Policies
Java Security Rules
Java Security Rules: what it does, its label on each agent, what it misses, and examples.
Catalog policy java-security, version 0.7.0, labelled blocks on Claude Code.
What it does
Trigger: writing Java or Kotlin (Spring, Jakarta EE, Quarkus, Android), SQL/JPA/MyBatis, templates, application.properties/.yml, web.xml, pom.xml, Gradle; "customize java security" opens the guided page. avoid: injection, XXE, SSRF, unsafe deserialization, path traversal, weak crypto, trust-all TLS, Spring Security off, exposed secrets, known-exploited deps, SpotBugs/Sonar/PMD/Checkstyle findings. 129 rules, 16 packs, each allow|deny|ask in .chock/security.json; absent = deny (quality: allow).
On each agent
| Agent | Label | What it does there |
|---|---|---|
| Claude Code | Blocks | Blocks on an agent's file writes and at turn end |
| Cursor | Blocks | Blocks on an agent's file writes and at turn end |
| Codex | Blocks | Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| GitHub Copilot | Blocks | Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| Devin | Blocks | Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed) |
| Grok | Not graded | Not graded yet for Grok |
| goose | Not graded | Not graded yet for goose |
| Antigravity | Not graded | Not graded yet for Antigravity |
| OpenHands | Not graded | Not graded yet for OpenHands |
| Kimi Code | Not graded | Not graded yet for Kimi Code |
| Factory Droid | Not graded | Not graded yet for Factory Droid |
What it misses
This policy does not state what it misses.
Examples from its eval suite
Refused: A MyBatis mapper orders by a column taken from the request, written as ORDER BY ${col}.
Allowed: A MyBatis mapper binds a parameter as WHERE id =
More
Built from engine 5a4b6287a46e and catalog 1e60d211c1bb.