hullproof 0.0.0-stage → 0.5.0

package/rules/semgrep/api-route-no-auth.yaml

@@ -0,0 +1,31 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/api-route-no-auth.yaml).
+#
+rules:
+  - id: hullproof-api-route-no-auth
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      An API route handler (GET, POST, PUT, PATCH or DELETE) reads from a database or data client and nothing in the handler
+      reads a session, user, token, signature or secret. If the route is not meant to be public, any caller gets the data. Read
+      the session first and return 401 before any query, or confirm that the route is public on purpose.
+    patterns:
+      - pattern-either:
+          - pattern: export async function $M(...) { ... $DB.$READ(...); ... }
+          - pattern: export const $M = async (...) => { ... $DB.$READ(...); ... }
+      - metavariable-regex:
+          metavariable: $M
+          regex: ^(GET|POST|PUT|PATCH|DELETE)$
+      - metavariable-regex:
+          metavariable: $READ
+          regex: ^(select|findMany|findUnique|findFirst|findUniqueOrThrow|findFirstOrThrow|query|rpc|execute|single|maybeSingle|aggregate|download|list)$
+      - pattern-not-regex: (?i)(auth|getUser|getSession|getClaims|session|requireUser|currentUser|verify|signature|constructEvent|jwt|bearer|api_?key|cookies\s*\(|token|clerk|guard|permission|secret)
+    metadata:
+      sec_ids: [SEC-API-001, SEC-AUTHZ-002]
+      severity_hint: HIGH
+      confidence: LOW
+      note: >-
+        The handler text is searched for any of the words above, so one mention anywhere, even in a comment, counts as an auth
+        read. A deliberately public route is reported. Route handlers that call a shared wrapper with a name outside the list are
+        reported, add the wrapper name to the regex.

package/rules/semgrep/cors-reflect-origin.yaml

@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/cors-reflect-origin.yaml).
+#
+rules:
+  - id: hullproof-cors-reflect-origin
+    mode: taint
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      The request Origin header is copied into Access-Control-Allow-Origin. Compare it to an exact
+      allowlist and return the matched value, never the raw header.
+    pattern-sources:
+      - pattern: $REQ.headers.origin
+      - pattern: $REQ.headers["origin"]
+      - pattern: $REQ.headers.get("origin")
+      - pattern: $REQ.header("origin")
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: $RES.setHeader("Access-Control-Allow-Origin", $SINK)
+              - pattern: $RES.set("Access-Control-Allow-Origin", $SINK)
+              - pattern: $RES.header("Access-Control-Allow-Origin", $SINK)
+              - pattern: $RES.append("Access-Control-Allow-Origin", $SINK)
+              - pattern: $H.set("Access-Control-Allow-Origin", $SINK)
+              - pattern: '{..., "Access-Control-Allow-Origin": $SINK, ...}'
+          - focus-metavariable: $SINK
+          - pattern-not-inside: |
+              if (<... $L.includes(...) ...>) { ... }
+          - pattern-not-inside: |
+              if (<... $L.has(...) ...>) { ... }
+    metadata:
+      sec_ids: [SEC-WEB-022]
+      severity_hint: HIGH
+      confidence: MEDIUM
+  - id: hullproof-cors-origin-true
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      CORS is configured to accept any origin. Use an exact allowlist.
+    pattern-either:
+      - pattern: 'cors({..., origin: true, ...})'
+      - pattern: 'cors({..., origin: "*", credentials: true, ...})'
+      - pattern: 'cors({..., origin: (...) => true, ...})'
+    metadata:
+      sec_ids: [SEC-WEB-022]
+      severity_hint: HIGH
+      confidence: HIGH

