GistPin/infrastructure/security/sast-config.yml at main · ghzhost/GistPin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
# Semgrep SAST configuration for GistPin
# https://semgrep.dev/docs/semgrep-app/getting-started/

rules:
  - id: no-hardcoded-secrets
    patterns:
      - pattern: |
          $KEY = "..."
    message: "Potential hardcoded secret in $KEY"
    languages: [typescript, javascript]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-798"

  - id: no-eval
    pattern: eval(...)
    message: "Use of eval() is unsafe"
    languages: [typescript, javascript]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-95"

  - id: sql-injection-typeorm
    patterns:
      - pattern: |
          $REPO.query("..." + $INPUT, ...)
    message: "Possible SQL injection via string concatenation"
    languages: [typescript]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-89"

  - id: unsafe-regex
    patterns:
      - pattern: new RegExp($VAR)
    message: "Dynamic RegExp may lead to ReDoS"
    languages: [typescript, javascript]
    severity: WARNING
    metadata:
      category: security
      cwe: "CWE-1333"

# Rulesets to include from Semgrep registry
configs:
  - p/typescript
  - p/nodejs
  - p/secrets
  - p/owasp-top-ten

# Paths to exclude from scanning
exclude:
  - node_modules/
  - "**/*.min.js"
  - "**/*.d.ts"
  - dist/
  - build/
  - coverage/

# Severity threshold — fail on ERROR findings
severity: ERROR