git-security-tool 0.1.0__tar.gz → 0.1.1__tar.gz

{git_security_tool-0.1.0 → git_security_tool-0.1.1}/.github/workflows/scan.reusable.yml

@@ -4,18 +4,19 @@ name: git-security-tool scan
 #
 #   jobs:
 #     security:
-#       uses: MustafaBasit521/commit-guard/.github/workflows/scan.reusable.yml@main
+#       uses: MustafaBasit521/commit-guard/.github/workflows/scan.reusable.yml@v0.1.0
 #
-# Pin @v0.1.0 (or a commit SHA) instead of @main once the tool is tagged, so a
-# change to the tool can't unexpectedly break a downstream project's CI.
+# Pin the caller to a tag (@v0.1.0), not @main, so a change to this workflow
+# can't unexpectedly break a downstream project's CI. Bump `version` here when
+# a new git-security-tool release is out.
 
 on:
   workflow_call:
     inputs:
-      ref:
-        description: "git-security-tool version, branch, or SHA to install"
+      version:
+        description: "git-security-tool version to install from PyPI"
         type: string
-        default: main
+        default: "0.1.0"
       python-version:
         type: string
         default: "3.12"
@@ -31,9 +32,7 @@ jobs:
           python-version: ${{ inputs.python-version }}
 
       - name: Install git-security-tool
-        run: >
-          pip install "git-security-tool[scanners] @
-          git+https://github.com/MustafaBasit521/commit-guard.git@${{ inputs.ref }}"
+        run: pip install "git-security-tool[scanners]==${{ inputs.version }}"
 
       - name: Install gitleaks
         run: |

{git_security_tool-0.1.0 → git_security_tool-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: git-security-tool
-Version: 0.1.0
+Version: 0.1.1
 Summary: Local Git security and code-quality gate that runs on pre-commit.
 Project-URL: Homepage, https://github.com/MustafaBasit521/commit-guard
 Project-URL: Issues, https://github.com/MustafaBasit521/commit-guard/issues
@@ -30,25 +30,46 @@ Description-Content-Type: text/markdown
 # git-security-tool
 
 [![CI](https://github.com/MustafaBasit521/commit-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/MustafaBasit521/commit-guard/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/git-security-tool)](https://pypi.org/project/git-security-tool/)
+[![Python](https://img.shields.io/pypi/pyversions/git-security-tool)](https://pypi.org/project/git-security-tool/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 
-A local Git **pre-commit gate** for Linux. It scans your *staged* changes and
-blocks the commit when it finds something serious — secrets, dangerous code
-patterns — while surfacing quality and formatting issues as warnings.
+**Stop secrets and dangerous code from reaching a commit.** A local Git
+pre-commit gate (Linux) that scans your *staged* changes and blocks the
+commit when it finds something serious — leaked credentials, `eval()`,
+`pickle.loads`, disabled TLS verification — while surfacing lint and
+formatting issues as non-blocking warnings. The same engine runs in CI over
+the whole repository.
 
 It is an **orchestration layer**, not a new scanner: it runs
 [Gitleaks](https://github.com/gitleaks/gitleaks),
 [Semgrep](https://semgrep.dev/), and [Ruff](https://docs.astral.sh/ruff/),
-normalizes their output, applies your policy, and decides pass/block.
+normalizes their output into one model, applies your policy, and decides
+pass / block.
