Codevigilant Semgrep Rules

CodeVigilant Semgrep Rules

A curated collection of Semgrep security rules for **WordPress and PHP development**. This repository focuses exclusively on WordPress-specific security vulnerabilities.

**Note**: We focus exclusively on **security rules**. Coding style and quality rules are not included.

Quick Start

# Run ALL rules (117 total)
semgrep --config php/ 

# Run CodeVigilant original security rules only (30 rules)
semgrep --config php/wordpress/ 

# Run WordPress/VIP coding standard rules (87 rules)
semgrep --config php/coding-standards/ 

# Run a specific rule category
semgrep --config php/wordpress/SQLi/ 
semgrep --config php/coding-standards/security/ 

⚠️ **Important**: Do not run these rules on your entire WordPress codebase. Run them against specific plugins or themes you want to analyze. Semgrep may run out of memory on large codebases.

Rule Sources

This repository contains rules from two sources:

1. Original CodeVigilant Rules - Custom rules developed by the CodeVigilant team
2. Ported Rules - Rules ported from other security tools with proper attribution

When rules are ported from other tools, we clearly credit the original source in the rule metadata and documentation.

Current Status

Category	Rules	Source
SQL Injection (SQLi)	28	Original + Ported
Cross-Site Scripting (XSS)	18	Original + Ported
Server-Side Request Forgery (SSRF)	5	Original
Remote Code Execution (RCE)	12	Original + Ported
Insecure Deserialization	1	Original
Input Validation	5	Ported
File Inclusion (LFI/RFI)	3	Ported
Open Redirect	3	Ported
CSRF/Nonce	3	Ported
Template Injection	4	Ported
DoS/Resource Exhaustion	5	Ported
VIP-Specific Security	21	Ported
WordPress Security	13	Ported
PHP Security	19	Ported
Total	**