Java Security Rules
Blocks on an agent's file writes and at turn end.
Acts on
File write · Turn end
When
Before the file write · at turn end
Tested
167 of 177 pass
In a git repo
At commit
What it does
Trigger: writing Java or Kotlin (Spring, Jakarta EE, Quarkus, Android), SQL/JPA/MyBatis, templates, application.properties/.yml, web.xml, pom.xml, Gradle; "customize java security" opens the guided page. avoid: injection, XXE, SSRF, unsafe deserialization, path traversal, weak crypto, trust-all TLS, Spring Security off, exposed secrets, known-exploited deps, SpotBugs/Sonar/PMD/Checkstyle findings. 129 rules, 16 packs, each allow|deny|ask in .chock/security.json; absent = deny (quality: allow).
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedBlocks Blocks on an agent's file writes and at turn endBuild →
- Cursor TestedBlocks Blocks on an agent's file writes and at turn endBuild →
- Codex TestedBlocks Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- GitHub Copilot TestedBlocks Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- Devin TestedBlocks Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
See it in action
Refused
A MyBatis mapper orders by a column taken from the request, written as ORDER BY ${col}.
Allowed
A MyBatis mapper binds a parameter as WHERE id =
Both examples are this policy's own test cases.
What it misses
This policy does not state what it misses.
Latest change
0.7.0 · · Owner-approved loosening (plan decision D2, roadmap 4.5 #11): a rule no selection speaks for now takes its pack's tier default. The nine security packs (79 rules) still deny; the seven quality packs -- bugs, concurrency, resources, exceptions, performance, style, testing (50 rules) -- now allow, so a legacy file's existing quality findings no longer refuse an edit. A pack kind with no written default, or a pack this build lacks, denies. A verdict a selection file spells keeps its value; only silence changed meaning. A file that spells every rule (what the setup page wrote when nothing was unticked) reads exactly as before. A rule a file leaves unspoken now takes its tier's default: that includes every quality rule in a version-1 file, which predates the quality packs, and any quality row someone unticked on the page (shown then as unspoken -> deny). Such a file now allows those quality rules. To keep enforcing a quality pack, spell it: {"version": 2, "packs": {"exceptions": {"verdict": "deny"}}}. The description says absent = deny (quality: allow), its wording shortened to stay within the 500-char budget. The setup page preselects each rule's pack default (from the pack's kind). It marks a row weakened when its verdict (an unticked row: the pack default it falls to) is weaker than the stricter of that default and the repository's current selection, and it leaves a quality rule at allow unspoken unless something stricter stood before. Not yet mirrored by the engine: chock's check-baseline and chock_guidance still read a silent quality rule as deny. Deleting a quality pack's entry from a committed selection is therefore not reported as a loosening, and guidance may name a quality rule that no longer enforces. Security rules are unaffected: silence denies them in both. Known limit: an empty catch around a security check (checkServerTrusted, parseClaimsJws, verify) was refused only by the quality rule exceptions-empty-catch, so with no selection it now passes; spell the exceptions pack as deny to keep that refusal.