Add security audit knowledge entries
ober
b0c1ad1de40fa29503725d713ae471141849aab7
--- a/data/features.sexp +++ b/data/features.sexp @@ -887,4 +887,22 @@ ("use_case" . "Validating large Jerboa Scheme tools such as jerbuild.ss after edits.") + ("votes" . 0)) + (("description" + . + "Add a Jerboa MCP tool that accepts multiple project roots or glob patterns, skips common generated/vendor/artifact directories, runs security_scan/import/resource/FFI checks per repo, and emits a grouped markdown handoff with findings, false-positive notes, and success criteria.") + ("estimated_token_reduction" + . + "~3000-6000 tokens per large workspace audit") + ("example_scenario" + . + "Audit /Users/user/mine/chez* and /Users/user/mine/jerboa* while excluding target, vendor, .venv, model artifacts, generated parser output, and bare git backup repos, then generate a fix plan for another agent.") + ("id" . "cross-repo-security-review") ("impact" . "high") + ("tags" "security" "multi-repo" "audit" "report") + ("title" + . + "Cross-repo security review with generated/vendor exclusions") + ("use_case" + . + "Reviewing a workspace containing many related Jerboa and Chez repositories without manually running inventory, rg exclusions, and per-repo MCP scans.") ("votes" . 0))) --- a/data/security-rules.sexp +++ b/data/security-rules.sexp @@ -884,4 +884,13 @@ . "(audit-emit|policy-emit|log-event)[^)]*env-tag") ("scope" . "scheme") + ("severity" . "high")) + (("id" . "empty-secret-auth-bypass") + ("message" + . + "Authentication or signature verification compares a secret value to the empty string. Do not bypass verification just because a secret is empty; fail closed unless an explicit development-only flag disables verification.") + ("pattern" + . + "\\(string=\\?\\s+[^\\)]*secret[^\\)]*\\s+\"\"\\)") + ("scope" . "scheme") ("severity" . "high")))