SG-099: Destructive Filesystem Wipe
Severity: MEDIUM
rm -rf of home/root/user-data, shred of files, find -exec destruction, or dd over a raw device
Fires when
- rm -rf targeting the filesystem root, the home directory, or personal user-data dirs (Documents/Desktop/Pictures/...), not build/cache dirs.
- Silent destruction of user data via `mv ... /dev/null`, or find -exec shred / rm -r rooted at home/user data.
- git clean -xfd removing all untracked files, or dd overwriting a raw block device (/dev/sda, /dev/nvme0).
- A classic fork bomb.
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.