hullproof 0.0.0-stage → 0.5.0

package/rules/semgrep/taint-python.yaml

@@ -0,0 +1,414 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Written for the Hullproof Engine from the CWE definitions named in each rule. Not copied or derived from any Semgrep
+# registry rule. Fixtures: test/fixtures/rules/taint-python.py, run by test/rules.test.ts with semgrep --test.
+#
+# Sources are request data in Flask, Django (and Django REST framework) and FastAPI (and Starlette): the request object's
+# fields and the parameters of a function under a route decorator. Taint flows through string building, assignment and
+# calls by default. Each rule names its sanitizers; a project guard is recognised when its name says what it checks.
+rules:
+  - id: hullproof-taint-py-sql-injection
+    languages: [python]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data reaches the text of a SQL query (CWE-89). Pass the value as a bound parameter, for example
+      cursor.execute("SELECT * FROM t WHERE id = %s", (value,)), and keep the query text constant.
+    metadata:
+      cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command"
+      sec_ids: [SEC-API-017]
+    pattern-sources:
+      - pattern: flask.request
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.GET
+              - pattern: $REQ.POST
+              - pattern: $REQ.COOKIES
+              - pattern: $REQ.META
+              - pattern: $REQ.FILES
+              - pattern: $REQ.body
+              - pattern: $REQ.headers
+              - pattern: $REQ.cookies
+              - pattern: $REQ.data
+              - pattern: $REQ.query_params
+              - pattern: $REQ.path_params
+              - pattern: $REQ.json()
+              - pattern: $REQ.body()
+              - pattern: $REQ.form()
+          - metavariable-regex:
+              metavariable: $REQ
+              regex: ^(request|req|self\.request)$
+      - patterns:
+          - pattern-either:
+              - pattern-inside: |
+                  @$APP.$VERB(...)
+                  def $F(..., $P, ...):
+                    ...
+              - pattern-inside: |
+                  @$APP.$VERB(...)
+                  async def $F(..., $P, ...):
+                    ...
+          - metavariable-regex:
+              metavariable: $VERB
+              regex: ^(route|get|post|put|patch|delete|api_route|websocket)$
+          - focus-metavariable: $P
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: int(...)
+          - pattern: float(...)
+          - pattern: bool(...)
+          - pattern: uuid.UUID(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: $C.execute($Q, ...)
+              - pattern: $C.executemany($Q, ...)
+              - pattern: $C.executescript($Q, ...)
+              - pattern: $C.exec_driver_sql($Q, ...)
+              - pattern: $M.objects.raw($Q, ...)
+              - pattern: $M.objects.extra(..., where=$Q, ...)
+              - pattern: django.db.models.expressions.RawSQL($Q, ...)
+              - pattern: sqlalchemy.text($Q, ...)
+              - pattern: pandas.read_sql($Q, ...)
+              - pattern: pandas.read_sql_query($Q, ...)
+          - focus-metavariable: $Q
+
+  - id: hullproof-taint-py-xss
+    languages: [python]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data is written into an HTML response without encoding (CWE-79). Render it through an autoescaping template
+      (render_template, Django templates) or encode it with html.escape or markupsafe.escape before it is placed in HTML.
+    metadata:
+      cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation"
+      sec_ids: [SEC-WEB-031]
+    pattern-sources:
+      - pattern: flask.request
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.GET
+              - pattern: $REQ.POST
+              - pattern: $REQ.COOKIES
+              - pattern: $REQ.META
+              - pattern: $REQ.FILES
+              - pattern: $REQ.body
+              - pattern: $REQ.headers
+              - pattern: $REQ.cookies
+              - pattern: $REQ.data
+              - pattern: $REQ.query_params
+              - pattern: $REQ.path_params
+              - pattern: $REQ.json()
+              - pattern: $REQ.body()
