Audit and narrow overly broad detection rules with comprehensive test coverage#635

Open

Copilot wants to merge 8 commits into

mainfrom

copilot/audit-default-rules

Commits on Feb 14, 2026

Initial plan
Copilot
committed
Phase 1: Fix critical performance issues in rules

Copilot
and
gfs
committed
Phase 2: Improve pattern precision for authentication and RSA

Copilot
and
gfs
committed
Phase 3: Improve serialization and device detection patterns

Copilot
and
gfs
committed
Address code review feedback: simplify patterns and improve consistency

Copilot
and
gfs
committed
Add must-match and must-not-match test cases to improved rules

Copilot
and
gfs
committed
Fix test cases to validate correctly against rule patterns

Copilot
and
gfs
committed
Fix schema validation: capitalize severity, type, confidence, and scope values

Copilot
and
gfs
committed