# Security Rule Reference for Pilot Calibration

| Category | CWE | Evaluation evidence | Pilot action | Safe control |
|---|---|---|---|---|
| SQL injection | CWE-89 | Detected | Parameterize queries; block confirmed reachable cases | Parameterized query |
| OS command injection | CWE-78 | Detected | Remove shell construction; allowlist arguments | Fixed executable + argument array |
| Path traversal | CWE-22 | Detected | Constrain resolved path to approved root | Constant/validated internal path |
| Dynamic code execution | CWE-94 | Detected | Replace `eval`/`exec` with explicit parser | Fixed non-executable expression logic |
| Hard-coded credentials | CWE-798 | Detected | Remove, rotate, and use secret manager | Ordinary non-secret string |
| Resource leak | CWE-404 | Detected | Guarantee cleanup/context management | Context-managed resource |

Severity and blocking policy must use the active MetaSolve ruleset plus organization context. Do not infer compliance or exploitability solely from the CWE identifier.

For each rule record analyzer version, ruleset version, language/parser, positive fixture, negative fixture, severity, owner, reviewer, and last calibration date.