 @@
       "violation": {
         "code": "B402",
         "anchor": "witness.span",
-        "message": "An FTP-related module is being imported. FTP is insecure; use SSH, SFTP, SCP, or another encrypted protocol.",
+        "message": "Remove this ftplib import and use SFTP, SCP, or another encrypted protocol instead.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b405-import-xml-etree.json

@@ -3,7 +3,7 @@
   "id": "bandit-b405-import-xml-etree",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of xml.etree.cElementTree and xml.etree.ElementTree.",
+  "description": "Avoid importing xml.etree.ElementTree or cElementTree; use defusedxml instead, since the standard parsers are open to XML attacks on untrusted input.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b407-import-xml-expat.json

@@ -3,7 +3,7 @@
   "id": "bandit-b407-import-xml-expat",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of xml.dom.expatbuilder.",
+  "description": "Avoid importing xml.dom.expatbuilder to parse XML; it is open to XML attacks, so use defusedxml.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b408-import-xml-minidom.json

@@ -3,7 +3,7 @@
   "id": "bandit-b408-import-xml-minidom",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of xml.dom.minidom.",
+  "description": "Avoid importing xml.dom.minidom to parse XML; it is open to XML attacks, so use defusedxml.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b409-import-xml-pulldom.json

@@ -3,7 +3,7 @@
   "id": "bandit-b409-import-xml-pulldom",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of xml.dom.pulldom.",
+  "description": "Avoid importing xml.dom.pulldom to parse XML; it is open to XML attacks, so use defusedxml.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b411-import-xmlrpclib.json

@@ -3,7 +3,7 @@
   "id": "bandit-b411-import-xmlrpclib",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of xmlrpc.",
+  "description": "Avoid importing xmlrpc unprotected; its XML parsing is open to XML attacks unless patched with defusedxml.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b413-import-pycrypto.json

@@ -3,7 +3,7 @@
   "id": "bandit-b413-import-pycrypto",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of deprecated pyCrypto namespaces.",
+  "description": "Avoid importing the pyCrypto package; it is unmaintained and has known vulnerabilities, so use the cryptography package instead.",
   "scope": {
     "include": [
       "**/*.py"

package/rules/bandit-b415-import-pyghmi.json

@@ -3,7 +3,7 @@
   "id": "bandit-b415-import-pyghmi",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect direct imports of the insecure pyghmi package.",
+  "description": "Avoid importing pyghmi; IPMI is an insecure protocol, so prefer an encrypted management protocol.",
   "scope": {
     "include": [
       "**/*.py"
@@ -34,7 +34,7 @@
       "violation": {
         "code": "B415",
         "anchor": "witness.span",
-        "message": "An IPMI-related module is being imported. IPMI is insecure; use an encrypted protocol.",
+        "message": "Replace this pyghmi import with a client for an encrypted management protocol such as Redfish over HTTPS; IPMI is insecure.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b502-ssl-with-bad-version.json

@@ -3,7 +3,7 @@
   "id": "bandit-b502-ssl-with-bad-version",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect calls whose method or ssl_version argument selects an insecure SSL/TLS protocol.",
+  "description": "Don't select SSLv2, SSLv3, TLS 1.0 or TLS 1.1 when configuring ssl or pyOpenSSL connections; these protocol versions are broken.",
   "scope": {
     "include": [
       "**/*.py"
@@ -76,7 +76,7 @@
       "violation": {
         "code": "B502",
         "anchor": "witness.span",
-        "message": "An SSL context is configured with an insecure protocol version.",
+        "message": "Select TLS 1.2 or newer here (e.g. ssl.PROTOCOL_TLS_CLIENT) instead of this SSLv2, SSLv3, TLS 1.0 or TLS 1.1 protocol.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b505-weak-cryptographic-key.json

@@ -3,7 +3,7 @@
   "id": "bandit-b505-weak-cryptographic-key",
   "revision": 1,
   "mode": "steer",
-  "description": "Port of Bandit 1.9.4's B505 weak_cryptographic_key: a DSA or RSA key below 2048 bits or an EC curve below 224 bits, by keyword or position (Bandit's medium thresholds). Port of the kernel test b505_weak_key_sizes_by_keyword_or_position. Bandit's `# nosec` is honoured (`suppress.nosec`), as its recordings honour it.",
+  "description": "Use RSA and DSA keys of at least 2048 bits and elliptic curves of at least 224 bits; smaller keys can be broken.",
   "scope": {
     "include": [
       "**/*"
@@ -152,7 +152,7 @@
       "violation": {
         "anchor": "witness.span",
         "code": "B505",
-        "message": "Bandit B505 (weak-cryptographic-key)",
+        "message": "Generate this key with at least 2048 bits for RSA or DSA, or a curve of at least 224 bits for EC; smaller keys can be broken.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b507-ssh-no-host-key-verification.json

