feat: add high-signal semantic review rules for Hermes #7

Merged

speedi57 merged 17 commits from hermes-semantic-security-rules into main

2026-09-04 09:30:46 +00:00

hermes commented

2026-09-04 09:07:25 +00:00

Owner

Goal

Extend the Hermes ruleset with high-value semantic checks that target demonstrable security and correctness defects while following the evidence/confidence contract introduced in #6.

Added rules

BOLA / IDOR object-level authorization
role/permission authorization distinct from authentication
mass assignment / over-posting
path traversal
command injection / shell execution
unsafe deserialization
credentialed CORS with untrusted origins
outbound HTTP calls without finite timeouts
unsafe retry semantics / missing backoff and idempotency
file upload validation and storage boundaries
database uniqueness race conditions
SQLAlchemy session lifecycle / failed transaction reuse
frontend-only authorization
open redirects
React stale async response races
atomicity of dependent multi-write transactions

Review semantics

The rules are primarily diff-scoped and explicitly require concrete source-to-sink paths, reachable operations, visible invariants, or other repository evidence. Exceptions suppress findings where a shared/upstream control is visible. This is intended to keep Hermes high-signal and avoid speculative findings.

Manifest

Bumps the ruleset from 1.1.0 to 1.2.0 and the rule count from 34 to 50.

## Goal Extend the Hermes ruleset with high-value semantic checks that target demonstrable security and correctness defects while following the evidence/confidence contract introduced in #6. ## Added rules - BOLA / IDOR object-level authorization - role/permission authorization distinct from authentication - mass assignment / over-posting - path traversal - command injection / shell execution - unsafe deserialization - credentialed CORS with untrusted origins - outbound HTTP calls without finite timeouts - unsafe retry semantics / missing backoff and idempotency - file upload validation and storage boundaries - database uniqueness race conditions - SQLAlchemy session lifecycle / failed transaction reuse - frontend-only authorization - open redirects - React stale async response races - atomicity of dependent multi-write transactions ## Review semantics The rules are primarily diff-scoped and explicitly require concrete source-to-sink paths, reachable operations, visible invariants, or other repository evidence. Exceptions suppress findings where a shared/upstream control is visible. This is intended to keep Hermes high-signal and avoid speculative findings. ## Manifest Bumps the ruleset from 1.1.0 to 1.2.0 and the rule count from 34 to 50.

hermes added 17 commits

2026-09-04 09:07:25 +00:00

rules: add object-level authorization check 1e63e18998

rules: add operation authorization check e8cc2b2061

rules: add mass-assignment protection c79388625f

rules: add path traversal detection cdc6cd89e0

rules: add command injection detection e60b8ac08e

rules: add unsafe deserialization detection 68596a4172

rules: add credentialed CORS safety check 51d683fe71

rules: require outbound HTTP timeouts a695173df3

rules: add safe retry semantics check 5e57d30bf8

rules: add file upload validation aa3bf62784