 
 ```
 git commit
    └─► .git/hooks/pre-commit
         └─► git-security-tool scan
-             ├─ gitleaks   → secrets            (CRITICAL → blocks)
-             ├─ semgrep    → security patterns  (HIGH → blocks)
-             ├─ ruff check → lint               (LOW → warns)
-             └─ ruff format --check → format    (LOW → warns)
-                  └─► PASS (exit 0) / BLOCK (exit 1)
+             ├─ gitleaks            → secrets            (CRITICAL → blocks)
+             ├─ semgrep + 17 rules  → insecure code      (HIGH → blocks)
+             ├─ ruff check          → lint               (LOW → warns)
+             └─ ruff format --check → formatting         (LOW → warns)
+                  └─► policy → exit 0 (allow) | exit 1 (block)
+```
+
+### What a blocked commit looks like
+
+```
+$ git commit -m "add config loader"
+[git-security-tool] pre-commit security scan
+[git-security-tool] 2 file(s) to scan
+[git-security-tool] 1 blocking finding(s):
+  [HIGH] semgrep:python-yaml-unsafe-load config.py:14 - yaml.load() without a
+  safe loader can construct arbitrary Python objects from the input.
+[git-security-tool] summary: 1 blocking, 0 warning(s)
+[git-security-tool] commit blocked - fix the blocking findings above, or set
+GIT_SECURITY_NO_BLOCK=1 to override
 ```
 
 ## Install
@@ -59,14 +80,8 @@ cd your-repo
 git-security-tool install                     # writes .git/hooks/pre-commit
 ```
 
-Latest unreleased version, straight from the repo:
-
-```bash
-pip install "git-security-tool[scanners] @ git+https://github.com/MustafaBasit521/commit-guard.git"
-```
-
-Gitleaks is a Go binary — install it separately if you want secret detection
-(the scan skips any tool that isn't on `PATH`).
+Gitleaks is a Go binary — [install it](https://github.com/gitleaks/gitleaks#installing)
+separately for secret detection (the scan skips any tool that isn't on `PATH`).
 
 Commands: `scan [--all] [--format sarif]`, `baseline`, `install [--force]`,
 `uninstall`, `check`, `version`.
@@ -75,23 +90,26 @@ Commands: `scan [--all] [--format sarif]`, `baseline`, `install [--force]`,
 - `scan --all` — every tracked file (CI / audit); `--format sarif` emits SARIF
   on stdout for GitHub code scanning
 - `baseline` — records current findings to `.git-security-tool-baseline.json`
-  so a repo can adopt the tool without fixing everything first; new issues
-  still block
+  so an existing repo can adopt the tool without fixing everything first;
+  new issues still block
+
+Verify the ruleset end to end: `./scripts/probe.sh` (checks all 17 rules +
+secret detection in a throwaway repo).
 
 ## What it checks
 
 | category | tool | severity | blocks by default |
 |---|---|---|---|
-| Secrets / credentials | Gitleaks (staged diff) | CRITICAL | yes |
-| Insecure code patterns (17 rules) | Semgrep + bundled rules | HIGH / MEDIUM | HIGH yes |
+| Secrets / credentials | Gitleaks | CRITICAL | yes |
+| Insecure code patterns (17 rules) | Semgrep + bundled rules | HIGH / MEDIUM | HIGH only |
 | Lint (unused imports, undefined names, …) | `ruff check` | LOW | no |
 | Formatting | `ruff format --check` | LOW | no |
 
-The bundled Semgrep rules (`src/git_security/rules/semgrep/`) cover code/command
-injection (`eval`, `exec`, `os.system`, `shell=True`), unsafe deserialization
-(`pickle`, `yaml.load`, insecure XML), weak crypto & disabled TLS verification,
-web footguns (Flask `debug=True`, Jinja autoescape off, `mark_safe`), and
-filesystem/network hygiene (`extractall`, `mktemp`, `requests` without timeout).
+The bundled Semgrep rules cover code/command injection (`eval`, `exec`,
+`os.system`, `shell=True`), unsafe deserialization (`pickle`, `yaml.load`,
+insecure XML), weak crypto & disabled TLS verification, web footguns (Flask
+`debug=True`, Jinja autoescape off, `mark_safe`), and filesystem/network
+hygiene (`extractall`, `mktemp`, `requests` without timeout).
 
 Semgrep/Ruff analysis is **Python only**; Gitleaks is language-agnostic.
