Public security rule registry

The community hub for quality SASTStatic Application Security Testing rules.

Search, inspect, and fetch rules ready for coding-agent workflows.

Verified qualityReusable packsAgent-ready fetch

JS/TS Python CVE rules Agent generated Verified

Indexed rules: 4,797
Rule fetches: 7.4M
Verified coverage: 100%

Explore rulesSearch by CVE, CWE, language, framework, or rule slug.Rule packsFetch curated sets with provenance and manifests.LeaderboardFind active authors and recommended rules.Agent pluginInstall and run greprules from Claude Code, Codex, or Hermes.

Featured

Rules worth checking first

Open explorer

CVE-2026-84190: Php Config Command InjectionQuality 81

Configuration value is passed directly to an OS command execution function without proper escaping or validation. An attacker with configuration modification privileges could inject arbitrary commands.

cve-2026-84190-php-config-command-injectionProvally

0 stars

271 downloads

CVE-2026-83743: Laravel Unauthorized Route Model UpdateQuality 76

Route-bound model is updated directly from generic Request input without explicit authorization or FormRequest validation, potentially allowing IDOR or unauthorized modifications.

cve-2026-83743-laravel-unauthorized-route-model-updateProvally

0 stars

271 downloads

Community

Top 5 authors

Rankings

1
@provally1 stars · 6.2M downloads
2
@gitlab-security-products0 stars · 1.2M downloads

Reuse

Packs and collections

All packs

Python Security972 rules · 5 downloads

FAQ

Common questions

Docs

Is greprules.io a scanner?

No. greprules.io is a registry and quality layer for SAST rules. Scans still run through compatible CLI, scanner, or agent workflows.

Can public rules be fetched without signing in?

Yes. Public rules are available for browse and fetch. Sign in is for starring rules, collections, feedback, and publishing reviewed submissions.

Which languages are supported?

JS/TS and Python are the focused languages today. Other languages may appear in the registry, with early support marked in the explorer filters.

How should I judge whether a rule is ready to reuse?

Check license, source/provenance, validation status, quality score, usage signals, references, and community feedback before reuse.

Is greprules open source?

Greprules is sponsored by Provally. Local tooling, public registry surfaces, schemas, manifests, and project docs are open-source oriented; hosted operations are run by Provally.