Custom Rules

Overview

Custom rules let you define security policies in natural language that ZeroPath evaluates during full scans across your selected repositories. Instead of writing complex pattern-matching rules, describe what you want to check and ZeroPath’s AI applies it across your codebase.

Creating Rules

From the Dashboard

Navigate to Rules in the ZeroPath dashboard and select the Custom Rules tab.
Click “Add Rule”.
Give the rule a descriptive name.
Write your rule in natural language. For example:
- “Flag any API endpoint that returns user email addresses without the caller having admin scope”
- “Find logging statements that include request bodies which may contain passwords or tokens”
- “Check that all database queries use parameterized queries instead of string concatenation”
The rule editor includes clickable example rules you can use as a starting point.
Optionally set a file scope using a glob pattern (e.g., src/api/**, *.py) to limit the rule to specific files. The default is all files.
Choose the repository scope: apply the rule to all repositories (including any added in the future) or select specific repositories. You can also assign tags to organize your rules.
Save the rule.

From the API

Rules can be managed via the v2 API:

# Create a rule scoped to specific repositories
curl -X POST https://zeropath.com/api/v2/rules/create \
  -H "Content-Type: application/json" \
  -H "X-ZeroPath-API-Token-Id: your-token-id" \
  -H "X-ZeroPath-API-Token-Secret: your-token-secret" \
  -d '{
    "organizationId": "your-org-id",
    "name": "Require Auth on API Endpoints",
    "description": "All API endpoints must require authentication",
    "rule": "All API endpoints must require authentication before processing requests",
    "repositoryIds": ["repo-id-1", "repo-id-2"]
  }'

To apply a rule to all repositories in the organization, pass allRepositories: true instead of repositoryIds:

# Create a rule that applies to all repositories
curl -X POST https://zeropath.com/api/v2/rules/create \
  -H "Content-Type: application/json" \
  -H "X-ZeroPath-API-Token-Id: your-token-id" \
  -H "X-ZeroPath-API-Token-Secret: your-token-secret" \
  -d '{
    "organizationId": "your-org-id",
    "name": "No Hardcoded Secrets",
    "rule": "No hardcoded credentials or API keys in source code",
    "allRepositories": true
  }'

To scope a rule to all repositories with specific tags, use scope: "tags" with tagIds:

# Create a rule scoped to repositories with specific tags
curl -X POST https://zeropath.com/api/v2/rules/create \
  -H "Content-Type: application/json" \
  -H "X-ZeroPath-API-Token-Id: your-token-id" \
  -H "X-ZeroPath-API-Token-Secret: your-token-secret" \
  -d '{
    "organizationId": "your-org-id",
    "name": "Require Auth on Internal APIs",
    "rule": "All internal API endpoints must require authentication",
    "scope": "tags",
    "tagIds": ["tag-id-1", "tag-id-2"]
  }'

You can also use the explicit scope parameter ("allRepositories", "repositories", or "tags") on any create or update request to make the intended scope unambiguous:

# Explicitly set scope to all repositories
curl -X POST https://zeropath.com/api/v2/rules/create \
  -d '{ "scope": "allRepositories", ... }'

# Explicitly set scope to specific repositories
curl -X POST https://zeropath.com/api/v2/rules/create \
  -d '{ "scope": "repositories", "repositoryIds": ["repo-id-1"], ... }'

You cannot combine allRepositories and repositoryIds in the same request. Use one or the other when creating or updating a rule. When using scope: "tags", do not pass repositoryIds or allRepositories.

How Rules Are Evaluated

During each scan, ZeroPath:

Identifies applications in your repository (services, modules, entry points).
Evaluates each custom rule against every application in context.
Reports violations as findings alongside SAST, SCA, and other results.

Custom rule violations appear in the same findings stream as other scan results — with severity, confidence, affected file, and remediation guidance.

Rule Scope

Rules can be scoped at different levels:

Scope	Applies To
Organization	All repositories in the organization
Tag	All repositories with a specific tag
Repository	A single repository

Organization-scoped rules automatically apply to newly added repositories without any manual update. Tag-scoped rules automatically apply to every repository that belongs to the selected tags, and access updates dynamically as repositories join or leave a tag. When you list rules via the API, each rule includes a scope field ("allRepositories", "repositories", or "tags") indicating how it is scoped. Rules follow the same org → tag → repo inheritance cascade as scanner settings. Repository-level rules supplement (not replace) org and tag-level rules.

Managing Rules

From the dashboard or API, you can:

List all rules for your organization — rules that apply to all repositories display “All Repositories”, and tag-scoped rules display the number of assigned tags (e.g., “2 Tags”) instead of a numeric repository count
View a rule’s definition, scope, and metadata. Each rule includes a source field indicating its origin: rules you create manually have the source USER, while rules auto-generated by the Security Compass integration have the source SECURITY_COMPASS
Update a rule’s name, description, natural language definition, or scope (pass allRepositories: true to apply to all repos, or repositoryIds to scope to specific repos)
Delete rules that are no longer needed. If a rule is deleted while a scan is in progress, findings from that rule are preserved — the association to the deleted rule is cleared, but the findings themselves remain in your results

Custom Rules Only Mode

For organizations or repositories that want to run only their custom rules, enable the Custom rules only toggle in your scanner settings. When enabled, ZeroPath disables all built-in scanning modules — including SAST, SCA, IaC, Secrets, and EOL — and evaluates only your custom natural-language rules against identified sources. This setting can be configured at the organization, tag, or individual repository level, following the standard settings inheritance cascade.

Rule Packs

In addition to custom rules, ZeroPath offers Rule Packs — curated bundles of pre-built rules published by ZeroPath that target common security patterns and compliance requirements. You can browse available rule packs from the Rule Packs tab on the Rules page and enable the ones relevant to your organization. Rule packs supplement your custom rules. When a rule pack is enabled, its rules are evaluated during scans alongside any custom rules you have defined.

Security Compass Rules

If your organization has the Security Compass integration enabled, a Security Compass tab appears on the Rules page. This tab lists all rules that were automatically generated from SD Elements countermeasures during a rule sync — distinct from rules you create manually. Within the Custom Rules tab, any rule sourced from the Security Compass integration displays a badge next to its name so you can identify auto-generated rules at a glance. You can open, view, and edit these rules the same way as any other custom rule. To manage the Security Compass integration or trigger a rule sync, go to Settings → Integrations → Security Compass. See Security Compass / SD Elements for the full workflow.

Best Practices

Be specific — “All API endpoints must validate the user’s session token before processing” is better than “APIs should be secure”.
One policy per rule — create separate rules for separate concerns so violations are actionable.
Start broad, then refine — begin with high-level policies and add detail based on the violations you see.
Use tags for team-specific rules — different teams may have different security requirements; scope rules using tags.

Getting Started

Scanning

SCA

Platform

Developer Tools

Integrations

Authentication

Overview

Creating Rules

From the Dashboard

From the API

How Rules Are Evaluated

Rule Scope

Managing Rules

Custom Rules Only Mode

Rule Packs

Security Compass Rules

Best Practices

​Overview

​Creating Rules

​From the Dashboard

​From the API

​How Rules Are Evaluated

​Rule Scope

​Managing Rules

​Custom Rules Only Mode

​Rule Packs

​Security Compass Rules

​Best Practices

Overview

Creating Rules

From the Dashboard

From the API

How Rules Are Evaluated

Rule Scope

Managing Rules

Custom Rules Only Mode

Rule Packs

Security Compass Rules

Best Practices