# LDR Custom Security Rules

This directory contains custom Semgrep security rules specific to Local Deep Research (LDR).

## Rules Overview

### ldr-security.yaml

LDR-specific security rules covering:

1. **Hardcoded Secrets**
   - Detects API keys, passwords, tokens in source code
   - Severity: ERROR
   - CWE-798

2. **SQL Injection Prevention**
   - Detects string concatenation in SQL queries
   - Enforces parameterized queries via SQLAlchemy
   - Severity: ERROR
   - CWE-89

3. **Code Injection**
   - Detects dangerous use of eval/exec
   - Prevents arbitrary code execution
   - Severity: ERROR
   - CWE-95

4. **Command Injection**
   - Detects unsafe use of os.system, shell=True
   - Enforces subprocess with argument lists
   - Severity: ERROR
   - CWE-78

5. **Path Traversal**
   - Detects unsanitized user input in file paths
   - Prevents directory traversal attacks
   - Severity: WARNING
   - CWE-22

6. **Unsafe Deserialization**
   - Detects unsafe YAML/pickle loading
   - Prevents code execution via deserialization
   - Severity: ERROR
   - CWE-502

7. **Weak Randomness**
   - Detects use of random module for security
   - Enforces secrets module for crypto operations
   - Severity: WARNING
   - CWE-338

8. **Debug Mode in Production**
   - Detects Flask debug=True
   - Prevents information disclosure
   - Severity: ERROR
   - CWE-489

9. **SSRF Prevention**
   - Detects URL fetching operations
   - Reminds to validate URLs
   - Severity: WARNING
   - CWE-918

10. **XSS Prevention**
    - Detects user input in HTML context
    - Enforces proper escaping
    - Severity: WARNING
    - CWE-79

11. **CSRF Protection**
    - Detects POST endpoints
    - Reminds to enable CSRF protection
    - Severity: INFO
    - CWE-352

12. **Credential Logging**
    - Detects passwords in log statements
    - Prevents credential disclosure
    - Severity: ERROR
    - CWE-532

## Usage

These rules are automatically run by the Semgrep CI/CD workflow:

```bash
# Run locally
semgrep --config=.semgrep/rules/ src/

# Run with standard rules
semgrep --config=p/security-audit --config=.semgrep/rules/ src/
```

## Adding New Rules

To add new custom rules:

1. Create a new YAML file in `.semgrep/rules/`
2. Follow [Semgrep rule syntax](https://semgrep.dev/docs/writing-rules/overview/)
3. Test the rule: `semgrep --config=.semgrep/rules/your-rule.yaml src/`
4. Document the rule in this README

## Rule Template

```yaml
rules:
  - id: your-rule-id
    pattern: |
      # Your pattern here
    message: Description of the security issue
    languages: [python]
    severity: ERROR  # or WARNING, INFO
    metadata:
      category: security
      cwe: "CWE-XXX: Description"
      owasp: "AXX:2021 - Category"
```

## References

- [Semgrep Documentation](https://semgrep.dev/docs/)
- [OWASP Top 10 2021](https://owasp.org/Top10/)
- [CWE Top 25](https://cwe.mitre.org/top25/)
- [Semgrep Registry](https://semgrep.dev/explore)