 Scanners see the exact **staged** content, not your working tree.
@@ -122,7 +140,22 @@ to the API, and secret-bearing files are never sent.
 | provider | key env var | extra install |
 |---|---|---|
 | `gemini` | `GEMINI_API_KEY` | none (stdlib HTTP) |
-| `anthropic` | `ANTHROPIC_API_KEY` | `pip install ".[ai]"` |
+| `anthropic` | `ANTHROPIC_API_KEY` | `pip install "git-security-tool[ai]"` |
+
+## CI (the second layer)
+
+Local hooks can be skipped (`--no-verify`) or simply not installed on a
+teammate's machine, so CI is the enforcement layer. This repo ships a
+reusable workflow:
+
+```yaml
+# .github/workflows/security.yml in your project
+name: security
+on: [push, pull_request]
+jobs:
+  security:
+    uses: MustafaBasit521/commit-guard/.github/workflows/scan.reusable.yml@main
+```
 
 ## Overrides
 
@@ -133,10 +166,13 @@ to the API, and secret-bearing files are never sent.
 
 ```bash
 pip install -e ".[scanners,dev]"
-pytest
+pytest                                              # 96 tests
 ruff check src tests && ruff format --check src tests
 ```
 
+See [ARCHITECTURE.md](ARCHITECTURE.md) for the design and a milestone-by-milestone
+build log.
+
 ## Scope / non-goals
 
 No dependency-CVE scanning, no license checks, no SBOM, no IaC/container

git_security_tool-0.1.1/README.md

@@ -0,0 +1,156 @@
+# git-security-tool
+
+[![CI](https://github.com/MustafaBasit521/commit-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/MustafaBasit521/commit-guard/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/git-security-tool)](https://pypi.org/project/git-security-tool/)
+[![Python](https://img.shields.io/pypi/pyversions/git-security-tool)](https://pypi.org/project/git-security-tool/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+**Stop secrets and dangerous code from reaching a commit.** A local Git
+pre-commit gate (Linux) that scans your *staged* changes and blocks the
+commit when it finds something serious — leaked credentials, `eval()`,
+`pickle.loads`, disabled TLS verification — while surfacing lint and
+formatting issues as non-blocking warnings. The same engine runs in CI over
+the whole repository.
+
+It is an **orchestration layer**, not a new scanner: it runs
+[Gitleaks](https://github.com/gitleaks/gitleaks),
+[Semgrep](https://semgrep.dev/), and [Ruff](https://docs.astral.sh/ruff/),
+normalizes their output into one model, applies your policy, and decides
+pass / block.
+
+```
+git commit
+   └─► .git/hooks/pre-commit
+        └─► git-security-tool scan
+             ├─ gitleaks            → secrets            (CRITICAL → blocks)
+             ├─ semgrep + 17 rules  → insecure code      (HIGH → blocks)
+             ├─ ruff check          → lint               (LOW → warns)
+             └─ ruff format --check → formatting         (LOW → warns)
+                  └─► policy → exit 0 (allow) | exit 1 (block)
+```
+
+### What a blocked commit looks like
+
+```
+$ git commit -m "add config loader"
+[git-security-tool] pre-commit security scan
+[git-security-tool] 2 file(s) to scan
+[git-security-tool] 1 blocking finding(s):
+  [HIGH] semgrep:python-yaml-unsafe-load config.py:14 - yaml.load() without a
+  safe loader can construct arbitrary Python objects from the input.
+[git-security-tool] summary: 1 blocking, 0 warning(s)
+[git-security-tool] commit blocked - fix the blocking findings above, or set
+GIT_SECURITY_NO_BLOCK=1 to override
+```
+
+## Install
+
+```bash
+pip install "git-security-tool[scanners]"     # tool + ruff + semgrep
+cd your-repo
+git-security-tool install                     # writes .git/hooks/pre-commit
+```
+
+Gitleaks is a Go binary — [install it](https://github.com/gitleaks/gitleaks#installing)
+separately for secret detection (the scan skips any tool that isn't on `PATH`).