package/rules/semgrep/eval-or-new-function.yaml

@@ -0,0 +1,185 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/eval-or-new-function.yaml).
+#
+rules:
+  - id: hullproof-eval-or-new-function
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      Dynamic code evaluation. Remove it, or prove the input is a constant. Never evaluate request
+      data or model output.
+    patterns:
+      - pattern-either:
+          - pattern: eval(...)
+          - pattern: (0, eval)(...)
+          - pattern: (0, $G.eval)(...)
+          - pattern: $G.eval(...)
+          - pattern: new Function(...)
+          - pattern: Function(...)
+          - pattern: $G.Function(...)
+          - pattern: new $G.Function(...)
+          - pattern: Function.prototype.constructor(...)
+          - pattern: Reflect.construct(Function, ...)
+          - pattern: Reflect.apply(eval, ...)
+          - pattern: Reflect.apply(Function, ...)
+          - pattern: vm.runInNewContext(...)
+          - pattern: vm.runInThisContext(...)
+          - pattern: vm.runInContext(...)
+          - pattern: vm.compileFunction(...)
+          - pattern: new vm.Script(...)
+          - pattern: new Script(...)
+          - pattern: new vm.SourceTextModule(...)
+          - pattern: $VM.runInNewContext(...)
+          - pattern: $VM.runInThisContext(...)
+          - pattern: $VM.runInContext(...)
+          - pattern: $VM.compileFunction(...)
+          - pattern: new $VM.Script(...)
+          - pattern: setTimeout("...", ...)
+          - pattern: setInterval("...", ...)
+          - pattern: setTimeout($S + $T, ...)
+          - pattern: setInterval($S + $T, ...)
+          - pattern: setTimeout(`...${$X}...`, ...)
+          - pattern: setInterval(`...${$X}...`, ...)
+          - pattern: setTimeout($S as any, ...)
+          - pattern: setInterval($S as any, ...)
+          - pattern: setTimeout($S as string, ...)
+          - pattern: setInterval($S as string, ...)
+          - pattern: setTimeout(String(...), ...)
+          - pattern: setTimeout($S.toString(), ...)
+      - pattern-not: eval("...")
+      - pattern-not: new Function(..., "...")
+      - pattern-not: Function("...")
+      - pattern-not: $G.eval("...")
+      - pattern-not: new vm.Script("...")
+      - pattern-not: new Script("...")
+      - pattern-not: new $VM.Script("...")
+      - pattern-not: vm.compileFunction("...")
+      - pattern-not: $VM.compileFunction("...")
+      - pattern-not: vm.runInContext("...", ...)
+      - pattern-not: vm.runInNewContext("...", ...)
+      - pattern-not: vm.runInThisContext("...")
+    metadata:
+      sec_ids: [SEC-API-021, SEC-WEB-031]
+      severity_hint: HIGH
+      confidence: HIGH
+      note: >-
+        Covers direct and indirect eval, the Function constructor (also through Reflect and a
+        global object), vm run and compile calls, and string timers. The global receiver match
+        ($G.eval) is broad and also fires on any object with an eval method.
+  - id: hullproof-eval-through-alias
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      eval or the Function constructor is copied to another name and then called. This hides a
+      dynamic code call from name based review. Remove it.
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $F = eval;
+              ...
+              $F($X, ...);
+          - pattern: |
+              $F = Function;
+              ...
+              $F($X, ...);
+          - pattern: |
+              $F = Function;
+              ...
+              new $F($X, ...);
+          - pattern: |
+              $F = $G.eval;
+              ...
+              $F($X, ...);
+          - pattern: $A.constructor.constructor($X)
+          - pattern: (() => {}).constructor($X)
+          - pattern: (function () {}).constructor($X)
+          - pattern: (async () => {}).constructor($X)
+      - pattern-not: $A.constructor.constructor("...")
+    metadata:
+      sec_ids: [SEC-API-021]
+      severity_hint: HIGH
+      confidence: MEDIUM
+      note: Same block alias only. An alias passed through a function parameter or an import is not followed.
+  - id: hullproof-expression-library-eval
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A library that interprets text as code or as a template is called with a non constant value.
+      Expression and template engines run attacker text with the process's powers. Compile only
+      reviewed constants, or evaluate with a sandbox that has no access to globals.
+    patterns:
+      - pattern-either:
+          - patterns:
+              - pattern-either:
+                  - pattern: $M.evaluate($X, ...)
+                  - pattern: $M.parse($X).evaluate(...)
+                  - pattern: $M.compile($X)
+                  - pattern: $M.template($X, ...)
+                  - pattern: $M.render($X, ...)
+                  - pattern: $M.renderString($X, ...)
+                  - pattern: $M.renderToString($X, ...)
+                  - pattern: $M.run($X, ...)
+              - metavariable-regex:
+                  metavariable: $M
+                  regex: ^(math|mathjs|parser|expr|jexl|jsonata|_|lodash|ejs|pug|jade|Handlebars|handlebars|hbs|nunjucks|env|Mustache|mustache|doT|dot|liquid|engine|vm2|sandbox|VM)$
+          - pattern: jsonata($X)
+          - pattern: new Function($X)
+          - pattern: new VM(...).run($X)
+          - pattern: new NodeVM(...).run($X)
+          - pattern: new Parser().evaluate($X)
+          - pattern: new Parser().parse($X)
+          - pattern: new Jexl().eval($X)
+          - patterns:
+              - pattern-inside: |
+                  import {..., evaluate, ...} from "mathjs";
+                  ...
+              - pattern: evaluate($X, ...)
+          - patterns:
+              - pattern-inside: |
+                  import {..., compile, ...} from "handlebars";
+                  ...
+              - pattern: compile($X, ...)
+      - metavariable-pattern:
+          metavariable: $X
+          patterns:
+            - pattern-not: '"..."'
+            - pattern-not: "`...`"
+    metadata:
+      sec_ids: [SEC-API-021]
+      severity_hint: HIGH
+      confidence: MEDIUM
+      note: >-
+        Server template and expression engines (SEC-API-021).
+        Receiver names are matched by a regex over common import names. Rename the alias or edit the regex.
+  - id: hullproof-dynamic-module-path
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      A module is loaded from a computed path. If any part comes from a request, a database row or a
+      file, the caller chooses which code runs. Load from a fixed map of allowed names instead.
+    patterns:
+      - pattern-either:
+          - pattern: require($X)
+          - pattern: import($X)
+          - pattern: createRequire(...)($X)
+          - pattern: module.require($X)
+      - metavariable-pattern:
+          metavariable: $X
+          patterns:
+            - pattern-not: '"..."'
+            - pattern-not: "`...`"
+            - pattern-not: path.join(__dirname, "...")
+            - pattern-not: path.resolve(__dirname, "...")
+            - pattern-not: |
+                `./...${$Y}...`
+            - pattern-not: |
+                `../...${$Y}...`
+      - pattern-not: require.resolve(...)
+    metadata:
+      sec_ids: [SEC-API-021]
+      severity_hint: MEDIUM
+      confidence: LOW
+      note: >-
+        Relative template paths with a fixed directory prefix are skipped because a bundler limits
+        them to that folder. Confirm the variable part cannot contain dot dot segments.

