Does this skill cover infrastructure security like Terraform and Kubernetes?

Yes. The skill includes 28 rule categories covering Terraform (AWS, Azure, GCP), Kubernetes, Docker, and GitHub Actions alongside language-specific rules for Python, JavaScript, Java, Go, C/C++, Ruby, and PHP.

When should I use this skill — only when the user asks about security?

No. The skill is designed for proactive mode: automatically check for vulnerabilities when writing or reviewing any code that handles user input, authentication, databases, file operations, network requests, cryptography, or infrastructure configuration — even if the user doesn't explicitly mention security.

What vulnerabilities does this skill prioritize?

It prioritizes Critical impact rules first: SQL injection, command injection, XSS, XXE, path traversal, insecure deserialization, code injection, hardcoded secrets, and memory safety. High impact rules include insecure crypto, SSRF, JWT issues, and CSRF.

Does this skill provide code examples for each vulnerability type?

Yes. Each rule category (e.g., `rules/sql-injection.md`) contains detailed vulnerable and secure code examples in the relevant language.

code-security by semgrep

Code Security

Version 0.1.0
Semgrep Engineering
January 2026

Note:
This document is mainly for agents and LLMs to follow when maintaining,
generating, or refactoring codebases with a focus on security best practices. Humans
may also find it useful, but guidance here is optimized for automation
and consistency by AI-assisted workflows.

Abstract

Comprehensive code security guide, designed for AI agents and LLMs.

SQL Injection — CRITICAL
- 1.1 Prevent SQL Injection
Command Injection — CRITICAL
- 2.1 Prevent Command Injection
Cross-Site Scripting — CRITICAL
- 3.1 Prevent Cross-Site Scripting (XSS)
XML External Entity — CRITICAL
- 4.1 Prevent XML External Entity (XXE) Injection
Path Traversal — CRITICAL
- 5.1 Prevent Path Traversal
Insecure Deserialization — CRITICAL
- 6.1 Prevent Insecure Deserialization
Code Injection — CRITICAL
- 7.1 Prevent Code Injection
Hardcoded Secrets — CRITICAL
- 8.1 Avoid Hardcoded Secrets
Memory Safety — CRITICAL
- 9.1 Ensure Memory Safety
Insecure Cryptography — HIGH

10.1 Avoid Insecure Cryptography

Insecure Transport — HIGH

11.1 Use Secure Transport

Server-Side Request Forgery — HIGH

12.1 Prevent Server-Side Request Forgery

JWT Authentication — HIGH

13.1 Secure JWT Authentication

Cross-Site Request Forgery — HIGH

14.1 Prevent Cross-Site Request Forgery

Prototype Pollution — HIGH

15.1 Prevent Prototype Pollution

Unsafe Functions — HIGH

16.1 Avoid Unsafe Functions

Terraform AWS Security — HIGH

17.1 Secure AWS Terraform Configurations

Terraform Azure Security — HIGH

18.1 Secure Azure Terraform Configurations

Terraform GCP Security — HIGH

19.1 Secure GCP Terraform Configurations

Kubernetes Security — HIGH

20.1 Secure Kubernetes Configurations

Docker Security — HIGH

21.1 Secure Docker Configurations

GitHub Actions Security — HIGH

22.1 Secure GitHub Actions

Regular Expression DoS — MEDIUM

23.1 Prevent Regular Expression DoS

Race Conditions — MEDIUM

24.1 Prevent Race Conditions

Code Correctness — MEDIUM

25.1 Code Correctness

Best Practices — LOW

26.1 Code Best Practices

Performance — LOW

27.1 Performance Best Practices

Maintainability — LOW

28.1 Code Maintainability

1. SQL Injection

Impact: CRITICAL

SQL injection allows attackers to manipulate database queries, leading to data theft, modification, or deletion. OWASP Top 10.

1.1 Prevent SQL Injection

Impact: CRITICAL (Attackers can read, modify, or delete database data)

SQL injection allows attackers to manipulate database queries by injecting malicious SQL through user input. Never concatenate user input into SQL queries - always use parameterized queries or prepared statements.

Vulnerable patterns: String concatenation (+), format strings (.format(), %, f-strings, String.Format()), template literals with variables.

