Search, inspect, and fetch rules ready for coding-agent workflows.
+22.1% · 30d
1M in 7d
All rules verified
Untrusted template code is compiled or evaluated with Function/eval in the host realm instead of a hardened VM realm. Compiling a stored template with new Function() in the worker's own realm, and handing it the host payload object by reference, lets $payload.constructor.constructor resolve to the host Function constructor and execute arbitrary code (sandbox
A libcurl request is created from a non-constant URL while redirect following is enabled (CURLOPT_FOLLOWLOCATION = true) and the URL is neither validated nor restricted with CURLOPT_PROTOCOLS. An attacker-controlled URL here enables server-side request forgery (CWE-918): libcurl's default protocol set exposes file://, dict:// and gopher://, a redirect from a
No. greprules.io is a registry and quality layer for SAST rules. Scans still run through compatible CLI, scanner, or agent workflows.
Yes. Public rules are available for browse and fetch. Sign in is for starring rules, collections, feedback, and publishing reviewed submissions.
JS/TS and Python are the focused languages today. Other languages may appear in the registry, with early support marked in the explorer filters.
Check license, source/provenance, validation status, quality score, usage signals, references, and community feedback before reuse.
Greprules is sponsored by Provally. Local tooling, public registry surfaces, schemas, manifests, and project docs are open-source oriented; hosted operations are run by Provally.
