codelaw-rules-security-python

The rules are reimplementations written for codelaw. Rules ported from
Bandit (https://bandit.readthedocs.io/, Apache-2.0, Copyright (c) PyCQA and
the Bandit contributors) and from Ruff's `S` rules (https://docs.astral.sh/ruff/,
MIT License, Copyright (c) 2022 Charles Marsh) name their source check in
`ported_from:` (`bandit/Bnnn`, `ruff/Snnn`) and reproduce its documented
behaviour: the matchers, messages, examples and fixes are written fresh, and
no code or documentation text from either tool is included. The README lists
every Bandit check with where it went, or why it was not ported.

The CWE identifiers are MITRE's (https://cwe.mitre.org/) and the category
names are the OWASP Top 10:2025's (https://owasp.org/Top10/), used as
references only.

Rule sets under a copyleft or source-available licence — eslint-plugin-no-unsanitized
(MPL-2.0), njsscan (LGPL-3.0), Semgrep's rules (the Semgrep Rules License) — are
read for ideas only; no text, pattern or code is taken from them (L2). CodeQL's
query list (MIT) was read for ideas and nothing was copied.