+              - pattern: $REQ.form()
+          - metavariable-regex:
+              metavariable: $REQ
+              regex: ^(request|req|self\.request)$
+      - patterns:
+          - pattern-either:
+              - pattern-inside: |
+                  @$APP.$VERB(...)
+                  def $F(..., $P, ...):
+                    ...
+              - pattern-inside: |
+                  @$APP.$VERB(...)
+                  async def $F(..., $P, ...):
+                    ...
+          - metavariable-regex:
+              metavariable: $VERB
+              regex: ^(route|get|post|put|patch|delete|api_route|websocket)$
+          - focus-metavariable: $P
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: html.escape(...)
+          - pattern: markupsafe.escape(...)
+          - pattern: flask.escape(...)
+          - pattern: django.utils.html.escape(...)
+          - pattern: django.utils.html.conditional_escape(...)
+          - pattern: bleach.clean(...)
+          - pattern: flask.jsonify(...)
+          - pattern: flask.render_template(...)
+          - pattern: django.shortcuts.render(...)
+          - pattern: flask.redirect(...)
+          - pattern: flask.url_for(...)
+          - pattern: flask.send_file(...)
+          - pattern: flask.send_from_directory(...)
+          - pattern: urllib.parse.quote(...)
+          - pattern: int(...)
+          - pattern: float(...)
+          - pattern: bool(...)
+          - pattern: len(...)
+    pattern-sinks:
+      # A Flask view's return value becomes a text/html response when it is a string. Dict and list returns become JSON.
+      - patterns:
+          - pattern-inside: |
+              @$APP.route(...)
+              def $F(...):
+                ...
+          - pattern-either:
+              - pattern: return $X
+              - pattern: return $X, ...
+          - pattern-not: return {...}
+          - pattern-not: return [...]
+          - pattern-not: return {...}, ...
+          - focus-metavariable: $X
+      - patterns:
+          - pattern-either:
+              - pattern: flask.make_response($X, ...)
+              - pattern: flask.Response($X, ...)
+              - pattern: flask.render_template_string($X, ...)
+              - pattern: markupsafe.Markup($X)
+              - pattern: django.http.HttpResponse($X, ...)
+              - pattern: django.utils.safestring.mark_safe($X)
+              - pattern: django.utils.html.format_html($X, ...)
+              - pattern: fastapi.responses.HTMLResponse($X, ...)
+              - pattern: starlette.responses.HTMLResponse($X, ...)
+          - pattern-not: flask.Response($X, ..., mimetype="application/json", ...)
+          - pattern-not: django.http.HttpResponse($X, ..., content_type="application/json", ...)
+          - focus-metavariable: $X
+
+  - id: hullproof-taint-py-command-injection
+    languages: [python]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data reaches a shell command or chooses the program that runs (CWE-78). Run a fixed program with an
+      argument list and no shell, map the request value to a fixed set of options, or quote it with shlex.quote when a
+      shell cannot be avoided.
+    metadata:
+      cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command"
+      sec_ids: [SEC-API-020]
+    pattern-sources:
+      - pattern: flask.request
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.GET
+              - pattern: $REQ.POST
+              - pattern: $REQ.COOKIES
+              - pattern: $REQ.META
+              - pattern: $REQ.FILES
+              - pattern: $REQ.body
+              - pattern: $REQ.headers
+              - pattern: $REQ.cookies
+              - pattern: $REQ.data
+              - pattern: $REQ.query_params
+              - pattern: $REQ.path_params
+              - pattern: $REQ.json()
+              - pattern: $REQ.body()
+              - pattern: $REQ.form()
+          - metavariable-regex:
+              metavariable: $REQ
+              regex: ^(request|req|self\.request)$
+      - patterns:
+          - pattern-either:
+              - pattern-inside: |
+                  @$APP.$VERB(...)
+                  def $F(..., $P, ...):
