What unverified means
A rule is unverified when it has only ever fired on its own example file, on the planted example app or on this tool's own source, and never on a real project or an outside sample. 44 rules are in that state, and all of them are marked below.
Verified does not mean flawless. It says the rule has worked on at least one real project.
In a browser
93 rules are on by default. 4 of them cannot run without a .git folder; the rest all run in a browser. 2 rules are off by default: one needs the network, and one was switched off because it caught nothing when measured. The 7 experimental scale rules are not on this site.
| Rule | Group | Evidence | In a browser | Default |
|---|---|---|---|---|
| ai-risk/assistant-config-tracked | AI-assisted development risk | Verified | Only with a .git folder | On |
| ai-risk/comment-code-imbalance | AI-assisted development risk | Unverified | Runs | On |
| ai-risk/competing-patterns | AI-assisted development risk | Unverified | Runs | On |
| ai-risk/inconsistent-error-shape | AI-assisted development risk | Unverified | Runs | On |
| ai-risk/orphaned-file | AI-assisted development risk | Verified | Runs | On |
| ai-risk/placeholder-in-production-path | AI-assisted development risk | Unverified | Runs | On |
| ai-risk/redundant-implementation | AI-assisted development risk | Verified | Runs | On |
| ai-risk/unfinished-work-accumulation | AI-assisted development risk | Unverified | Runs | On |
| architecture/circular-dependency | Architecture | Unverified | Runs | On |
| architecture/db-in-client-layer | Architecture | Unverified | Runs | On |
| architecture/god-module | Architecture | Verified | Runs | On |
| architecture/hub-module | Architecture | Unverified | Runs | On |
| dependencies/floating-version | Dependencies | Unverified | Runs | On |
| dependencies/known-vulnerability | Dependencies | Unverified | Runs | Off (--online) |
| dependencies/missing-lockfile | Dependencies | Verified | Runs | On |
| dependencies/unused | Dependencies | Verified | Runs | On |
| devops/docker-runs-as-root | Deployment and config | Verified | Runs | On |
| devops/docker-unpinned-base-image | Deployment and config | Unverified | Runs | On |
| devops/error-details-leaked | Deployment and config | Verified | Runs | On |
| devops/production-source-maps | Deployment and config | Unverified | Runs | On |
| documentation/incomplete-readme | Documentation | Verified | Runs | On |
| documentation/missing-readme | Documentation | Verified | Runs | On |
| missing/authorization-check | Missing safeguards | Verified | Runs | On |
| missing/ci-pipeline | Missing safeguards | Verified | Only with a .git folder | On |
| missing/ci-security-scan | Missing safeguards | Verified | Runs | On |
| missing/database-index | Missing safeguards | Verified | Runs | On |
| missing/env-example | Missing safeguards | Verified | Runs | On |
| missing/error-handling | Missing safeguards | Verified | Runs | On |
| missing/input-validation | Missing safeguards | Verified | Runs | On |
| missing/network-timeout | Missing safeguards | Verified | Runs | On |
| missing/rate-limiting | Missing safeguards | Verified | Runs | On |
| missing/security-headers | Missing safeguards | Verified | Runs | On |
| performance/async-foreach | Performance | Unverified | Runs | On |
| performance/blocking-sync-io | Performance | Verified | Runs | On |
| performance/n-plus-one-query | Performance | Unverified | Runs | On |
| performance/sequential-awaits | Performance | Unverified | Runs | On |
| performance/unawaited-map | Performance | Unverified | Runs | On |
| performance/unbounded-cache | Performance | Verified | Runs | On |
| performance/unbounded-query | Performance | Verified | Runs | On |
| quality/duplicated-block | Code quality | Verified | Runs | On |
| quality/hardcoded-fallback-connection | Code quality | Unverified | Runs | On |
| quality/hardcoded-user-path | Code quality | Unverified | Runs | On |
| quality/high-cognitive-complexity | Code quality | Verified | Runs | On |
| quality/large-file | Code quality | Verified | Runs | On |
| quality/long-function | Code quality | Verified | Runs | On |
| quality/tangled-function | Code quality | Verified | Runs | On |
| quality/too-many-parameters | Code quality | Verified | Runs | On |
| secrets/anthropic-key | Secrets | Unverified | Runs | On |
| secrets/aws-access-key | Secrets | Verified | Runs | On |
| secrets/aws-secret-key | Secrets | Verified | Runs | On |
| secrets/database-url | Secrets | Unverified | Runs | On |
| secrets/env-fallback-literal | Secrets | Verified | Runs | On |
| secrets/env-file-committed | Secrets | Unverified | Only with a .git folder | On |
| secrets/env-not-ignored | Secrets | Unverified | Only with a .git folder | On |
| secrets/github-token | Secrets | Verified | Runs | On |
| secrets/google-api-key | Secrets | Unverified | Runs | On |
| secrets/hardcoded-credential | Secrets | Verified | Runs | On |
| secrets/npm-token | Secrets | Unverified | Runs | On |
| secrets/openai-key | Secrets | Unverified | Runs | On |
| secrets/private-key | Secrets | Unverified | Runs | On |
| secrets/public-env-prefix-on-secret | Secrets | Unverified | Runs | On |
| secrets/sendgrid-key | Secrets | Unverified | Runs | On |
| secrets/server-secret-in-client-file | Secrets | Unverified | Runs | On |
| secrets/slack-token | Secrets | Unverified | Runs | On |
| secrets/slack-webhook | Secrets | Unverified | Runs | On |
| secrets/stripe-restricted-key | Secrets | Unverified | Runs | On |
| secrets/stripe-secret-key | Secrets | Verified | Runs | On |
| secrets/supabase-service-role | Secrets | Unverified | Runs | On |
| secrets/twilio-key | Secrets | Unverified | Runs | On |
| secrets/vercel-token | Secrets | Unverified | Runs | On |
| security/command-injection | Security | Verified | Runs | On |
| security/cors-credentials-wildcard | Security | Verified | Runs | On |
| security/csrf-missing | Security | Unverified | Runs | On |
| security/dangerous-eval | Security | Verified | Runs | On |
| security/debug-enabled | Security | Unverified | Runs | On |
| security/file-upload | Security | Verified | Runs | On |
| security/idor-unscoped-query | Security | Unverified | Runs | Off (--experimental-idor) |
| security/insecure-cookie | Security | Verified | Runs | On |
| security/insecure-randomness | Security | Verified | Runs | On |
| security/insecure-transport | Security | Unverified | Runs | On |
| security/jwt-decode-without-verify | Security | Unverified | Runs | On |
| security/path-traversal | Security | Verified | Runs | On |
| security/sensitive-logging | Security | Verified | Runs | On |
| security/sql-injection | Security | Verified | Runs | On |
| security/ssrf | Security | Verified | Runs | On |
| security/supabase-rls | Security | Unverified | Runs | On |
| security/unsafe-deserialization | Security | Unverified | Runs | On |
| security/verify-disabled | Security | Unverified | Runs | On |
| security/weak-hash | Security | Verified | Runs | On |
| security/xss-dangerous-html | Security | Verified | Runs | On |
| security/xss-inner-html | Security | Verified | Runs | On |
| security/xss-reflected | Security | Verified | Runs | On |
| testing/critical-path-untested | Testing | Verified | Runs | On |
| testing/no-tests | Testing | Verified | Runs | On |
| testing/weak-assertions | Testing | Unverified | Runs | On |