All pull requests

Pull requests

• Add missing sinks to mcp-ssrf-python and mcp-command-injection-python

  #4142·Varshith-Kali opened Nov 11, 2026·

  ·
  1

• Add 7 rules for gaps found in AI code review findings

  #4140·liukatkat opened Nov 10, 2026Contributor·

  ·
  5

• chore(codeowners): populate empty CODEOWNERS (SECENG-330)

  #4139·Cr0n1c opened Nov 10, 2026·

  ·

• fix(python): detect positional Loader and unsafe_load_all in avoid-pyyaml-load

  #4138·VISHNU0906 opened Nov 6, 2026·

  ·
  1

• fix(ai): detect aiohttp requests in MCP SSRF rule

  #4137·Carl7702 opened Nov 6, 2026·

  ·

• docs: warn about Defender quarantine of reverse-shell fixtures

  #4136·VISHNU0906 opened Nov 5, 2026·1 of 2 tasks·

  ·

• Document actions.lock workaround for github-actions-mutable-action-tag

  #4133·VISHNU0906 opened Nov 5, 2026·

  ·
  1

• remove duplicate insecure-innerhtml rule

  #4131·kankan223 opened Nov 2, 2026·

  ·
  1

• fix: don't treat str.strip as sanitization in mcp-unsanitized-return

  #4130·kankan223 opened Nov 2, 2026·

  ·
  3

• added semgrep rules for haskell

  #4129·aravindgopall opened Oct 30, 2026·

  ·
  1

• Fix false negatives in Python MCP and LLM exec rules

  #4128·Ayush-M99 opened Oct 30, 2026·

  ·
  1

  4

• Honor top-level minimumReleaseAge in Renovate cooldown rule

  #4126·asimmon opened Oct 28, 2026·

  ·
  1

  2

• Add rules for missing Host/Origin checks and open CORS on loopback servers

  #4125·kasparovabi opened Oct 28, 2026·

  ·

• Add ok-pattern for same repository reference

  #4124·ronnypolley opened Oct 27, 2026·

  ·
  1

  1

• feat(python.jinja2): taint-mode SSTI rule for Template and from_string

  #4123·brahimeelhamed opened Oct 26, 2026·

  ·
  1

• fix(javascript): detect namespaced vm2 constructors in Express rule

  #4122·aymanbouanouj opened Oct 26, 2026·

  ·
  1

  1

• fix(java): flag non-literal Runtime.exec args anywhere after -c

  #4121·protonnegativo opened Oct 24, 2026·

  ·
  1

  2

• Anchor PHP exec-use sink regex to exact function names.

  #4119·comptonjack opened Oct 23, 2026·

  ·
  1

  1

• Merge Develop into Release

  #4116·r2c-argo[bot] opened Oct 22, 2026Bot·

  ·
  1

• Add PHP session.upload_progress rules for CVE-2026-109619

  #4113·pid1 opened Oct 21, 2026Contributor·

  ·

• Add httpx and missing request sinks to mcp-ssrf-python rule

  #4112·Varshith-Kali opened Oct 21, 2026·

  ·
  1

  44

• Accept doctype feature set in constructor for DocumentBuilderFactory rule

  #4111·raju4199 opened Oct 20, 2026·

  ·
  1

• Fix anonymous-ldap-bind missing env set up in a helper

  #4110·raju4199 opened Oct 20, 2026·

  ·
  1

  1

• feat(mcp): add audit rule for dynamic shell commands

  #4109·hexisteme opened Oct 20, 2026·4 tasks done·

  ·

• Fix(OCaml): Update messages to use code formatting for clarity

  #4107·zbraiterman opened Oct 20, 2026·

  ·