rules:
  - id: no-eval
    pattern: eval(...)
    message: >
      Use of eval() is a security risk. Do not use eval() in production code.
      Consider using ast.literal_eval() for safe evaluation of literals.
    languages: [python]
    severity: ERROR
    paths:
      include:
        - src/

  - id: no-exec
    pattern: exec(...)
    message: >
      Use of exec() is a security risk. Do not use exec() in production code.
      Find an alternative approach that does not require dynamic code execution.
    languages: [python]
    severity: ERROR
    paths:
      include:
        - src/
      exclude:
        - src/cleveragents/tool/wrapping.py

  - id: no-compile-exec
    pattern: compile(..., ..., "exec")
    message: >
      Using compile() with exec mode is a security risk.
      Avoid dynamic code compilation in production code.
    languages: [python]
    severity: ERROR
    paths:
      include:
        - src/
      exclude:
        - src/cleveragents/tool/wrapping.py

  - id: no-os-system
    pattern: os.system(...)
    message: >
      Use of os.system() is insecure. Use subprocess.run() with shell=False instead.
    languages: [python]
    severity: WARNING
    paths:
      include:
        - src/

  - id: no-pickle-loads
    pattern: pickle.loads(...)
    message: >
      Use of pickle.loads() on untrusted data is a security risk.
      Consider using json or a safe serialization format.
    languages: [python]
    severity: WARNING
    paths:
      include:
        - src/