Incorrect: string concatenation

import psycopg2

def get_user(user_input):
    conn = psycopg2.connect("dbname=test")
    cur = conn.cursor()
    query = "SELECT * FROM users WHERE name = '" + user_input + "'"
    cur.execute(query)

Incorrect: format string

def get_user(user_input):
    cur.execute("SELECT * FROM users WHERE id = {}".format(user_input))

Incorrect: f-string

def get_user(user_input):
    cur.execute(f"SELECT * FROM users WHERE id = {user_input}")

Correct: parameterized query

def get_user(user_input):
    conn = psycopg2.connect("dbname=test")
    cur = conn.cursor()
    cur.execute("SELECT * FROM users WHERE name = %s", [user_input])

Incorrect: template literal with variable

const { Pool } = require('pg')
const pool = new Pool()

async function getUser(userId) {
  const sql = `SELECT * FROM users WHERE id = ${userId}`
  const { rows } = await pool.query(sql)
  return rows
}

Incorrect: string concatenation

async function getUser(userId) {
  const sql = "SELECT * FROM users WHERE id = " + userId
  const { rows } = await pool.query(sql)
  return rows
}

Correct: parameterized query

async function getUser(userId) {
  const sql = 'SELECT * FROM users WHERE id = $1'
  const { rows } = await pool.query(sql, [userId])
  return rows
}

Incorrect: string concatenation with Statement

public ResultSet getUser(String input) throws SQLException {
    Statement stmt = connection.createStatement();
    String sql = "SELECT * FROM users WHERE name = '" + input + "'";
    return stmt.executeQuery(sql);
}

Incorrect: String.format

public ResultSet getUser(String input) throws SQLException {
    Statement stmt = connection.createStatement();
    return stmt.executeQuery(String.format("SELECT * FROM users WHERE name = '%s'", input));
}

Correct: PreparedStatement with parameters

public ResultSet getUser(String input) throws SQLException {
    PreparedStatement pstmt = connection.prepareStatement(
        "SELECT * FROM users WHERE name = ?");
    pstmt.setString(1, input);
    return pstmt.executeQuery();
}

Incorrect: string concatenation

func getUser(db *sql.DB, userInput string) {
    query := "SELECT * FROM users WHERE name = '" + userInput + "'"
    db.Query(query)
}

Incorrect: fmt.Sprintf

func getUser(db *sql.DB, email string) {
    query := fmt.Sprintf("SELECT * FROM users WHERE email = '%s'", email)
    db.Query(query)
}

Correct: parameterized query

func getUser(db *sql.DB, userInput string) {
    db.Query("SELECT * FROM users WHERE name = $1", userInput)
}

Incorrect: string concatenation

def get_user(user_input)
  conn = PG.connect(dbname: 'test')
  query = "SELECT * FROM users WHERE name = '" + user_input + "'"
  conn.exec(query)
end

Incorrect: string interpolation

def get_user(user_input)
  conn = PG.connect(dbname: 'test')
  conn.exec("SELECT * FROM users WHERE name = '#{user_input}'")
end

Correct: parameterized query

def get_user(user_input)
  conn = PG.connect(dbname: 'test')
  conn.exec_params('SELECT * FROM users WHERE name = $1', [user_input])
end

Incorrect: String.Format

public void GetUser(string userInput)
{
    SqlCommand command = connection.CreateCommand();
    command.CommandText = String.Format(
        "SELECT * FROM users WHERE name = '{0}'", userInput);
}

Incorrect: string concatenation

public void GetUser(string userInput)
{
    SqlCommand command = new SqlCommand(
        "SELECT * FROM users WHERE name = '" + userInput + "'");
}

Correct: SqlParameter

public void GetUser(string userInput)
{
    string sql = "SELECT * FROM users WHERE name = @Name";
    SqlCommand command = new SqlCommand(sql);
    command.Parameters.Add("@Name", SqlDbType.NVarChar);
    command.Parameters["@Name"].Value = userInput;
}

References:

2. Command Injection

Impact: CRITICAL

OS command injection allows attackers to execute arbitrary system commands, leading to full system compromise. CWE-78.

2.1 Prevent Command Injection

Impact: CRITICAL (Remote code execution allowing attackers to run arbitrary commands on the host system)

Command injection occurs when untrusted input is passed to system shell commands. Attackers can execute arbitrary commands on the host system, potentially downloading malware, stealing data, or taking complete control of the server.

Incorrect: vulnerable to command injection via subprocess

import subprocess
import flask

app = flask.Flask(__name__)

@app.route("/ping")
def ping():
    ip = flask.request.args.get("ip")
    subprocess.run("ping " + ip, shell=True)

Correct: use array form without shell=True

import subprocess
import flask

app = flask.Flask(__name__)

@app.route("/ping")
def ping():
    ip = flask.request.args.get("ip")
    subprocess.run(["ping", ip])

Incorrect: vulnerable child_process with user input

const { exec } = require('child_process');

function runCommand(userInput) {
    exec(`cat ${userInput}`, (error, stdout, stderr) => {
        console.log(stdout);
    });
}

Correct: use spawn with array arguments

const { spawn } = require('child_process');

function runCommand(userInput) {
    const proc = spawn('cat', [userInput]);
    proc.stdout.on('data', (data) => {
        console.log(data.toString());
    });
}