+
+Commands: `scan [--all] [--format sarif]`, `baseline`, `install [--force]`,
+`uninstall`, `check`, `version`.
+
+- `scan` — staged changes (pre-commit)
+- `scan --all` — every tracked file (CI / audit); `--format sarif` emits SARIF
+  on stdout for GitHub code scanning
+- `baseline` — records current findings to `.git-security-tool-baseline.json`
+  so an existing repo can adopt the tool without fixing everything first;
+  new issues still block
+
+Verify the ruleset end to end: `./scripts/probe.sh` (checks all 17 rules +
+secret detection in a throwaway repo).
+
+## What it checks
+
+| category | tool | severity | blocks by default |
+|---|---|---|---|
+| Secrets / credentials | Gitleaks | CRITICAL | yes |
+| Insecure code patterns (17 rules) | Semgrep + bundled rules | HIGH / MEDIUM | HIGH only |
+| Lint (unused imports, undefined names, …) | `ruff check` | LOW | no |
+| Formatting | `ruff format --check` | LOW | no |
+
+The bundled Semgrep rules cover code/command injection (`eval`, `exec`,
+`os.system`, `shell=True`), unsafe deserialization (`pickle`, `yaml.load`,
+insecure XML), weak crypto & disabled TLS verification, web footguns (Flask
+`debug=True`, Jinja autoescape off, `mark_safe`), and filesystem/network
+hygiene (`extractall`, `mktemp`, `requests` without timeout).
+
+Semgrep/Ruff analysis is **Python only**; Gitleaks is language-agnostic.
+Scanners see the exact **staged** content, not your working tree.
+
+## Configuration — `.git-security-tool.toml` (optional, repo root)
+
+```toml
+[policy]
+block_threshold = "HIGH"          # INFO | LOW | MEDIUM | HIGH | CRITICAL
+
+[scanners]
+gitleaks = false                  # disable a scanner
+
+[ignore]
+paths = ["tests/fixtures/", "*.generated.py"]
+
+[ai]
+enabled = false                   # optional LLM remediation suggestions
+provider = "gemini"               # "anthropic" | "gemini"
+model = ""                        # blank = provider default
+max_findings = 3
+```
+
+**AI suggestions** are off by default and advisory only — they never affect
+the pass/block decision or modify files, they announce before sending code
+to the API, and secret-bearing files are never sent.
+
+| provider | key env var | extra install |
+|---|---|---|
+| `gemini` | `GEMINI_API_KEY` | none (stdlib HTTP) |
+| `anthropic` | `ANTHROPIC_API_KEY` | `pip install "git-security-tool[ai]"` |
+
+## CI (the second layer)
+
+Local hooks can be skipped (`--no-verify`) or simply not installed on a
+teammate's machine, so CI is the enforcement layer. This repo ships a
+reusable workflow:
+
+```yaml
+# .github/workflows/security.yml in your project
+name: security
+on: [push, pull_request]
+jobs:
+  security:
+    uses: MustafaBasit521/commit-guard/.github/workflows/scan.reusable.yml@main
+```
+
+## Overrides
+
+- `GIT_SECURITY_NO_BLOCK=1 git commit …` — run the scan, report, never block.
+- `git commit --no-verify` — skip the hook entirely (Git built-in).
+
+## Development
+
+```bash
+pip install -e ".[scanners,dev]"
+pytest                                              # 96 tests
+ruff check src tests && ruff format --check src tests
+```
+
+See [ARCHITECTURE.md](ARCHITECTURE.md) for the design and a milestone-by-milestone
+build log.
+
+## Scope / non-goals
+
+No dependency-CVE scanning, no license checks, no SBOM, no IaC/container
+scanning, no non-Python static analysis. The bundled Semgrep ruleset is
+curated and intentionally small — not a replacement for a full SAST platform
+or the Semgrep registry.
