@aegisq-codeshield/security-rules

Security rule definitions for AegisQ-CodeShield — the AI security scanner for coding tools.

80+ regex-based security rules covering OWASP Top 10, OWASP LLM Top 10, CISA Secure by Design, and CWE mappings.

Installation

npm install @aegisq-codeshield/security-rules

Most users should install aegisq-codeshield-mcp or @aegisq-codeshield/core instead — this package is the standalone rule set.

Rule Categories

| Category | Rules | Covers | |----------|-------|--------| | Injection | SQL injection, command injection, XSS, path traversal, LDAP injection | OWASP A03, CWE-78/79/89 | | Authentication | Hardcoded credentials, weak passwords, missing auth checks | OWASP A07, CWE-798 | | Cryptography | Weak algorithms (MD5, SHA1, DES), hardcoded keys, insecure random | OWASP A02, CWE-327/330 | | LLM Security | Prompt injection, unsafe model output handling, training data poisoning | OWASP LLM Top 10 | | CISA Secure by Design | Memory safety, default credentials, known exploited vulnerabilities | CISA KEV catalog | | OWASP Extended | Broken access control, SSRF, security misconfiguration, logging failures | OWASP A01-A10 |

Usage

import { ALL_RULES, INJECTION_RULES, SEVERITY_ORDER } from '@aegisq-codeshield/security-rules';
import type { SecurityRule, Severity } from '@aegisq-codeshield/security-rules';

// All 80+ rules
console.log(ALL_RULES.length);

// Filter by category
const highSeverity = ALL_RULES.filter(r => r.severity === 'critical' || r.severity === 'high');

Rule Structure

Each SecurityRule includes:

| Field | Type | Description | |-------|------|-------------| | id | string | Unique rule ID (e.g., INJ-001) | | pattern | RegExp | Detection regex | | severity | Severity | critical, high, medium, or low | | category | string | Rule category | | message | string | Human-readable finding message | | languages | string[] | Applicable languages (empty = all) | | owaspCategory | string | OWASP Top 10 mapping | | cisaCategory | string | CISA Secure by Design mapping | | cweId | string | CWE identifier | | remediation | string | Fix guidance | | references | string[] | External reference URLs |

License

MIT