package/rules/semgrep/log-session-token.yaml

@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/log-session-token.yaml).
+#
+rules:
+  - id: hullproof-log-session-token
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      A log call receives a value whose name says it is a session token, access token, authorization header, cookie, password or
+      secret. Logs are copied to vendors and read by more people than the database. Log a user id or a request id instead,
+      and never the credential.
+    patterns:
+      - pattern-either:
+          - patterns:
+              - pattern-either:
+                  - pattern: $L.$M(<... $ARG ...>)
+                  - pattern: $L.$M(..., <... $ARG ...>, ...)
+              - metavariable-regex:
+                  metavariable: $ARG
+                  regex: (?i)^(?:[\w$]+\??\.)*[\w$]*(?:accesstoken|refreshtoken|idtoken|sessiontoken|session_token|access_token|refresh_token|id_token|authorization|bearer|jwt|cookie|password|passwd|secret|apikey|api_key)[\w$]*$
+          - patterns:
+              - pattern-either:
+                  - pattern: $L.$M($ARG)
+                  - pattern: $L.$M(..., $ARG, ...)
+              - metavariable-regex:
+                  metavariable: $ARG
+                  regex: (?i)^(?:[\w$]+\??\.)*(?:token|session|headers)$
+          - patterns:
+              - pattern-either:
+                  - pattern: $L.$M(<... $H.get($K) ...>)
+                  - pattern: $L.$M(..., <... $H.get($K) ...>, ...)
+              - metavariable-regex:
+                  metavariable: $K
+                  regex: (?i)^["'`](authorization|cookie|x-api-key)["'`]$
+      - metavariable-regex:
+          metavariable: $L
+          regex: ^(console|logger|log|Logger|winston|pino|bunyan|Sentry|this\.logger)$
+      - metavariable-regex:
+          metavariable: $M
+          regex: ^(log|info|warn|error|debug|trace|fatal|captureMessage|addBreadcrumb)$
+    metadata:
+      sec_ids: [SEC-LOG-001]
+      severity_hint: HIGH
+      confidence: MEDIUM
+      note: >-
+        Matches names only. A string literal is not a match. Logging a whole session object or the whole headers object is
+        reported because both hold the token. A variable with a neutral name that holds a token is not found.