+
+## License
+
+MIT — see [LICENSE](LICENSE).

git_security_tool-0.1.1/scripts/probe.sh

@@ -0,0 +1,113 @@
+#!/bin/sh
+# Verify every bundled Semgrep rule fires, plus secret detection. Creates a
+# throwaway git repo, drops one probe file per rule category and a fake
+# secret, runs `git-security-tool scan --all`, then reports which of the 17
+# rules were seen. Touches nothing in your real repositories.
+#
+#   ./scripts/probe.sh
+set -eu
+
+probe=$(mktemp -d)
+trap 'rm -rf "$probe"' EXIT
+cd "$probe"
+git init -q
+git config user.email probe@example.com
+git config user.name probe
+
+# match the real project's lint config so the output isn't full of ruff noise
+cat > pyproject.toml <<'EOF'
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F", "I"]
+EOF
+
+cat > injection.py <<'EOF'
+import os
+import subprocess
+eval(user_input)                       # python-dangerous-eval
+exec(user_input)                       # python-dangerous-exec
+os.system(cmd)                         # python-os-system
+os.popen(cmd)                          # python-os-popen
+subprocess.run(cmd, shell=True, check=True)   # python-subprocess-shell-true
+EOF
+
+cat > deserialization.py <<'EOF'
+import pickle
+import xml.etree.ElementTree as ET
+
+import yaml
+pickle.loads(blob)                     # python-pickle-load
+yaml.load(text)                        # python-yaml-unsafe-load
+ET.fromstring(untrusted_xml)           # python-insecure-xml-parser
+EOF
+
+cat > crypto_tls.py <<'EOF'
+import hashlib
+import ssl
+
+import requests
+hashlib.md5(b"x")                      # python-weak-hash
+requests.get(u, verify=False, timeout=5)   # python-tls-verification-disabled
+ssl._create_unverified_context()       # python-ssl-unverified-context
+EOF
+
+cat > web.py <<'EOF'
+import jinja2
+from django.utils.safestring import mark_safe
+app.run(debug=True)                    # python-flask-debug-true
+jinja2.Environment()                   # python-jinja-autoescape-disabled
+mark_safe(user_input)                  # python-django-mark-safe
+EOF
+
+cat > filesystem_net.py <<'EOF'
+import tempfile
+
+import requests
+archive.extractall(dest)               # python-archive-extractall
+tempfile.mktemp()                      # python-tempfile-mktemp
+requests.get(url)                      # python-requests-no-timeout
+EOF
+
+# Fake GitHub token - not a real credential; never leaves this temp repo.
+# The gitleaks:allow marker keeps *this* script committable; the secrets.txt
+# it writes has no such marker and is what the probe expects gitleaks to flag.
+tok='ghp_016C7f4a9BdEfGhIjKlMnOpQrStUvWx0y1Z2a'  # gitleaks:allow
+printf 'API_TOKEN=%s\n' "$tok" > secrets.txt
+
+git add -A
+out=$(git-security-tool scan --all 2>&1 || true)
+printf '%s\n' "$out"
+
+echo
+echo "=================================================================="
+rules="python-dangerous-eval python-dangerous-exec python-os-system \
+python-os-popen python-subprocess-shell-true python-pickle-load \
+python-yaml-unsafe-load python-insecure-xml-parser python-weak-hash \
+python-tls-verification-disabled python-ssl-unverified-context \
+python-flask-debug-true python-jinja-autoescape-disabled \
+python-django-mark-safe python-archive-extractall python-tempfile-mktemp \
+python-requests-no-timeout"
+
+missing=0
+for r in $rules; do
+    if printf '%s' "$out" | grep -q "semgrep:$r"; then
+        echo "  ok   $r"
+    else
+        echo "  MISS $r"
+        missing=$((missing + 1))
+    fi
+done
+
+if printf '%s' "$out" | grep -q "gitleaks:"; then
+    echo "  ok   gitleaks secret detection"
+else
+    echo "  MISS gitleaks secret detection"
+    missing=$((missing + 1))
+fi
+
+echo "=================================================================="
+if [ "$missing" -eq 0 ]; then
+    echo "All 17 rules + secret detection fired."