@@ -3,7 +3,7 @@
   "id": "bandit-b507-ssh-no-host-key-verification",
   "revision": 4,
   "mode": "steer",
-  "description": "Once an import whose name contains paramiko has been walked (Bandit's substring test, in Bandit's source-order walk), flag a call whose function name is set_missing_host_key_policy (the attribute name, a bare name, or a name aliased by an earlier import to one ending in set_missing_host_key_policy) and whose first positional argument is a name, attribute, or call naming AutoAddPolicy or WarningPolicy.",
+  "description": "Don't let Paramiko auto-accept unknown SSH host keys with AutoAddPolicy or WarningPolicy; it opens the door to man-in-the-middle attacks.",
   "scope": {
     "include": [
       "**/*.py"
@@ -196,7 +196,7 @@
       "violation": {
         "code": "B507",
         "anchor": "witness.span",
-        "message": "Paramiko call with policy set to automatically trust the unknown host key.",
+        "message": "Set paramiko.RejectPolicy and load known host keys instead of auto-accepting unknown ones; that invites man-in-the-middle attacks.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b606-start-process-with-no-shell.json

@@ -3,7 +3,7 @@
   "id": "bandit-b606-start-process-with-no-shell",
   "revision": 1,
   "mode": "steer",
-  "description": "Detect configured process APIs that execute without a command shell",
+  "description": "Validate input passed to the os exec, spawn and startfile functions; they start whatever program and arguments they receive.",
   "scope": {
     "include": [
       "**/*.py"
@@ -49,7 +49,7 @@
       "violation": {
         "code": "B606",
         "anchor": "witness.span",
-        "message": "Review input passed to a no-shell process API",
+        "message": "Validate any untrusted input passed to this os exec, spawn or startfile call; it starts whatever program and arguments it receives.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/bandit-b615-huggingface-unsafe-download.json

@@ -3,7 +3,7 @@
   "id": "bandit-b615-huggingface-unsafe-download",
   "revision": 5,
   "mode": "steer",
-  "description": "Require a transformers, datasets, or huggingface_hub-like import; resolve the supported download/load APIs; allow nonliteral revisions, hexadecimal revisions of at least seven characters, or local-path first arguments, and flag all other unpinned downloads.",
+  "description": "Pin Hugging Face model and dataset downloads to a specific commit revision; an unpinned download can silently pull changed or tampered files.",
   "scope": {
     "include": [
       "**/*.py"
@@ -1138,7 +1138,7 @@
       "violation": {
         "code": "B615",
         "anchor": "witness.span",
-        "message": "Unsafe Hugging Face Hub download without revision pinning in ${API}()",
+        "message": "Pin ${API}() to a specific commit hash with revision=; an unpinned download can silently pull changed or tampered files.",
         "suppress": {
           "nosec": {
             "codes": [

package/rules/ruff-async100-cancel-scope-no-checkpoint.json

@@ -3,7 +3,7 @@
  "id": "ruff-async100-cancel-scope-no-checkpoint",
  "revision": 1,
  "mode": "steer",
- "description": "Port of Ruff's ASYNC100 (cancel-scope-no-checkpoint): a `with` statement whose last timeout-context item (`asyncio.timeout[_at]`, `anyio.move_on_after`/`fail_after`/`CancelScope`, `trio.move_on_after`/`move_on_at`/`fail_after`/`fail_at`/`CancelScope` calls) is the last item when the statement is `async with`, and whose body has no `yield` (nested scopes included) and no `await`, `async with`, `async for` or async comprehension outside nested functions and classes. Reported on the whole statement. Names resolve as in Ruff's resolve_qualified_name, through the engine's `resolves` (M7).",
+ "description": "Add an await inside asyncio, anyio or trio timeout and cancel-scope blocks; without a checkpoint the timeout can never fire.",
  "scope": {
   "include": [
    "**/*"
@@ -343,7 +343,7 @@
    "violation": {
     "anchor": "witness.span",
     "code": "ASYNC100",
-    "message": "A `with $CALLEE(...):` context does not contain any `await` statements. This makes it pointless, as the timeout can only be triggered by a checkpoint.",
+    "message": "Add an await inside this `with $CALLEE(...):` block; without a checkpoint the timeout can never fire.",
     "suppress": {
       "noqa": {
         "codes": [