Incorrect: ProcessBuilder with user input via shell

public class CommandRunner {

    public void runCommand(String userInput) throws IOException {
        String[] cmd = {"/bin/bash", "-c", userInput};
        ProcessBuilder builder = new ProcessBuilder(cmd);
        Process proc = builder.start();
    }
}

Correct: use ProcessBuilder with array arguments, no shell

public class CommandRunner {

    public void runCommand(String filename) throws IOException {
        ProcessBuilder builder = new ProcessBuilder("cat", filename);
        Process proc = builder.start();
    }
}

Incorrect: dangerous command with user input via stdin

import (
    "fmt"
    "os/exec"
)

func runCommand(userInput string) {
    cmd := exec.Command("bash")
    cmdWriter, _ := cmd.StdinPipe()
    cmd.Start()

    cmdString := fmt.Sprintf("echo %s", userInput)
    cmdWriter.Write([]byte(cmdString + "\n"))

    cmd.Wait()
}

Correct: use exec.Command with explicit arguments

import (
    "os/exec"
)

func runCommand(filename string) {
    cmd := exec.Command("cat", filename)
    output, _ := cmd.Output()
    println(string(output))
}

Incorrect: Shell methods with tainted input

require 'shell'

def read_file(params)
    Shell.cat(params[:filename])
end

Correct: use hardcoded or validated paths

require 'shell'

def read_log
    Shell.cat("/var/log/www/access.log")
end

References:

3. Cross-Site Scripting

Impact: CRITICAL

XSS allows attackers to inject malicious scripts into web pages, leading to session hijacking, defacement, or malware distribution. CWE-79.

3.1 Prevent Cross-Site Scripting (XSS)

Impact: CRITICAL (Client-side code execution, session hijacking, credential theft)

XSS occurs when untrusted data is included in web pages without proper validation or escaping. Attackers can execute scripts in victim's browser to steal cookies, session tokens, or other sensitive data.

Incorrect: vulnerable to XSS

function renderUserContent(userInput) {
  document.body.innerHTML = '<div>' + userInput + '</div>';
}

Correct: use textContent or sanitization

function renderUserContent(userInput) {
  const div = document.createElement('div');
  div.textContent = userInput;
  document.body.appendChild(div);
}

References:

Incorrect: user input in response

from flask import make_response, request

def search():
    query = request.args.get("q")
    return make_response(f"Results for: {query}")

Correct: escape output

from flask import make_response, request
from markupsafe import escape

def search():
    query = request.args.get("q")
    return make_response(f"Results for: {escape(query)}")

References:

Incorrect: request data in HttpResponse

from django.http import HttpResponse

def greet(request):
    name = request.GET.get("name", "")
    return HttpResponse(f"Hello, {name}!")

Correct: use template or escape

from django.http import HttpResponse
from django.utils.html import escape

def greet(request):
    name = request.GET.get("name", "")
    return HttpResponse(f"Hello, {escape(name)}!")

References:

Incorrect: writing request parameters directly

public class UserServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {
        String name = req.getParameter("name");
        resp.getWriter().write("<h1>Hello " + name + "</h1>");
    }
}

Correct: encode output

import org.owasp.encoder.Encode;

public class UserServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {
        String name = req.getParameter("name");
        resp.getWriter().write("<h1>Hello " + Encode.forHtml(name) + "</h1>");
    }
}

References:

Incorrect: writing user input to ResponseWriter

func greetHandler(w http.ResponseWriter, r *http.Request) {
    name := r.URL.Query().Get("name")
    template := "<html><body><h1>Hello %s</h1></body></html>"
    w.Write([]byte(fmt.Sprintf(template, name)))
}

Correct: use html/template

func greetHandler(w http.ResponseWriter, r *http.Request) {
    name := r.URL.Query().Get("name")
    tmpl := template.Must(template.New("greet").Parse(
        "<html><body><h1>Hello {{.}}</h1></body></html>"))
    tmpl.Execute(w, name)
}

References:

Incorrect: echoing user input

<?php
function greet() {
    $name = $_REQUEST['name'];
    echo "Hello: " . $name;
}

Correct: use htmlspecialchars

<?php
function greet() {
    $name = $_REQUEST['name'];
    echo "Hello: " . htmlspecialchars($name, ENT_QUOTES, 'UTF-8');
}

References:

4. XML External Entity

Impact: CRITICAL

XXE attacks exploit XML parsers to access local files, perform SSRF, or cause denial of service. CWE-611.

4.1 Prevent XML External Entity (XXE) Injection

Impact: CRITICAL (File disclosure, SSRF, denial of service)

XXE occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. Attackers can access local files, perform SSRF, or cause DoS.