Rules and Scope

CODYGIENE ships with 70 registered rules across four categories. Of these, 64 are enabled by default and 6 are disabled by default (opt-in only).

Rule families

CH-* · Frozen Ruleset 1.0.0 rules (44 rules). Stable, production-ready.
CAND-* · Alpha candidate rules (26 rules). Most are enabled by default; two (CAND-030, CAND-031) are disabled by default pending metric validation.

The following rules are disabled by default to reduce noise on typical projects. They can be enabled with --enable or in .codygiene.json:

Rule ID	Reason
CH-HEALTH-004	Unreachable source file · high volume in many projects
CH-HEALTH-005	Unused export · high volume in many projects
CH-HEALTH-007	Undeclared package import · often intentional in monorepos
CH-HEALTH-008	Duplicated logic · can be noisy on large codebases
CAND-030	Excessive coupling · metric pending validation on diverse repos
CAND-031	Architectural hotspot · size threshold needs validation

ID	Severity	Description
CH-SEC-001	high	Dangerous eval() usage
CH-SEC-002	high	Function constructor used to create code from strings
CH-SEC-003	critical	Potential secret exposed via NEXT_PUBLIC_ env variable
CH-SEC-004	critical	Supabase service credential reachable from client-side code
CH-SEC-005	high	dangerouslySetInnerHTML with a dynamic value
CH-SEC-006	high	Table referenced in code without RLS enabled
CH-SEC-007	high	RLS policy with USING(true) or WITH CHECK(true) on non-public tables
CH-SEC-008	medium	INSERT/UPDATE RLS policy without a WITH CHECK expression
CH-SEC-009	critical	Service-role Supabase client in a route handler processing user input
CH-SEC-010	high	Route handler uses params to look up a resource without ownership constraint
CH-SEC-011	high	Mutation handler without an identifiable auth check
CH-SEC-012	medium	select("*") on a table that may contain sensitive columns
CH-SEC-013	medium	Redirect target derived from user input without validation
CH-SEC-014	high	Server-side fetch with a user-controlled URL target
CH-SEC-015	high	Filesystem path constructed from user input without containment

ID	Severity	Description
CAND-001	medium	Sensitive data (tokens, secrets, passwords) in log output
CAND-002	high	Webhook trusts caller-supplied metadata as organization identity
CAND-003	high	URL constructed from untrusted request Host header
CAND-004	high	HTTP header injection via unsanitized request input
CAND-005	high	Filter-string injection in Supabase/PostgREST raw filter methods
CAND-006	high	Shell command execution with string interpolation
CAND-007	high	Browser-role GRANT EXECUTE on SECURITY DEFINER function
CAND-008	high	Cross-table tenant integrity gap
CAND-009	high	SQL TOCTOU / missing lock in PLpgSQL functions
CAND-011	medium	Unbounded SQL array/JSON processing in functions
CAND-019	critical	Potential secret exposed via VITE_/REACT_APP_/PUBLIC_ env prefix
CAND-020	high	Dynamic require() with non-literal module path
CAND-021	high	SECURITY DEFINER function with unsafe search_path
CAND-022	high	Dynamic SQL inside privileged functions
CAND-023	high	Unsafe raw ORM query construction (Prisma/Drizzle)
CAND-025	high	Request-derived open redirect
CAND-026	high	Unverified webhook side effect

ID	Severity	Description
CH-PERF-001	medium	Database query executed inside a loop (potential N+1)
CH-PERF-002	medium	Network request executed inside a loop
CH-PERF-003	medium	Sequential independent await operations that could run concurrently
CH-PERF-004	high	Potential N+1 database query pattern
CH-PERF-005	low	Repeated identical database query within the same function
CH-PERF-006	low	Repeated identical network request within the same function
CH-PERF-007	medium	Synchronous blocking operation in a request handler path
CH-PERF-008	medium	Excessive client boundary causing large client-reachable graph
CH-PERF-011	low	useEffect with unstable constructed dependency

ID	Severity	Description
CAND-010	medium	Unbounded database query on growing table (Supabase/Prisma/Drizzle)
CAND-024	medium	Fetch-all then filter/sort in JavaScript

ID	Severity	Enabled	Description
CH-HEALTH-001	medium	Yes	Oversized function (many statements or lines)
CH-HEALTH-002	low	Yes	Oversized file (many effective lines)
CH-HEALTH-003	medium	Yes	Circular dependency detected in the import graph
CH-HEALTH-004	low	No	Source file not reachable from any known entrypoint
CH-HEALTH-005	low	No	Exported symbol not used by any reachable file
CH-HEALTH-006	low	Yes	Dependency declared in package.json but not imported
CH-HEALTH-007	medium	No	Package imported but not declared in package.json
CH-HEALTH-008	medium	No	Functions with high structural similarity (duplicated logic)
CH-HEALTH-009	medium	Yes	Function with excessive cyclomatic complexity
CH-HEALTH-010	low	Yes	Function with excessive nesting depth
CH-HEALTH-011	medium	Yes	Module that accumulates multiple risk signals (hotspot)
CH-HEALTH-012	low	Yes	Suspicious cross-layer dependency (e.g. domain importing UI)
CH-HEALTH-014	medium	Yes	Exception caught and silently swallowed

ID	Severity	Enabled	Description
CAND-027	medium	Yes	Unsafe type-safety escape (`as any`, unsafe casts) in high-risk production logic
CAND-028	medium	Yes	Type-check suppression (`@ts-ignore`/`@ts-nocheck`) in production code
CAND-029	medium	Yes	High change blast radius: module with top-percentile transitive dependents (architecture insight)
CAND-030	medium	No	Excessive coupling: module with top-percentile fan-out (disabled experimental · metric pending validation)
CAND-031	medium	No	Architectural hotspot: high fan-in combined with large implementation (disabled experimental · metric pending validation)
CAND-032	high	Yes	Workspace dependency cycle detected (architecture insight)
CAND-033	medium	Yes	Cross-workspace dependency risk: app-to-app internal imports (architecture insight)

Findings marked (architecture insight) have findingClass: "insight" · see Understanding Results for what that means.

ID	Severity	Description
CH-AIQ-001	low	Redundant pass-through abstraction chain
CH-AIQ-002	medium	Multiple independently maintained implementations of the same operation
CH-AIQ-003	high	Similar implementations use inconsistent authorization or security safeguards
CH-AIQ-004	high	Silent failure around a critical operation
CH-AIQ-005	medium	High-risk logic without identifiable related tests
CH-AIQ-006	medium	Module significantly diverges from the dominant architecture pattern
CH-AIQ-007	low	Multiple abstractions serve the same repository-level responsibility

ID	Status	Reason
CAND-012	Reserved	Rate limiting · cannot prove absence locally
CAND-013	Reserved	Behavior/documentation drift · no deterministic case
CAND-014–018	Backlog	Historical reservations, not implemented

CODYGIENE analyzes:

Framework awareness:

CODYGIENE does not analyze:

Spotted something wrong or missing? Send feedback