+else
+    echo "$missing check(s) missing - a rule regressed."
+    exit 1
+fi

{git_security_tool-0.1.0 → git_security_tool-0.1.1}/src/git_security/__init__.py

@@ -1,3 +1,3 @@
 """git-security-tool: a local Git security and code-quality gate."""
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"

{git_security_tool-0.1.0 → git_security_tool-0.1.1}/src/git_security/suggestions/providers.py

@@ -18,7 +18,8 @@ import os
 import urllib.error
 import urllib.request
 
-_TIMEOUT = 30
+# Newer models spend time reasoning before answering; give them room.
+_TIMEOUT = 60
 _MAX_OUTPUT_TOKENS = 2048
 
 
@@ -54,7 +55,7 @@ class AnthropicProvider:
 
 class GeminiProvider:
     name = "gemini"
-    default_model = "gemini-2.5-flash"
+    default_model = "gemini-3.6-flash"  # override via [ai] model = "..."
     env_var = "GEMINI_API_KEY"
     _URL = (
         "https://generativelanguage.googleapis.com/v1beta/models/"

{git_security_tool-0.1.0 → git_security_tool-0.1.1}/tests/test_providers.py

@@ -52,7 +52,7 @@ def test_gemini_complete_returns_text(monkeypatch):
             ]
         },
     )
-    out = GeminiProvider().complete("sys", "user", "gemini-2.5-flash")
+    out = GeminiProvider().complete("sys", "user", "gemini-3.6-flash")
     assert out == "use parameterized queries"
 
 
@@ -60,7 +60,7 @@ def test_gemini_complete_raises_when_blocked(monkeypatch):
     monkeypatch.setenv("GEMINI_API_KEY", "k")
     _patch_urlopen(monkeypatch, {"promptFeedback": {"blockReason": "SAFETY"}})
     with pytest.raises(RuntimeError, match="SAFETY"):
-        GeminiProvider().complete("sys", "user", "gemini-2.5-flash")
+        GeminiProvider().complete("sys", "user", "gemini-3.6-flash")
 
 
 def test_gemini_complete_wraps_http_error(monkeypatch):
@@ -73,4 +73,4 @@ def test_gemini_complete_wraps_http_error(monkeypatch):
 
     monkeypatch.setattr("urllib.request.urlopen", _raise)
     with pytest.raises(RuntimeError, match="Gemini API error 400"):
-        GeminiProvider().complete("sys", "user", "gemini-2.5-flash")
+        GeminiProvider().complete("sys", "user", "gemini-3.6-flash")

git_security_tool-0.1.0/README.md

@@ -1,120 +0,0 @@
-# git-security-tool
-
-[![CI](https://github.com/MustafaBasit521/commit-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/MustafaBasit521/commit-guard/actions/workflows/ci.yml)
-
-A local Git **pre-commit gate** for Linux. It scans your *staged* changes and
-blocks the commit when it finds something serious — secrets, dangerous code
-patterns — while surfacing quality and formatting issues as warnings.
-
-It is an **orchestration layer**, not a new scanner: it runs
-[Gitleaks](https://github.com/gitleaks/gitleaks),
-[Semgrep](https://semgrep.dev/), and [Ruff](https://docs.astral.sh/ruff/),
-normalizes their output, applies your policy, and decides pass/block.
