CODYGIENE

Known Limitations

CODYGIENE is transparent about what it can and cannot do. Known limitations increase trust and help you interpret results correctly.

Analysis scope

  • Syntax-oriented TypeScript analysis · CODYGIENE parses TypeScript syntax but does not perform full TypeScript type checking. Type-level issues are not detected.
  • No code execution · CODYGIENE does not run your code. Runtime behavior, side effects, and dynamic dispatch are not analyzed.
  • No database connection · CODYGIENE does not connect to your database. Query plans, runtime cardinality, and index usage are not available.
  • Same-function data flow · CAND-025 (open redirect) traces request-derived values within the same function. Inter-function data flow is not traced.

Framework and ORM support

  • Kysely · not yet supported
  • TypeORM · not yet supported
  • Other ORMs · only Prisma and Drizzle are supported for ORM-specific analysis
  • Other SQL databases · PostgreSQL/Supabase are the primary focus; MySQL, SQLite, and others have limited SQL migration analysis

Security analysis

  • Auth/authorization · CODYGIENE detects auth signals (getUser, getSession, etc.) but does not prove authentication or authorization is correct. Absence of a signal does not prove unauthenticated behavior.
  • IDOR · deferred. Detecting IDOR requires data-flow analysis beyond current capabilities.
  • CORS · deferred. Access-Control-Allow-Origin: * is intentionally used by many APIs. Insufficient static signal for deterministic detection.
  • Rate limiting (CAND-012) · reserved. Cannot prove absence locally; controls may exist in reverse proxy, CDN, or infrastructure.

Rule-specific limitations

  • CAND-025 · Only detects same-function source-to-sink flow. Complex expressions (ternary, spread, destructuring) may not be fully traced.
  • CAND-020 · Dynamic require() detection resolves local bindings (functions, imports, methods, parameters named require) to avoid false positives, but suppression is file-level rather than fully scope-aware. A file that both defines a local require binding and uses the real CommonJS loader may have the genuine use suppressed.
  • CAND-026 · Flags privileged side effects in inbound webhook handlers that lack a preceding verification call (e.g. constructEvent, HMAC/signature checks). Verification-flow awareness is bounded to the same file: helpers invoked after a verification call are treated as verified, and handler-local sinks require preceding verification. Cross-file helpers use conservative fallback behavior · verification performed in another file may not be recognized, and receivers without identifiable inbound-handler or webhook signals are not analyzed. Whole-program or cross-file verification analysis is not performed.
  • CAND-024 · Short association window for fetch-all-then-filter detection. Complex control flow may not be fully modeled.
  • CAND-010 · Conservative cardinality heuristics. Cannot determine actual row counts without runtime data.
  • CAND-023 · 3 residual false positives in drizzle-seed (library tool). Application scanning is unaffected.

Migration reconstruction

  • SQL migration reconstruction is best-effort. Complex migration patterns, dynamic DDL, and non-standard migration frameworks may not be fully reconstructed.
  • FK and unique-constraint extraction depends on explicit DDL. Implicit constraints are not detected.

What CODYGIENE is not

  • Not a complete security verification tool
  • Not a runtime vulnerability scanner
  • Not an all-language linter
  • Not a cloud-based analysis service
  • Not an AI-powered auto-fixer

CODYGIENE reports what it can determine from static, deterministic analysis of your source code. Findings should be reviewed by a developer who understands the application context.