# Help Scout MCP Server - Semgrep Security Rules
# Self-contained configuration with all rules inline
rules:
# ================================
# Debug Statement Prevention
# ================================
- id: no-console-log-production
patterns:
- pattern: console.log(...)
- pattern-not-inside: |
if ($DEBUG) { ... }
- pattern-not-inside: |
if (process.env.NODE_ENV === 'development') { ... }
message: "Remove console.log statements before production deployment"
severity: WARNING
languages: [javascript, typescript]
fix: ""
- id: no-console-debug-production
patterns:
- pattern-either:
- pattern: console.debug(...)
- pattern: console.trace(...)
- pattern: console.warn(...)
- pattern-not-inside: |
if ($DEBUG) { ... }
message: "Debug statements should be conditional or removed"
severity: WARNING
languages: [javascript, typescript]
- id: no-alert-statements
pattern: alert(...)
message: "Remove alert() statements - use proper user notifications"
severity: ERROR
languages: [javascript, typescript]
- id: no-debugger-statements
pattern: debugger
message: "Remove debugger statements before committing"
severity: ERROR
languages: [javascript, typescript]
fix: ""
# ================================
# Hardcoded Secrets Prevention
# ================================
- id: no-hardcoded-api-keys
patterns:
- pattern-either:
- pattern: |
$KEY = "Bearer $TOKEN"
- pattern: |
$KEY = "sk-$TOKEN"
- pattern: |
apiKey: "$TOKEN"
- pattern: |
api_key = "$TOKEN"
- pattern-not: |
process.env.$VAR
- pattern-not: |
$CONFIG.get($KEY)
message: "API keys should come from environment variables or secure config"
severity: ERROR
languages: [javascript, typescript, python]
- id: no-hardcoded-passwords
patterns:
- pattern-either:
- pattern: |
password = "$PASS"
- pattern: |
passwd = "$PASS"
- pattern: |
pwd = "$PASS"
- pattern-not: |
password = ""
- pattern-not: |
process.env.$VAR
message: "Passwords should never be hardcoded"
severity: ERROR
languages: [javascript, typescript, python]
- id: no-hardcoded-jwt-secrets
patterns:
- pattern-either:
- pattern: |
jwt.sign($PAYLOAD, "$SECRET")
- pattern: |
jwtSecret = "$SECRET"
- pattern: |
JWT_SECRET = "$SECRET"
- metavariable-regex:
metavariable: $SECRET
regex: .{8,}
message: "JWT secrets should come from secure environment variables"
severity: ERROR
languages: [javascript, typescript]
# ================================
# Security Essentials
# ================================
- id: no-eval-usage
patterns:
- pattern-either:
- pattern: eval(...)
- pattern: Function(...)
message: "Avoid eval() and similar functions - major security risk"
severity: ERROR
languages: [javascript, typescript]
- id: no-shell-injection
patterns:
- pattern-either:
- pattern: |
exec($CMD)
- pattern: |
system($CMD)
- pattern: |
os.system($CMD)
- pattern: |
subprocess.call($CMD, shell=True)
- pattern-not: |
$CMD = ["$PROG", ...]
message: "Potential shell injection - use parameterized commands"
severity: ERROR
languages: [javascript, typescript, python]
- id: no-sql-injection-risk
patterns:
- pattern-either:
- pattern: |
$DB.query($SQL + $VAR)
- pattern: |
$DB.execute($SQL + $VAR)
- pattern: |
$CURSOR.execute($SQL + $VAR)
- pattern-not-inside: |
$SQL = "SELECT ... WHERE id = ?"
message: "Potential SQL injection - use parameterized queries"
severity: ERROR
languages: [javascript, typescript, python]
- id: no-prototype-pollution
patterns:
- pattern-either:
- pattern: |
$OBJ["__proto__"] = $VAL
- pattern: |
$OBJ.constructor.prototype = $VAL
- pattern: |
Object.prototype.$KEY = $VAL
message: "Potential prototype pollution vulnerability"
severity: ERROR
languages: [javascript, typescript]
- id: require-https-only
patterns:
- pattern-either:
- pattern: |
"http://$URL"
- pattern: |
http://$URL
- pattern-not: |
"http://localhost"
- pattern-not: |
"http://127.0.0.1"
message: "Use HTTPS instead of HTTP for external URLs"
severity: WARNING
languages: [javascript, typescript, python]
# ================================
# Architectural Integrity
# ================================
- id: no-todo-comments-in-main
patterns:
- pattern-either:
- pattern-regex: ".*TODO.*"
- pattern-regex: ".*FIXME.*"
- pattern-regex: ".*HACK.*"
- pattern-regex: ".*XXX.*"
message: "Address TODO/FIXME comments before merging to main"
severity: WARNING
languages: [javascript, typescript, python, java, go, rust]
- id: no-empty-catch-blocks
patterns:
- pattern-either:
- pattern: |
try { ... } catch ($E) { }
- pattern: |
try { ... } catch ($E) { /* empty */ }
message: "Empty catch blocks hide errors - add logging or handling"
severity: WARNING
languages: [javascript, typescript, python, java]
- id: require-error-handling-async
patterns:
- pattern: |
await $FUNC()
- pattern-not-inside: |
try { ... } catch { ... }
- pattern-not-inside: |
$FUNC().catch(...)
message: "Async operations should have error handling"
severity: WARNING
languages: [javascript, typescript]
- id: no-sync-file-operations
patterns:
- pattern-either:
- pattern: fs.readFileSync(...)
