All pull requests

Pull requests

• feat(python.jinja2): taint-mode SSTI rule for Template and from_string

  #4123·brahimeelhamed opened Oct 26, 2026·

  ·
  1

• fix(javascript): detect namespaced vm2 constructors in Express rule

  #4122·aymanbouanouj opened Oct 26, 2026·

  ·
  1

  1

• fix(java): flag non-literal Runtime.exec args anywhere after -c

  #4121·protonnegativo opened Oct 24, 2026·

  ·
  1

  2

• Add Bash reverse shell detection

  #4120·emjin opened Oct 24, 2026Contributor·3 tasks done·

  ·

• Anchor PHP exec-use sink regex to exact function names.

  #4119·comptonjack opened Oct 23, 2026·

  ·
  1

  1

• Merge Develop into Release

  #4116·r2c-argo[bot] opened Oct 22, 2026Bot·

  ·
  1

• Add PHP session.upload_progress rules for CVE-2026-109619

  #4113·pid1 opened Oct 21, 2026Contributor·

  ·

• Add httpx and missing request sinks to mcp-ssrf-python rule

  #4112·Varshith-Kali opened Oct 21, 2026·

  ·
  1

  44

• Accept doctype feature set in constructor for DocumentBuilderFactory rule

  #4111·raju4199 opened Oct 20, 2026·

  ·
  1

• Fix anonymous-ldap-bind missing env set up in a helper

  #4110·raju4199 opened Oct 20, 2026·

  ·
  1

  1

• feat(mcp): add audit rule for dynamic shell commands

  #4109·hexisteme opened Oct 20, 2026·4 tasks done·

  ·

• Fix(OCaml): Update messages to use code formatting for clarity

  #4107·zbraiterman opened Oct 20, 2026·

  ·

• fix(mcp): catch promisified exec and FastMCP addTool in mcp-command-injection-typescript

  #4104·hexisteme opened Oct 20, 2026·2 tasks done·

  ·
  1

• fix: skip GitHub Actions curl rules on steps without a download

  #4103·Portll opened Oct 20, 2026·

  ·
  1

  3

• fix(ai): stop treating str.strip() as a sanitizer in mcp-unsanitized-return rule

  #4102·Varshith-Kali opened Oct 19, 2026·

  ·
  1

  2

• feat(python, javascript): flag redaction applied to each stream chunk with no carry-over

  #4100·ninadphalak opened Oct 17, 2026·3 tasks done·

  ·
  1

• fix(ai): stop treating bare os.path.realpath()/abspath() as complete path sanitizers in python hook rule

  #4099·Varshith-Kali opened Oct 17, 2026·

  ·
  1

  1

• Retire the duplicate browser innerHTML rule

  #4097·jdotc1 opened Oct 16, 2026·

  ·

• Recognize separate S3 bucket versioning resources

  #4096·jdotc1 opened Oct 16, 2026·

  ·
  1

• feat(rules): add Nigerian fintech secret detectors

  #4095·LloydCoder opened Oct 16, 2026·

  ·

• fix(ai): stop treating urllib.parse.urlparse() as an SSRF sanitizer in mcp-ssrf rule

  #4094·Varshith-Kali opened Oct 16, 2026·

  ·
  1

  5

• fix(ai): stop treating bare realpath/readlink -f as complete path sanitizers in bash hook rule

  #4092·Varshith-Kali opened Oct 16, 2026·

  ·
  1

  1

• fix(python): cover list-form shell/interpreter commands in dangerous-subprocess-use

  #4089·Varshith-Kali opened Oct 15, 2026·

  ·
  1

  1

• Spring Actuator YAML rules: match dotted keys and scalar endpoint lists

  #4088·rgiovann opened Oct 15, 2026·

  ·
  1

• Correct the S3 versioning rule’s reversed remediation message

  #4087·jdotc1 opened Oct 15, 2026·

  ·