Require Rust advisory checks, Clippy and real-WASM property regressions

.github/CODEOWNERS

@@ -15,3 +15,24 @@
 /guard/ @dotmantissa
 /migration/ @dotmantissa
 /sdk/src/generated/ @dotmantissa
+
+# Security policy and value-moving source always require owner review.
+/.semgrepignore @dotmantissa
+/src/ @dotmantissa
+/sdk/src/ @dotmantissa
+/api/ @dotmantissa
+/embed/src/ @dotmantissa
+/copy/src/ @dotmantissa
+/package.json @dotmantissa
+/sdk/package.json @dotmantissa
+/embed/package.json @dotmantissa
+/fixtures/ @dotmantissa
+/tests/ @dotmantissa
+/test/ @dotmantissa
+
+# Build/test configuration and nested manifests are also part of the trust boundary.
+**/package.json @dotmantissa
+**/Cargo.toml @dotmantissa
+/tsconfig*.json @dotmantissa
+/playwright*.ts @dotmantissa
+/vitest*.ts @dotmantissa

.github/dependabot.yml

@@ -5,3 +5,13 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: pip
+    directory: /.github
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/rustsec-native-host.json

@@ -0,0 +1,8 @@
+{
+  "advisory": "RUSTSEC-2026-0387",
+  "package": "crypto-bigint",
+  "version": "0.5.5",
+  "expires": "2027-01-01",
+  "reason": "Only pinned Soroban native test host through elliptic-curve 0.13.8 / k256 / p256. Absent from normal guard and migration wasm32v1-none graphs, checked on every run. Fixtures use mocked owner authorization and public-input host verification; no production secret scalar operations are performed here. Patched crypto-bigint >=0.7.6 requires an upstream major-version transition. Preserve deployed guest hashes and review upstream upgrade before expiry.",
+  "upstream": "https://github.com/RustCrypto/crypto-bigint/pull/1365"
+}

.github/security-requirements.in

@@ -0,0 +1,2 @@
+semgrep==1.183.0
+PyYAML==6.0.3

.github/security-rules/LICENSE

@@ -0,0 +1 @@
+Semgrep Rules License v1.0. For more details, visit https://semgrep.dev/legal/rules-license

.github/security-rules/javascript__aws-lambda__security__pg-sqli.yaml

@@ -0,0 +1,63 @@
+rules:
+- id: pg-sqli
+  message: >-
+    Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if the
+    variable is user-controlled
+    and not properly sanitized. In order to prevent SQL injection,
+    use parameterized queries or prepared statements instead.
+    You can use parameterized statements like so:
+    `connection.query('SELECT $1 from table', [userinput])`
+  metadata:
+    references:
+    - https://node-postgres.com/features/queries
+    category: security
+    owasp:
+    - A01:2017 - Injection
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    cwe:
+    - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+    technology:
+    - aws-lambda
+    - postgres
+    - pg
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    confidence: MEDIUM
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern-inside: |
+          exports.handler = function ($EVENT, ...) {
+            ...
+          }
+      - pattern-inside: |
+          function $FUNC ($EVENT, ...) {...}
+          ...
+          exports.handler = $FUNC
+      - pattern-inside: |
+          $FUNC = function ($EVENT, ...) {...}
+          ...
+          exports.handler = $FUNC
+    - pattern: $EVENT
+  pattern-sinks:
+  - patterns:
+    - focus-metavariable: $QUERY
+    - pattern-either:
+      - pattern: $DB.query($QUERY, ...)
+    - pattern-either:
+      - pattern-inside: |
+          require('pg')
+          ...
+      - pattern-inside: |
+          import 'pg'
+          ...

.github/security-rules/javascript__browser__security__dom-based-xss.yaml

@@ -0,0 +1,34 @@
+rules:
+- id: dom-based-xss
+  message: >-
+    Detected possible DOM-based XSS. This occurs because a portion of the URL is being used
+    to construct an element added directly to the page. For example, a malicious actor could
+    send someone a link like this: http://www.some.site/page.html?default=<script>alert(document.cookie)</script>
+    which would add the script to the page.
+    Consider allowlisting appropriate values or using an approach which does not involve the URL.
+  metadata:
+    cwe:
+    - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+    owasp:
+    - A07:2017 - Cross-Site Scripting (XSS)
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    references:
+    - https://owasp.org/www-community/attacks/DOM_Based_XSS
+    category: security
+    technology:
+    - browser
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW
+    confidence: LOW
+  languages:
+  - javascript
+  - typescript
+  severity: ERROR
+  pattern-either:
+  - pattern: document.write(<... document.location.$W ...>)
+  - pattern: document.write(<... location.$W ...>)

.github/security-rules/javascript__browser__security__eval-detected.yaml

@@ -0,0 +1,35 @@
+rules:
+- id: eval-detected
+  message: >-
+    Detected the use of eval(). eval() can be dangerous if used to evaluate
+    dynamic content. If this content can be input from outside the program, this
+    may be a code injection vulnerability. Ensure evaluated content is not definable
+    by external sources.
+  metadata:
+    cwe:
+    - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
+    owasp:
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    asvs:
+      section: V5 Validation, Sanitization and Encoding
+      control_id: 5.2.4 Dynamic Code Execution Features
+      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing
+      version: '4'
+    category: security
+    technology:
+    - browser
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM
+    confidence: LOW
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  patterns:
+  - pattern-not: eval("...")
+  - pattern: eval(...)