+                    ...
+              - pattern-inside: |
+                  @$APP.$VERB(...)
+                  async def $F(..., $P, ...):
+                    ...
+          - metavariable-regex:
+              metavariable: $VERB
+              regex: ^(route|get|post|put|patch|delete|api_route|websocket)$
+          - focus-metavariable: $P
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: shlex.quote(...)
+          - pattern: pipes.quote(...)
+          - pattern: int(...)
+          - pattern: float(...)
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: os.system($X)
+              - pattern: os.popen($X, ...)
+              - pattern: subprocess.getoutput($X)
+              - pattern: subprocess.getstatusoutput($X)
+              - pattern: asyncio.create_subprocess_shell($X, ...)
+              - pattern: subprocess.$F($X, ..., shell=True, ...)
+              - pattern: subprocess.$F([$X, ...], ...)
+              - pattern: subprocess.$F([$SH, "-c", $X, ...], ...)
+              - patterns:
+                  - pattern: os.$EXEC($X, ...)
+                  - metavariable-regex:
+                      metavariable: $EXEC
+                      regex: ^(execl|execle|execlp|execv|execve|execvp|execvpe|spawnl|spawnlp|spawnv|spawnvp)$
+          - focus-metavariable: $X
+      - patterns:
+          - pattern: subprocess.$F($X, ...)
+          - pattern-not: subprocess.$F([...], ...)
+          - metavariable-regex:
+              metavariable: $F
+              regex: ^(run|call|check_call|check_output|Popen)$
+          - focus-metavariable: $X
+
+  - id: hullproof-taint-py-path-traversal
+    languages: [python]
+    mode: taint
+    severity: WARNING
+    message: >-
+      Request data becomes part of a file path the server opens, writes, lists or deletes (CWE-22). Reduce the name with
+      os.path.basename or werkzeug secure_filename, or resolve the full path and check that it stays inside a fixed folder
+      before using it.
+    metadata:
+      cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory"
+      sec_ids: []
+    pattern-sources:
+      - pattern: flask.request
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.GET
+              - pattern: $REQ.POST
+              - pattern: $REQ.COOKIES
+              - pattern: $REQ.META
+              - pattern: $REQ.FILES
+              - pattern: $REQ.body
+              - pattern: $REQ.headers
+              - pattern: $REQ.cookies
+              - pattern: $REQ.data
+              - pattern: $REQ.query_params
+              - pattern: $REQ.path_params
+              - pattern: $REQ.json()
+              - pattern: $REQ.body()
+              - pattern: $REQ.form()
+          - metavariable-regex:
+              metavariable: $REQ
+              regex: ^(request|req|self\.request)$
+      - patterns:
+          - pattern-either:
+              - pattern-inside: |
+                  @$APP.$VERB(...)
+                  def $F(..., $P, ...):
+                    ...
+              - pattern-inside: |
+                  @$APP.$VERB(...)
+                  async def $F(..., $P, ...):
+                    ...
+          - metavariable-regex:
+              metavariable: $VERB
+              regex: ^(route|get|post|put|patch|delete|api_route|websocket)$
+          - focus-metavariable: $P
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: os.path.basename(...)
+          - pattern: werkzeug.utils.secure_filename(...)
+          - pattern: werkzeug.security.safe_join(...)
+          - pattern: werkzeug.utils.safe_join(...)
+          - pattern: flask.safe_join(...)
+          - pattern: int(...)
+          - pattern: uuid.UUID(...)
+      - by-side-effect: true
+        patterns:
+          - pattern: $GUARD($X, ...)
+          - metavariable-regex:
+              metavariable: $GUARD
+              regex: (?i).*(safe|allow|valid|guard|check|verify|within|inside|contain).*
+          - focus-metavariable: $X
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - pattern: open($X, ...)
+              - pattern: io.open($X, ...)
+              - pattern: codecs.open($X, ...)
+              - pattern: pathlib.Path($X, ...)