- pattern: fs.writeFileSync(...)
- pattern: fs.existsSync(...)
- pattern-not-inside: |
if (process.env.NODE_ENV === 'test') { ... }
message: "Use async file operations to avoid blocking the event loop"
severity: WARNING
languages: [javascript, typescript]
# ================================
# Help Scout MCP Specific Rules
# ================================
- id: helpscout-api-key-exposure
patterns:
- pattern-either:
- pattern: |
console.$LOG(..., $KEY, ...)
- pattern: |
logger.$LOG(..., $KEY, ...)
- pattern: |
throw new Error($MSG)
- metavariable-regex:
metavariable: $KEY
regex: .*(apiKey|api_key|HELPSCOUT_API_KEY|token|bearer|Bearer).*
- metavariable-regex:
metavariable: $MSG
regex: .*(apiKey|api_key|HELPSCOUT_API_KEY|token|bearer|Bearer).*
message: "Help Scout API keys should never be logged or exposed in errors"
severity: ERROR
languages: [typescript]
- id: helpscout-oauth-secret-hardcoded
patterns:
- pattern-either:
- pattern: HELPSCOUT_APP_SECRET = "$SECRET"
- pattern: clientSecret = "$SECRET"
- pattern: client_secret = "$SECRET"
- pattern-not: process.env.$VAR
- pattern-not: config.get($VAR)
message: "Help Scout OAuth secrets must come from environment variables"
severity: ERROR
languages: [typescript]
- id: helpscout-pii-protection-check
patterns:
- pattern: |
body: $BODY
- pattern-not-inside: |
$CONFIG.allowPII ? $BODY : '[REDACTED]'
- pattern-not-inside: |
if (allowPII) { ... }
- pattern-not-inside: |
allowPII && $BODY
message: "Message bodies must check ALLOW_PII configuration before exposure"
severity: WARNING
languages: [typescript]
paths:
include:
- src/tools/*.ts
- src/resources/*.ts
- id: helpscout-bearer-token-format
patterns:
- pattern: |
Authorization: $TOKEN
- pattern-not: |
Authorization: `Bearer ${$VAR}`
- pattern-not: |
Authorization: this.apiKey
- pattern-not: |
Authorization: $CONFIG.apiKey
message: "Use proper Bearer token format for Help Scout API"
severity: WARNING
languages: [typescript]
- id: helpscout-error-sensitive-data
patterns:
- pattern-either:
- pattern: |
throw new Error(`...$SENSITIVE...`)
- pattern: |
message: `...$SENSITIVE...`
- pattern: |
logger.error(`...$SENSITIVE...`)
- metavariable-regex:
metavariable: $SENSITIVE
regex: .*(api.*key|secret|token|password|bearer|oauth).*
message: "Don't include sensitive Help Scout data in error messages"
severity: ERROR
languages: [typescript]
- id: helpscout-pii-logging-prevention
patterns:
- pattern-either:
- pattern: |
console.log($DATA.body)
- pattern: |
logger.$METHOD($DATA.body)
- pattern: |
console.log($THREAD)
- pattern: |
logger.$METHOD($THREAD)
- metavariable-regex:
metavariable: $DATA
regex: .*(conversation|thread|message).*
- metavariable-regex:
metavariable: $THREAD
regex: .*(thread|message|body).*
message: "Don't log Help Scout conversation/thread data - may contain PII"
severity: ERROR
languages: [typescript]
- id: helpscout-oauth-callback-validation
patterns:
- pattern: |
$CODE = req.query.code
- pattern-not-inside: |
if (!$CODE) { ... }
- pattern-not-inside: |
if (typeof $CODE !== 'string') { ... }
message: "Validate OAuth callback parameters before use"
severity: WARNING
languages: [typescript]
- id: helpscout-token-storage-security
patterns:
- pattern-either:
- pattern: |
localStorage.setItem($KEY, $TOKEN)
- pattern: |
sessionStorage.setItem($KEY, $TOKEN)
- pattern: |
$OBJ[$KEY] = $TOKEN
- metavariable-regex:
metavariable: $TOKEN
regex: .*(token|key|secret|bearer).*
- metavariable-regex:
metavariable: $KEY
regex: .*(token|key|secret|bearer).*
message: "Help Scout tokens should be stored securely (encrypted, server-side)"
severity: ERROR
languages: [typescript]
