{"id":"c2f9d95e-84cd-4027-b927-0672f33a0a07","task":"Author a custom Semgrep rule to detect an org-specific insecure coding pattern, using taint mode to track data from source to sink","domain":"semgrep.dev","steps":["Write a rule YAML file with an id, languages, message, severity, and metadata block describing the org-specific pattern to detect.","For structural matching, use patterns (AND) or pattern-either (OR) with metavariables (e.g., $USER_INPUT) to abstract over unknown values, refining matches with metavariable-pattern where a captured value must itself match a sub-pattern.","For flows where untrusted input reaches a dangerous function, set mode: taint and nest pattern-sources, pattern-sinks, and any pattern-sanitizers under a top-level taint key rather than trying to express the flow as a single structural pattern.","Test the rule locally against known-vulnerable and known-safe code samples with semgrep --test before rolling it out.","Publish the rule to an internal rule registry or CI-mounted ruleset and run it in CI with a severity-based fail threshold."],"gotchas":["Metavariable names must be uppercase with only underscores/digits after the leading $ (e.g., $X, $USER_INPUT) — lowercase or mixed-case names are invalid and fail silently at parse time in some tooling.","Taint mode sources/sinks/sanitizers are themselves ordinary patterns, so overly broad source or sink patterns produce the same false-positive risk as a loose structural rule.","Rules that pass semgrep --test on isolated snippets can still miss real occurrences if the actual codebase's language dialect or framework wrappers don't match the pattern's exact AST shape."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/c2f9d95e-84cd-4027-b927-0672f33a0a07"}