+              - pattern: pathlib.Path($BASE, $X, ...)
+              - pattern: flask.send_file($X, ...)
+              - patterns:
+                  - pattern: os.$OSF($X, ...)
+                  - metavariable-regex:
+                      metavariable: $OSF
+                      regex: ^(remove|unlink|rmdir|removedirs|mkdir|makedirs|listdir|scandir|stat|chmod|chown|rename|replace|walk|open|truncate)$
+              - patterns:
+                  - pattern-either:
+                      - pattern: shutil.$SHF($X, ...)
+                      - pattern: shutil.$SHF($SRC, $X, ...)
+                  - metavariable-regex:
+                      metavariable: $SHF
+                      regex: ^(copy|copyfile|copy2|copytree|move|rmtree)$
+          - focus-metavariable: $X
+
+  - id: hullproof-taint-py-ssrf
+    languages: [python]
+    mode: taint
+    severity: ERROR
+    message: >-
+      Request data chooses the address of an outbound request the server makes (CWE-918). Allow only http and https,
+      resolve the host, refuse private, loopback, link local and metadata addresses, connect to the checked address and
+      do not follow redirects unchecked. A value that only fills a path or query under a fixed host is not matched.
+    metadata:
+      cwe: "CWE-918: Server-Side Request Forgery (SSRF)"
+      sec_ids: [SEC-API-035]
+    pattern-sources:
+      - pattern: flask.request
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.GET
+              - pattern: $REQ.POST
+              - pattern: $REQ.COOKIES
+              - pattern: $REQ.META
+              - pattern: $REQ.FILES
+              - pattern: $REQ.body
+              - pattern: $REQ.headers
+              - pattern: $REQ.cookies
+              - pattern: $REQ.data
+              - pattern: $REQ.query_params
+              - pattern: $REQ.path_params
+              - pattern: $REQ.json()
+              - pattern: $REQ.body()
+              - pattern: $REQ.form()
+          - metavariable-regex:
+              metavariable: $REQ
+              regex: ^(request|req|self\.request)$
+      - patterns:
+          - pattern-either:
+              - pattern-inside: |
+                  @$APP.$VERB(...)
+                  def $F(..., $P, ...):
+                    ...
+              - pattern-inside: |
+                  @$APP.$VERB(...)
+                  async def $F(..., $P, ...):
+                    ...
+          - metavariable-regex:
+              metavariable: $VERB
+              regex: ^(route|get|post|put|patch|delete|api_route|websocket)$
+          - focus-metavariable: $P
+    pattern-sanitizers:
+      - pattern-either:
+          - pattern: int(...)
+          - pattern: urllib.parse.quote(...)
+          - pattern: urllib.parse.urlencode(...)
+      # A fixed scheme and host before the request value: the value can only change the path or the query.
+      - patterns:
+          - pattern: '"$URL" + $Y'
+          - metavariable-regex:
+              metavariable: $URL
+              regex: ^https?://[^/]+/
+      - pattern-regex: f["']https?://[^/"'{]+/[^"']*["']
+      - by-side-effect: true
+        patterns:
+          - pattern: $GUARD($X, ...)
+          - metavariable-regex:
+              metavariable: $GUARD
+              regex: (?i).*(safe|allow|valid|guard|check|verify).*
+          - focus-metavariable: $X
+    pattern-sinks:
+      - patterns:
+          - pattern-either:
+              - patterns:
+                  - pattern-either:
+                      - pattern: requests.$M($X, ...)
+                      - pattern: httpx.$M($X, ...)
+                  - metavariable-regex:
+                      metavariable: $M
+                      regex: ^(get|post|put|patch|delete|head|options)$
+              - pattern: requests.request($METHOD, $X, ...)
+              - pattern: httpx.request($METHOD, $X, ...)
+              - pattern: urllib.request.urlopen($X, ...)
+              - pattern: urllib.request.Request($X, ...)
+              - pattern: urllib3.PoolManager(...).request($METHOD, $X, ...)
+              - pattern: http.client.HTTPConnection($X, ...)
+              - pattern: http.client.HTTPSConnection($X, ...)
+          - focus-metavariable: $X

