reesec-rules

The rule pack the reesec platform scans with: our own SAST rules for Compose files and mobile app configuration (Android manifest/Gradle/network-security, iOS Info.plist, Expo), each with a test, published as tagged releases. The rules are written and graded in the private rule factory (pelerin.tech/reesec-factory); this repo is the factory's one-way output.

Source-available, not open source. Everything here is published under the PolyForm Shield License 1.0.0 (LICENSE, verbatim, SPDX LicenseRef-PolyForm-Shield-1.0.0 — SPDX lists no id for it). You may use, change and share the rules, including commercially, but not to compete with us.

Consuming a release

Releases are annotated semver tags only (vX.Y.Z); there are no release artifacts. Pin a tag exactly as the platform does:

{ "repo": "https://forge.pelerin.io/pelerin.tech/reesec-rules.git", "tag": "v0.1.0", "commit": "<40-hex>" }

Then clone it at that tag and verify the commit:

git clone --depth 1 --branch v0.1.0 https://forge.pelerin.io/pelerin.tech/reesec-rules.git
git -C reesec-rules rev-parse HEAD   # must equal the pinned commit

The pack is rules/*.yaml; tests/ and evidence/ are not part of the shipped pack. Every tag is made from a green test run (see below), and CHANGELOG.md names the rule ids added, changed and removed in it.

Layout

rules/<name>.yaml         the shipped rules
tests/<name>.test.<ext>   one test per rule file (not shipped)
evidence/<rule-id>.json   factory evidence bundles (not shipped; empty for hand-written rules)
scripts/test-rules.sh     opengrep test for every rule file with its test file
scripts/test-exempt.txt   rule files without a test, each with its reason
scripts/release.sh        tests green + clean tree + new semver → annotated tag + CHANGELOG section
.gitleaks.toml            secret scan config (one allowlisted fake credential in a test fixture)
.forgejo/workflows/test.yml   runs scripts/test-rules.sh on pull requests

Rule ids

Every rule carries an id of the form reesec.<area>.<name> — area is the technology (compose, android, ios, expo) and name the weakness (privileged, exported, ats-arbitrary-loads). Ids are never reused: a removed rule keeps its id retired, and a new version of a rule keeps its id so customer dismissals and trial counters carry over.

Adding a rule

1. Open a pull request adding rules/<name>.yaml and tests/<name>.test.<ext>. A rule without a test fails scripts/test-rules.sh; only files listed in scripts/test-exempt.txt (with a reason) may lack one.
2. The test needs at least one ruleid: (or ok:) annotation. An empty test passes vacuously, so it fails the check.
3. The workflow runs the test; a person reviews, merges, and runs scripts/release.sh vX.Y.Z to tag.

The factory opens such pull requests itself for rules it has graded: the rule, its test and evidence/<rule-id>.json (the mined, similarity, adversary, hit-sample and judge results). The factory never tags — a person does, after review.

Testing locally

OPENGREP=/path/to/opengrep scripts/test-rules.sh

Opengrep is pinned to 1.31.0 (the platform's version); scripts/test-rules.sh runs opengrep test tests/<name>.test.<ext> --config rules/<name>.yaml for each rule file.