-
-```
-git commit
-   └─► .git/hooks/pre-commit
-        └─► git-security-tool scan
-             ├─ gitleaks   → secrets            (CRITICAL → blocks)
-             ├─ semgrep    → security patterns  (HIGH → blocks)
-             ├─ ruff check → lint               (LOW → warns)
-             └─ ruff format --check → format    (LOW → warns)
-                  └─► PASS (exit 0) / BLOCK (exit 1)
-```
-
-## Install
-
-```bash
-pip install "git-security-tool[scanners]"     # tool + ruff + semgrep
-cd your-repo
-git-security-tool install                     # writes .git/hooks/pre-commit
-```
-
-Latest unreleased version, straight from the repo:
-
-```bash
-pip install "git-security-tool[scanners] @ git+https://github.com/MustafaBasit521/commit-guard.git"
-```
-
-Gitleaks is a Go binary — install it separately if you want secret detection
-(the scan skips any tool that isn't on `PATH`).
-
-Commands: `scan [--all] [--format sarif]`, `baseline`, `install [--force]`,
-`uninstall`, `check`, `version`.
-
-- `scan` — staged changes (pre-commit)
-- `scan --all` — every tracked file (CI / audit); `--format sarif` emits SARIF
-  on stdout for GitHub code scanning
-- `baseline` — records current findings to `.git-security-tool-baseline.json`
-  so a repo can adopt the tool without fixing everything first; new issues
-  still block
-
-## What it checks
-
-| category | tool | severity | blocks by default |
-|---|---|---|---|
-| Secrets / credentials | Gitleaks (staged diff) | CRITICAL | yes |
-| Insecure code patterns (17 rules) | Semgrep + bundled rules | HIGH / MEDIUM | HIGH yes |
-| Lint (unused imports, undefined names, …) | `ruff check` | LOW | no |
-| Formatting | `ruff format --check` | LOW | no |
-
-The bundled Semgrep rules (`src/git_security/rules/semgrep/`) cover code/command
-injection (`eval`, `exec`, `os.system`, `shell=True`), unsafe deserialization
-(`pickle`, `yaml.load`, insecure XML), weak crypto & disabled TLS verification,
-web footguns (Flask `debug=True`, Jinja autoescape off, `mark_safe`), and
-filesystem/network hygiene (`extractall`, `mktemp`, `requests` without timeout).
-
-Semgrep/Ruff analysis is **Python only**; Gitleaks is language-agnostic.
-Scanners see the exact **staged** content, not your working tree.
-
-## Configuration — `.git-security-tool.toml` (optional, repo root)
-
-```toml
-[policy]
-block_threshold = "HIGH"          # INFO | LOW | MEDIUM | HIGH | CRITICAL
-
-[scanners]
-gitleaks = false                  # disable a scanner
-
-[ignore]
-paths = ["tests/fixtures/", "*.generated.py"]
-
-[ai]
-enabled = false                   # optional LLM remediation suggestions
-provider = "gemini"               # "anthropic" | "gemini"
-model = ""                        # blank = provider default
-max_findings = 3
-```
-
-**AI suggestions** are off by default and advisory only — they never affect
-the pass/block decision or modify files, they announce before sending code
-to the API, and secret-bearing files are never sent.
-
-| provider | key env var | extra install |
-|---|---|---|
-| `gemini` | `GEMINI_API_KEY` | none (stdlib HTTP) |
-| `anthropic` | `ANTHROPIC_API_KEY` | `pip install ".[ai]"` |
-
-## Overrides
-
-- `GIT_SECURITY_NO_BLOCK=1 git commit …` — run the scan, report, never block.
-- `git commit --no-verify` — skip the hook entirely (Git built-in).
-
-## Development
-
-```bash
-pip install -e ".[scanners,dev]"
-pytest
-ruff check src tests && ruff format --check src tests
-```
-
-## Scope / non-goals
-
-No dependency-CVE scanning, no license checks, no SBOM, no IaC/container
-scanning, no non-Python static analysis. The bundled Semgrep ruleset is
-curated and intentionally small — not a replacement for a full SAST platform
-or the Semgrep registry.
-
-## License
-
-MIT — see [LICENSE](LICENSE).