package/rules/semgrep/math-random-tokens.yaml

@@ -0,0 +1,24 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/math-random-tokens.yaml).
+#
+rules:
+  - id: hullproof-math-random-token
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      Math.random is not a secure random source. Use crypto.randomUUID or crypto.getRandomValues
+      for tokens, codes, secrets and identifiers that must be unguessable.
+    patterns:
+      - pattern-either:
+          - pattern: $N = <... Math.random() ...>
+          - pattern: function $N(...) { ... Math.random(); ... }
+          - pattern: function $N(...) { ... return <... Math.random() ...>; }
+          - pattern: '{..., $N: <... Math.random() ...>, ...}'
+      - metavariable-regex:
+          metavariable: $N
+          regex: (?i)^(.*(token|secret|invite|reset|nonce|otp|password|apikey|api_key|session|share|code|salt).*|id|.*_id|[a-z]*Id)$
+    metadata:
+      sec_ids: [SEC-DATA-001, SEC-AUTH-001]
+      severity_hint: HIGH
+      confidence: MEDIUM

package/rules/semgrep/next-public-secret-name.yaml

@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/next-public-secret-name.yaml).
+#
+rules:
+  - id: hullproof-next-public-secret-name
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A variable with the NEXT_PUBLIC_ prefix is named like a service role key or a secret. Next.js copies every NEXT_PUBLIC_
+      variable into the browser bundle, so the value is public to everyone who loads the site. Rename it without the prefix,
+      read it only in server code, and rotate the key if it was ever deployed with the prefix.
+    patterns:
+      - pattern-either:
+          - pattern: process.env.$V
+          - pattern: process.env["$V"]
+          - pattern: process.env['$V']
+          - pattern: import.meta.env.$V
+          - pattern: '{..., $V: $X, ...}'
+          - pattern: '{..., "$V": $X, ...}'
+      - metavariable-regex:
+          metavariable: $V
+          regex: (?i)^NEXT_PUBLIC_.*(SERVICE_?ROLE|SERVICE_?KEY|SECRET|PRIVATE|ADMIN_?KEY|WEBHOOK_?SIGNING)
+      - focus-metavariable: $V
+    metadata:
+      sec_ids: [SEC-SECRETS-001, SEC-SECRETS-003]
+      severity_hint: CRITICAL
+      confidence: MEDIUM
+      note: >-
+        Matches the variable name only, never the value. It also fires on a safe use, for example a name that holds a public
+        identifier such as NEXT_PUBLIC_SECRET_SANTA_URL. Read the line. Env files are not scanned by this rule, see the
+        gitleaks configuration and the SEC-SECRETS-001 recipe for them.