package/rules/semgrep/tool-endpoint-admin-client.yaml

@@ -0,0 +1,86 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/tool-endpoint-admin-client.yaml).
+#
+rules:
+  - id: hullproof-tool-handler-admin-client-no-scope
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      A tool handler (an MCP server tool or a model tool) uses an admin or service role client and
+      takes no argument that could carry the caller (the handler has at most one parameter, its input).
+      Anyone who can call the tool, or any prompt that makes the model call it, acts with the service
+      role's powers. Use a client that carries the caller's own token, or check the caller's scope and
+      ownership of every id before using the admin client. Flagged for review.
+    # The admin client names below are heuristics. Edit them to match the project. A handler with two or
+    # more parameters is not flagged, because the second one (the MCP extra argument, or a context object)
+    # is where the caller identity arrives. Read those handlers by hand.
+    patterns:
+      - pattern-inside:
+          pattern-either:
+            - pattern: $S.tool(..., async () => { ... }, ...)
+            - pattern: $S.tool(..., async ($A) => { ... }, ...)
+            - pattern: $S.registerTool(..., async () => { ... }, ...)
+            - pattern: $S.registerTool(..., async ($A) => { ... }, ...)
+            - pattern: '$S.addTool({..., execute: async () => { ... }, ...})'
+            - pattern: '$S.addTool({..., execute: async ($A) => { ... }, ...})'
+            - pattern: '$T({..., execute: async () => { ... }, ...})'
+            - pattern: '$T({..., execute: async ($A) => { ... }, ...})'
+            - pattern: '$T({..., func: async () => { ... }, ...})'
+            - pattern: '$T({..., func: async ($A) => { ... }, ...})'
+            - pattern: $S.setRequestHandler(CallToolRequestSchema, async () => { ... })
+            - pattern: $S.setRequestHandler(CallToolRequestSchema, async ($A) => { ... })
+      # A registration made inside a function that takes a parameter (a per request or per user factory)
+      # is not flagged: the caller is captured by the closure. Read those by hand.
+      - pattern-not-inside: |
+          function $F($P, ...) { ... $S.tool(...); ... }
+      - pattern-not-inside: |
+          async function $F($P, ...) { ... $S.tool(...); ... }
+      - pattern-not-inside: |
+          ($P, ...) => { ... $S.tool(...); ... }
+      - pattern-not-inside: |
+          async ($P, ...) => { ... $S.tool(...); ... }
+      - pattern-not-inside: |
+          function $F($P, ...) { ... $S.registerTool(...); ... }
+      - pattern-not-inside: |
+          async function $F($P, ...) { ... $S.registerTool(...); ... }
+      - pattern-not-inside: |
+          ($P, ...) => { ... $S.registerTool(...); ... }
+      - pattern-not-inside: |
+          async ($P, ...) => { ... $S.registerTool(...); ... }
+      - pattern-not-inside: |
+          function $F($P, ...) { ... $S.addTool(...); ... }
+      - pattern-not-inside: |
+          async function $F($P, ...) { ... $S.addTool(...); ... }
+      - pattern-not-inside: |
+          ($P, ...) => { ... $S.addTool(...); ... }
+      - pattern-not-inside: |
+          async ($P, ...) => { ... $S.addTool(...); ... }
+      - pattern-not-inside: |
+          function $F($P, ...) { ... $S.setRequestHandler(...); ... }
+      - pattern-not-inside: |
+          async function $F($P, ...) { ... $S.setRequestHandler(...); ... }
+      - pattern-not-inside: |
+          ($P, ...) => { ... $S.setRequestHandler(...); ... }
+      - pattern-not-inside: |
+          async ($P, ...) => { ... $S.setRequestHandler(...); ... }
+      - pattern-either:
+          - patterns:
+              - pattern: $ADM(...)
+              - metavariable-regex:
+                  metavariable: $ADM
+                  regex: (?i)^(create|get|make|build|init)?(supabase)?(admin|service|servicerole|privileged)(supabase)?(client|db|database)?$
+          - pattern: process.env.SUPABASE_SERVICE_ROLE_KEY
+          - pattern: process.env.SERVICE_ROLE_KEY
+          - pattern: supabaseAdmin
+          - pattern: $X.auth.admin
+          - pattern: adminClient
+          - pattern: serviceClient
+    metadata:
+      sec_ids: [SEC-AI-020, SEC-AI-021, SEC-AGENT-008, SEC-SECRETS-003]
+      severity_hint: CRITICAL
+      confidence: LOW
+      note: >-
+        Pattern based lead for review. The finding is on the admin client use inside the handler. A caller
+        check made before the handler runs (in middleware) is not seen and shows up here, so confirm where
+        the caller is authenticated.

