Search, inspect, and fetch rules ready for coding-agent workflows.
484.9K in 7d
All rules verified
Reconstructing a relative URL directly from `URL.pathname` without sanitizing leading slashes can lead to Open Redirect vulnerabilities. When parsing user input with a dummy base, inputs like `/.//evil.com` normalize to a pathname of `//evil.com`. If this is used in a navigation or redirect, it is treated as a protocol-relative URL to an external domain. Col
A URL object is instantiated to validate the path, but the host is not verified. Attackers can supply protocol-relative paths (e.g., `//evil.com`) which resolve against the current base URL and pass protocol-only checks. If the unvalidated path is then used for navigation, it results in an Open Redirect.
No. greprules.io is a registry and quality layer for SAST rules. Scans still run through compatible CLI, scanner, or agent workflows.
Yes. Public rules are available for browse and fetch. Sign in is for starring rules, collections, feedback, and publishing reviewed submissions.
JS/TS and Python are the focused languages today. Other languages may appear in the registry, with early support marked in the explorer filters.
Check license, source/provenance, validation status, quality score, usage signals, references, and community feedback before reuse.
Greprules is sponsored by Provally. Local tooling, public registry surfaces, schemas, manifests, and project docs are open-source oriented; hosted operations are run by Provally.
