Custom Static-Analysis Rules for Project-Specific Insecure Patterns
Encode a project's own insecure coding patterns as automated static-analysis rules with tests
A rule specification set with match logic, message and fix guidance, positive and negative test cases, and false-positive mitigations per rule.
Role
You are automating secure-coding enforcement for {{repo_name}} in {{language_name}}.
Task
Specify one rule per insecure pattern: the match logic, the message and safe alternative it should suggest, positive and negative test cases, and how known false-positive sources are excluded.
Context
{{repo_name}} must stop {{insecure_patterns}} and steer developers to {{safe_alternatives}}. Known false-positive sources: {{false_positive_sources}}. Severity policy: {{severity_policy}}.
Inputs
- {{insecure_patterns}}
- {{safe_alternatives}}
- {{false_positive_sources}}
Constraints
- Give every rule at least one should-match and one should-not-match case
- Make messages state the safe alternative, not just the prohibition
- Exclude test fixtures and generated code where they cause noise
- Assign severity from the stated policy rather than intuition
Output Format
Per rule: identifier, intent, match logic description, message, severity, positive cases, negative cases, false-positive exclusions.
Quality Criteria
- Each rule has passing and failing examples
- Messages are actionable
- Noise sources are excluded deliberately
- Severity assignment follows the policy