package/rules/semgrep/postgrest-filter-injection.yaml

@@ -0,0 +1,78 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/postgrest-filter-injection.yaml).
+#
+rules:
+  - id: hullproof-postgrest-filter-string
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A PostgREST filter string, column or embed list is built from a value that is not a constant.
+      Filter strings are parsed as a small language, so a comma, a dot or a parenthesis in the value
+      adds conditions (for example an extra or branch that matches every row). Use the builder
+      methods with one column and one value each (eq, ilike, in), and take column names and sort
+      keys from a fixed allowlist.
+    patterns:
+      - pattern-either:
+          - pattern: $Q.or($F, ...)
+          - pattern: $Q.and($F, ...)
+          - pattern: $Q.filter($F, $OP, $V)
+          - pattern: $Q.not($F, $OP, $V)
+          - pattern: $Q.order($F, ...)
+          - pattern: $Q.eq($F, $V)
+          - pattern: $Q.neq($F, $V)
+          - pattern: $Q.ilike($F, $V)
+          - pattern: $Q.like($F, $V)
+          - pattern: $Q.in($F, $V)
+          - pattern: $Q.contains($F, $V)
+          - pattern: $Q.textSearch($F, $V, ...)
+          - pattern: $Q.from(...).select($F, ...)
+      - metavariable-pattern:
+          metavariable: $F
+          patterns:
+            - pattern: $Z
+            - pattern-not: '"..."'
+            - pattern-not: "`...`"
+            - pattern-not: '[...]'
+            - pattern-not: '{...}'
+      - metavariable-regex:
+          metavariable: $F
+          regex: (?s)^(?![A-Z][A-Z0-9_]*$)(?!\s*[\[{])(?!(?:z|zod|v|yup|Joi|t|S|Type|type)\.)
+    metadata:
+      sec_ids: [SEC-API-018, SEC-API-017]
+      severity_hint: HIGH
+      confidence: MEDIUM
+      note: >-
+        Fires on any non constant column name, filter string or sort key passed to a query builder
+        method. Value arguments of eq, ilike and in are bound by the client and are not flagged
+        unless the first argument is also dynamic. A constant written in upper case is skipped, and so is an argument that starts with a schema library name (z, zod, yup, Joi), because zod and similar libraries have or and and methods too.
+        Mongoose and similar libraries also have or and and methods: array and object arguments are skipped.
+  - id: hullproof-postgrest-interpolated-filter
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A value is interpolated into a PostgREST filter string. A comma, dot or parenthesis in the value
+      changes the filter. Build the condition with one builder call per column and bind each value.
+    patterns:
+      - pattern-either:
+          - pattern: $Q.or(`...${$V}...`, ...)
+          - pattern: $Q.and(`...${$V}...`, ...)
+          - pattern: $Q.or("..." + $V, ...)
+          - pattern: $Q.and("..." + $V, ...)
+          - pattern: $Q.or($V + "...", ...)
+          - pattern: $Q.not($C, $O, `...${$V}...`)
+          - pattern: $Q.filter($C, $O, `...${$V}...`)
+          - pattern: $Q.from(...).select(`...${$V}...`, ...)
+          - pattern: $Q.select(`...${$V}...`, ...)
+      - metavariable-regex:
+          metavariable: $Q
+          regex: (?s).*(from|supabase|client|admin|db|query|builder|rest|table)\b.*
+    metadata:
+      sec_ids: [SEC-API-018, SEC-API-017]
+      severity_hint: CRITICAL
+      confidence: HIGH
+      note: >-
+        Template or concatenated string in or, and, filter, not or a select list on a Supabase or
+        PostgREST builder. The receiver name must mention from, supabase, client, admin, db, query,
+        builder, rest or table, which keeps unrelated or methods out. Single column calls such as
+        ilike with an interpolated pattern are bound by the client and are not matched.

package/rules/semgrep/raw-sql-concat.yaml

@@ -0,0 +1,42 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/raw-sql-concat.yaml).
+#
+rules:
+  - id: hullproof-raw-sql-concat
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A query sink receives a string built from an interpolated or concatenated value. Use
+      parameters or a tagged template that binds values.
+    patterns:
+      - pattern-either:
+          - pattern: $X.$M(`...${$Y}...`, ...)
+          - pattern: $X.$M("..." + $Y, ...)
+          - pattern: $X.$M($Y + "...", ...)
+          - pattern: $X.$M("...".concat(...), ...)
+          - pattern: $X.$M([...].join(...), ...)
+          - pattern: $X.$M(`...${$Y}...`.concat(...), ...)
+      - metavariable-regex:
+          metavariable: $M
+          regex: ^(query|execute|raw|unsafe|\$queryRawUnsafe|\$executeRawUnsafe|queryRawUnsafe|executeRawUnsafe|whereRaw|andWhereRaw|orWhereRaw|havingRaw|orderByRaw|groupByRaw|joinRaw|selectRaw|fromRaw|rawQuery|literal)$
+    metadata:
+      sec_ids: [SEC-API-017]
+      severity_hint: CRITICAL
+      confidence: HIGH
+      note: >-
+        Unambiguous query method names. Tagged template calls bind values and are not matched. The
+        queryRaw and executeRaw plain string misuse is in sql-variants.yaml.
+  - id: hullproof-sql-string-built-in-variable
+    languages: [generic]
+    severity: WARNING
+    message: >-
+      A template literal that looks like SQL contains an interpolated value. If it reaches a query
+      call, bind the value as a parameter instead.
+    paths:
+      include: ["*.ts", "*.tsx", "*.js", "*.jsx", "*.mjs"]
+    pattern-regex: '(?is)(?<![\w$])`[^`]*\b(?:select\s[^`]*\sfrom|insert\s+into|update\s+\w+\s+set|delete\s+from)\b[^`]*\$\{'
+    metadata:
+      sec_ids: [SEC-API-017]
+      severity_hint: HIGH
+      confidence: LOW

