Rule catalog

Version 2026.10.1

ID	Title	Category	Level	Condition
R-001	Credential literal in source	security	critical	A password, API key, access token or private key is written as a literal in source code.
R-002	Secret exposed to the client bundle	security	critical	A secret value is placed in a variable or module that is shipped to the browser.
R-003	Code execution on external input	security	critical	Input from a request, message, file or environment reaches eval, new Function, a shell command, or dynamic module loading.
R-004	Query built from external input	security	critical	A database query string is assembled from external input without parameter binding.
R-005	Authenticated handler without an authorization check	security	attention	A request handler verifies who the caller is but not whether the caller may access the requested resource.
R-006	Permissive CORS on an endpoint returning user data	security	attention	An endpoint that returns user-specific data allows requests from any origin.
R-007	Webhook accepted without signature verification	security	attention	A webhook endpoint processes a payload without verifying its signature.
R-008	Storage bucket without access control	security	attention	A storage bucket or object is created or configured as publicly readable or writable.
R-009	Table access without row-level policy in client-side database code	security	attention	Client-side code reads or writes a database table directly and the repository defines no row-level policy for that table.
R-010	File path built from external input	security	attention	A filesystem path is built from external input without restricting it to an allowed directory.
R-011	Sensitive value written to logs	security	warning	A credential, token or personal data value is written to a log.
R-012	Instructions to automated reviewers in repository content	security	attention	Repository content contains text that instructs automated reviewers or AI tools to change their behaviour.
R-013	Identifier used but not declared or imported	correctness	attention	A function or value is referenced in a file where it is neither declared nor imported.
R-014	Access to a possibly absent value without a guard	correctness	attention	A value that can be null, undefined or empty is dereferenced without a check.
R-015	Promise neither awaited nor handled	correctness	warning	A promise-returning call is neither awaited, returned, nor given a rejection handler.
R-016	Error caught and discarded	correctness	warning	A caught error is discarded without being rethrown, returned, or recorded.
R-017	Check-then-act on shared state	correctness	warning	Code reads shared state, decides on it, and writes it back in separate steps that can interleave with other executions.
R-018	Outbound network call without a timeout	reliability	warning	An outbound HTTP or network call is made with no timeout or abort signal.
R-019	External input used without validation at the trust boundary	reliability	warning	Request, message or file input is used without schema or type validation at the point it enters the system.
R-020	Public endpoint without rate limiting	reliability	info	A public, unauthenticated endpoint that triggers expensive or sensitive work has no rate limit.
R-021	Environment-specific value hard-coded	reliability	info	A URL, host, port, account id or similar environment-specific value is hard-coded in application code.
R-022	Type assertion that bypasses the type checker	types	warning	A value is cast with any, as unknown as, or a non-null assertion across a module or data boundary.
R-023	Exported function without parameter or return types	types	info	An exported function has parameters or a return value whose type is implicitly any.
R-024	Database query inside a loop	performance	warning	A database query is executed once per iteration of a loop over a collection.
R-025	Dependency against the declared layer direction	architecture	warning	A module in an inner layer imports a module from an outer layer, against the dependency direction the project declares.
R-026	Call site does not match the callee contract	architecture	attention	A caller passes arguments or reads results in a shape that differs from the callee's current signature or return type.