.github/security-rules/javascript__browser__security__insecure-document-method.yaml

@@ -0,0 +1,40 @@
+rules:
+- id: insecure-document-method
+  message: >-
+    User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern
+    that can lead to XSS vulnerabilities
+  metadata:
+    cwe:
+    - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+    owasp:
+    - A07:2017 - Cross-Site Scripting (XSS)
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    category: security
+    technology:
+    - browser
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW
+    confidence: LOW
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+  languages:
+  - javascript
+  - typescript
+  severity: ERROR
+  patterns:
+  - pattern-either:
+    - pattern: |
+        $EL.innerHTML = $HTML;
+    - pattern: |
+        $EL.outerHTML = $HTML;
+    - pattern: document.write(...)
+  - pattern-not: |
+      $EL.innerHTML = "...";
+  - pattern-not: |
+      $EL.outerHTML = "...";
+  - pattern-not: document.write("...")

.github/security-rules/javascript__browser__security__insecure-innerhtml.yaml

@@ -0,0 +1,32 @@
+rules:
+- id: insecure-innerhtml
+  message: >-
+    User controlled data in a `$EL.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities
+  metadata:
+    cwe:
+    - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+    owasp:
+    - A07:2017 - Cross-Site Scripting (XSS)
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    category: security
+    technology:
+    - browser
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW
+    confidence: LOW
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+  languages:
+  - javascript
+  - typescript
+  severity: ERROR
+  patterns:
+  - pattern: |
+      $EL.innerHTML = $HTML;
+  - pattern-not: |
+      $EL.innerHTML = "...";

.github/security-rules/javascript__browser__security__insufficient-postmessage-origin-validation.yaml

@@ -0,0 +1,51 @@
+rules:
+- id: insufficient-postmessage-origin-validation
+  message: >-
+    No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw
+    to perform Cross Origin attacks such as Cross-Site Scripting(XSS).
+  metadata:
+    owasp:
+    - A08:2021 - Software and Data Integrity Failures
+    - A08:2025 - Software or Data Integrity Failures
+    cwe:
+    - 'CWE-345: Insufficient Verification of Data Authenticity'
+    category: security
+    technology:
+    - browser
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW
+    confidence: LOW
+    references:
+    - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  pattern-either:
+  - patterns:
+    - pattern: |
+        window.addEventListener('message', $FUNC, ...)
+    - metavariable-pattern:
+        patterns:
+        - pattern: |
+            function($OBJ) { ... }
+        - pattern-not: |
+            function($OBJ) { ... if (<... $OBJ.origin ...>) { ... } ... }
+        metavariable: $FUNC
+  - patterns:
+    - pattern-either:
+      - pattern-inside: |
+          function $FNAME($OBJ) { $CONTEXT }
+          ...
+      - pattern-inside: |
+          $FNAME = (...) => { $CONTEXT }
+          ...
+    - pattern: |
+        window.addEventListener('message', $FNAME,...)
+    - metavariable-pattern:
+        patterns:
+        - pattern-not: |
+            ... if (<... $OBJ.origin ...>) { ... } ...
+        metavariable: $CONTEXT

.github/security-rules/javascript__browser__security__open-redirect-from-function.yaml

@@ -0,0 +1,58 @@
+rules:
+- id: js-open-redirect-from-function
+  message: >-
+    The application accepts potentially user-controlled input `$PROP` which
+    can control the location of the current window context. This can lead two
+    types of vulnerabilities open-redirection and Cross-Site-Scripting
+    (XSS) with JavaScript URIs. It is recommended to validate
+    user-controllable input before allowing it to control the redirection.
+  metadata:
+    confidence: LOW
+    cwe:
+    - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
+    owasp:
+    - A01:2021 - Broken Access Control
+    - A01:2025 - Broken Access Control
+    asvs:
+      section: V5 Validation, Sanitization and Encoding
+      control_id: 5.5.1 Insecue Redirect
+      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation
+      version: '4'
+    category: security
+    references:
+    - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
+    technology:
+    - browser
+    subcategory:
+    - vuln
+    likelihood: LOW
+    impact: MEDIUM
+  languages:
+  - javascript
+  - typescript
+  severity: INFO
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-inside: |
+        function ... (..., $PROP, ...) { ... }
+    - focus-metavariable: $PROP
+  pattern-sinks:
+  - patterns:
+    - pattern-either:
+      - pattern: location.href = $SINK
+      - pattern: window.location.href = $SINK
+      - pattern: this.window.location.href = $SINK
+      - pattern: this.location.href = $SINK
+      - pattern: location.replace($SINK)
+      - pattern: window.location.replace($SINK)
+      - pattern: this.window.location.replace($SINK)
+      - pattern: this.location.replace($SINK)
+    - focus-metavariable: $SINK
+    - metavariable-pattern:
+        patterns:
+        - pattern-not: |
+            "..." + $VALUE
+        - pattern-not: |
+            `...${$VALUE}`
+        metavariable: $SINK