agentic-security:add-scan-rule

To add a new SAST detector, follow a six-step process covering language-specific detectors, framework hardening, and cross-cutting vulnerabilities, including wiring the detector into the engine and validating it with fixtures and tests.

Wiring a SAST detector into the scanning engine requires exporting a scan function, integrating it into engine.js, creating validation fixtures, and running existing tests to confirm the setup.

New SAST rules should be placed in language-specific detectors, framework hardening modules, cross-cutting vulnerability classes, or posture annotators, following the required file patterns for each category.

Yes, creating fixtures and tests is a required step to validate the behavior of a new SAST detector and ensure the new scanning rule integrates correctly without breaking existing test suites.

Yes, the SAST detector workflow supports cross-cutting vulnerability patterns alongside language-specific rules and framework hardening, enabling broad security coverage within the scanner.

The best way to validate a new SAST detector is by running the existing test suite against the newly created fixtures to ensure the exported scan function behaves correctly within the engine.