package/rules/semgrep/read-by-id-no-owner.yaml

@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/read-by-id-no-owner.yaml).
+#
+rules:
+  - id: hullproof-read-by-id-no-owner
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A record is read by its id alone. The query holds no filter on the owner, user, organisation or tenant, so any caller who
+      knows or guesses another id gets that record. Add the owner filter to the same query (or rely on a row level security policy
+      that you have tested) and return 404 for a record that is not the caller's.
+    patterns:
+      - pattern-either:
+          - patterns:
+              - pattern-either:
+                  - pattern: $C.from(...).select(...).eq("id", $X)
+                  - pattern: $C.from(...).select().eq("id", $X)
+              - pattern-not-inside:
+                  patterns:
+                    - pattern: <... $Q.eq($K, ...) ...>
+                    - metavariable-regex:
+                        metavariable: $K
+                        regex: (?i)^["'`].*(user|owner|org|tenant|team|account|created_?by|author|member|workspace|profile|customer).*["'`]$
+          - patterns:
+              - pattern-either:
+                  - pattern: '$P.$T.$FIND({ where: { id: $X } })'
+                  - pattern: '$P.$T.$FIND({ where: { id: $X }, ... })'
+              - pattern-not:
+                  patterns:
+                    - pattern: '$P.$T.$FIND({ where: { ..., $K: $V, ... } })'
+                    - metavariable-regex:
+                        metavariable: $K
+                        regex: (?i)^["'`]?.*(user|owner|org|tenant|team|account|created_?by|author|member|workspace|profile|customer).*["'`]?$
+              - metavariable-regex:
+                  metavariable: $FIND
+                  regex: ^(findUnique|findUniqueOrThrow|findFirst|findFirstOrThrow)$
+          - pattern: $DB.select(...).from($T).where(eq($T2.id, $X))
+      - metavariable-regex:
+          metavariable: $X
+          regex: (?i)^(?!.*(user|session|auth|owner|me\b)).*$
+    metadata:
+      sec_ids: [SEC-AUTHZ-003]
+      severity_hint: HIGH
+      confidence: LOW
+      note: >-
+        Covers a Supabase client chain, a Prisma find call and a Drizzle select with one id condition. It cannot see a row level
+        security policy, a wrapper that adds the owner filter, or an owner check made on the next line. A value whose text names
+        user, session, auth or owner is treated as the caller's own id and skipped. Read the query and the policy before you rate it.

package/rules/semgrep/server-action-no-auth.yaml

@@ -0,0 +1,26 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/server-action-no-auth.yaml).
+#
+rules:
+  - id: hullproof-server-action-no-auth
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      Exported function in a file with a top level "use server" directive has no call to a
+      session, auth or permission helper anywhere in its body. Every export is a public endpoint. Call the shared auth helper first.
+    patterns:
+      - pattern-inside: |
+          "use server";
+          ...
+      - pattern-either:
+          - pattern: export async function $F(...) { ... }
+          - pattern: export const $F = async (...) => { ... }
+      - pattern-not-regex: (?i)\b(?:[\w$]*(?:getUser|getSession|getClaims|requireUser|currentUser|session|assertAdmin|requireAdmin|authorize|authenticate|requireRole|checkPermission|validateRequest|requireAuth|withAuth|checkAuth|assertAuth|verifyAuth)[\w$]*|auth)\s*\(
+    metadata:
+      sec_ids: [SEC-AUTHZ-002, SEC-API-001]
+      severity_hint: HIGH
+      confidence: MEDIUM
+      note: >-
+        The whole function text is searched, so a session read inside an if, try or nested block counts. A helper name in a comment also
+        counts. The helper name regex is a convention guess. Adjust it to the project's auth helper.

