Would it be useful or easier to plug in if these were rules developed for platforms such as Semgrep? It looks like they already have an existing nginx ruleset: https://semgrep.dev/p/nginx.

They can always use some extra contributions, and would slot into existing tooling within a pipeline.