package/rules/semgrep/user-metadata-authz.yaml

@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/user-metadata-authz.yaml).
+#
+rules:
+  - id: hullproof-user-metadata-authz
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      user_metadata is editable by the signed in user. Do not read it in an authorization decision.
+      Use app_metadata or a server owned table.
+    pattern-either:
+      - pattern: if (<... $U.user_metadata ...>) $S
+      - pattern: $U.user_metadata.$F === $V
+      - pattern: $U.user_metadata.$F == $V
+      - pattern: $U.user_metadata.$F !== $V
+      - pattern: $U.user_metadata.$F != $V
+      - pattern: '$C ? <... $U.user_metadata ...> : $E'
+    metadata:
+      sec_ids: [SEC-DB-006, SEC-AUTHZ-005]
+      severity_hint: CRITICAL
+      confidence: MEDIUM

package/rules/semgrep/verify-result-unused.yaml

@@ -0,0 +1,62 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/verify-result-unused.yaml).
+#
+rules:
+  - id: hullproof-verify-result-unused
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      The result of a signature or token check is computed and then not used to reject the request. The check runs and the
+      handler goes on regardless, so a forged request is accepted. Test the result and return an error, or throw, when it is false.
+    patterns:
+      - pattern-either:
+          - patterns:
+              - pattern-either:
+                  - pattern: const $OK = $V(...);
+                  - pattern: const $OK = await $V(...);
+                  - pattern: const $OK = $O.$V(...);
+                  - pattern: const $OK = await $O.$V(...);
+                  - pattern: let $OK = $V(...);
+                  - pattern: let $OK = $O.$V(...);
+              - pattern-not-inside: |
+                  {
+                    ...
+                    const $OK = ...;
+                    ...
+                    <... $OK ...>
+                  }
+              - pattern-not-inside: |
+                  {
+                    ...
+                    let $OK = ...;
+                    ...
+                    <... $OK ...>
+                  }
+          - patterns:
+              - pattern-either:
+                  - pattern: $V(...);
+                  - pattern: await $V(...);
+                  - pattern: $O.$V(...);
+                  - pattern: await $O.$V(...);
+              - pattern-not-inside: const $X = ...;
+              - pattern-not-inside: let $X = ...;
+              - pattern-not-inside: $X = ...;
+              - pattern-not-inside: return ...;
+              - pattern-not-inside: if (...) ...
+              - pattern-not-inside: throw ...;
+              - pattern-not-inside: $A && $B
+              - pattern-not-inside: $A || $B
+              - pattern-not-inside: '!$A'
+              - pattern-not-inside: '$A ? $B : $C'
+      - metavariable-regex:
+          metavariable: $V
+          regex: ^(verifySignature|verifyHmac|verifyWebhookSignature|isValidSignature|isSignatureValid|validateSignature|checkSignature|compareSignatures|timingSafeEqual|safeCompare|verifyTokenSignature)$
+    metadata:
+      sec_ids: [SEC-API-101, SEC-AUTH-002]
+      severity_hint: CRITICAL
+      confidence: MEDIUM
+      note: >-
+        Finds a boolean returning check whose result is thrown away, or stored in a variable that nothing reads afterwards. The
+        function names are a convention guess, extend the list with the project's own verify helpers. A check that throws on
+        failure, such as a library constructEvent call, is not in the list.

package/rules/semgrep/webhook-parse-before-verify.yaml

@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Rare Phronesis Limited
+# Copied from the Hullproof kit (kit/tools/hullproof/rules/webhook-parse-before-verify.yaml).
+#
+rules:
+  - id: hullproof-webhook-parse-before-verify
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: >-
+      The request body is parsed as JSON before the webhook signature is verified. Read the raw
+      text first, verify the signature over those exact bytes, then parse.
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $B = await $REQ.json();
+              ...
+              $OBJ.$M(...);
+          - pattern: |
+              $B = await $REQ.formData();
+              ...
+              $OBJ.$M(...);
+      - metavariable-regex:
+          metavariable: $M
+          regex: ^(constructEvent|constructEventAsync|verify|verifySignature|verifyWebhook|verifyWebhookSignature|validateEvent|unwrap|isValidSignature)$
+    metadata:
+      sec_ids: [SEC-API-101]
+      severity_hint: HIGH
+      confidence: MEDIUM
+      note: Heuristic. Matches a JSON body read followed by a verify style call in the same block.

package/rules/test-artifact-ids.json

@@ -0,0 +1,4 @@
+{
+  "about": "Requirements whose subject is test material that ships in the product. A scanner hit in a test path still fails these.",
+  "sec_ids": []
+}