package/rules/semgrep/sql-variants.yaml

@@ -0,0 +1,99 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/sql-variants.yaml).
+#
+rules:
+  - id: hullproof-sql-raw-non-literal
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A raw SQL helper receives a value that is not a constant string. Raw helpers send the text
+      to the database as code. Bind values as parameters, and take identifiers from a fixed
+      allowlist.
+    patterns:
+      - pattern-either:
+          - pattern: sql.raw($Y)
+          - pattern: sql.unsafe($Y, ...)
+          - pattern: Prisma.raw($Y)
+          - patterns:
+              - pattern-either:
+                  - pattern: $DB.raw($Y, ...)
+                  - pattern: $DB.unsafe($Y, ...)
+                  - pattern: $DB.literal($Y)
+              - metavariable-regex:
+                  metavariable: $DB
+                  regex: (?i)^(?:.*\.)?(?:\w*knex\w*|\w*sequelize\w*|\w*db|db\w*|trx|tx|pool|database|conn|connection|kx|sql|pg|client|query)$
+          - patterns:
+              - pattern: $DB.$M($Y, ...)
+              - metavariable-regex:
+                  metavariable: $M
+                  regex: ^(whereRaw|andWhereRaw|orWhereRaw|havingRaw|orderByRaw|groupByRaw|joinRaw|selectRaw|fromRaw|\$queryRawUnsafe|\$executeRawUnsafe|queryRawUnsafe|executeRawUnsafe)$
+      - metavariable-pattern:
+          metavariable: $Y
+          patterns:
+            - pattern: $Z
+            - pattern-not: '"..."'
+            - pattern-not: "`...`"
+    metadata:
+      sec_ids: [SEC-API-017]
+      severity_hint: HIGH
+      confidence: MEDIUM
+      note: Fires on any non constant argument, including a variable that holds a reviewed constant. Read the variable.
+  - id: hullproof-sql-tagged-template-misuse
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      A function that is built for tagged templates is called with an ordinary string. The
+      interpolated value is pasted into the SQL text and is not bound. Write sql`...${value}...`
+      without the parentheses so the library binds it, or call the unsafe variant on purpose with
+      an allowlisted value.
+    patterns:
+      - pattern-either:
+          - pattern: sql(`...${$Y}...`)
+          - pattern: sql("..." + $Y)
+          - pattern: $DB.sql(`...${$Y}...`)
+          - pattern: $DB.$queryRaw(`...${$Y}...`)
+          - pattern: $DB.$executeRaw(`...${$Y}...`)
+          - pattern: Prisma.sql(`...${$Y}...`)
+          - pattern: $T`...${sql.raw($Y)}...`
+          - pattern: $T`...${Prisma.raw($Y)}...`
+          - pattern: $T`...${$DB.unsafe($Y)}...`
+    metadata:
+      sec_ids: [SEC-API-017]
+      severity_hint: CRITICAL
+      confidence: MEDIUM
+      note: Covers postgres.js, drizzle and Prisma call shapes. The raw helper inside a tagged template is also flagged.
+  - id: hullproof-sql-built-string-reaches-query
+    languages: [typescript, javascript]
+    mode: taint
+    severity: ERROR
+    message: >-
+      A string that starts like a SQL statement and holds a concatenated or interpolated value
+      reaches a query call. Bind the value as a parameter.
+    pattern-sources:
+      - pattern-regex: '(?is)(?<![\w$])`\s*(?:select|insert\s+into|update|delete\s+from|with\s+\w+\s+as|merge\s+into|create|alter|drop|truncate|call|exec|execute)\b[^`]*\$\{[^`]*`'
+      - patterns:
+          - pattern-either:
+              - pattern: '$L + $Y'
+              - pattern: '[$L, ...].join(...)'
+              - pattern: '$L.concat(...)'
+          - metavariable-regex:
+              metavariable: $L
+              regex: '(?is)^["''`]\s*(?:select|insert|update|delete|with|merge|create|alter|drop|truncate|call|exec|execute)\b'
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: $X.$M($Q, ...)
+              - pattern: $M($Q, ...)
+          - focus-metavariable: $Q
+          - metavariable-regex:
+              metavariable: $M
+              regex: ^(query|execute|exec|run|get|all|prepare|any|one|many|none|oneOrNone|manyOrNone|result|raw|unsafe|each|map|task|tx|\$queryRawUnsafe|\$executeRawUnsafe|queryRawUnsafe|executeRawUnsafe|whereRaw|havingRaw|orderByRaw|selectRaw|joinRaw|runSql|runQuery|rawQuery|literal)$
+    metadata:
+      sec_ids: [SEC-API-017]
+      severity_hint: CRITICAL
+      confidence: MEDIUM
+      note: >-
+        Follows a built string through a variable inside one function or file. The source must
+        start with a SQL keyword, which keeps get and run style method names from firing on
+        unrelated strings.