Rule catalog
Generated from the runtime rule registry · the same registry the CLI reports via codygiene rules list. Human-authored context lives in Rules and Scope.
70registered rules
64enabled by default
6disabled by default (opt-in via
--enable)Security (32 rules, 32 enabled)
| Rule | Severity | Default | Description |
|---|---|---|---|
CAND-001 | medium | enabled | Sensitive data (tokens, secrets, passwords) in log output (Alpha). |
CAND-002 | high | enabled | Webhook trusts caller-supplied metadata as organization identity (Alpha). |
CAND-003 | high | enabled | URL constructed from untrusted request Host header (Alpha). |
CAND-004 | high | enabled | HTTP header injection via unsanitized request input (Alpha). |
CAND-005 | high | enabled | Filter-string injection in Supabase/PostgREST raw filter methods (Alpha). |
CAND-006 | high | enabled | Shell command execution with string interpolation (Alpha). |
CAND-007 | high | enabled | Browser-role GRANT EXECUTE on SECURITY DEFINER function (Alpha). |
CAND-008 | high | enabled | Cross-table tenant integrity gap (Alpha). |
CAND-009 | high | enabled | SQL TOCTOU / missing lock in PLpgSQL functions (Alpha). |
CAND-011 | medium | enabled | Unbounded SQL array/JSON processing in functions (Alpha). |
CAND-019 | critical | enabled | Potential secret exposed via VITE_/REACT_APP_/PUBLIC_ env prefix (Alpha). |
CAND-020 | high | enabled | Dynamic require() with non-literal module path (Alpha). |
CAND-021 | high | enabled | SECURITY DEFINER function with unsafe search_path (Alpha). |
CAND-022 | high | enabled | Dynamic SQL inside privileged functions (Alpha). |
CAND-023 | high | enabled | Unsafe raw ORM query construction (Alpha, E1.3). |
CAND-025 | high | enabled | Request-derived open redirect (Alpha, E1.4). |
CAND-026 | high | enabled | Unverified webhook side effect (Alpha, E1.4). |
CH-SEC-001 | high | enabled | Dangerous eval() usage. |
CH-SEC-002 | high | enabled | Function constructor used to create code from strings. |
CH-SEC-003 | critical | enabled | Secret credential exposed via a NEXT_PUBLIC_ environment variable. |
CH-SEC-004 | critical | enabled | Supabase service credential reachable from client-side code. |
CH-SEC-005 | high | enabled | dangerouslySetInnerHTML with a dynamic value. |
CH-SEC-006 | high | enabled | Table referenced in code without Row Level Security enabled. |
CH-SEC-007 | high | enabled | RLS policy with USING(true) or WITH CHECK(true) on non-public tables. |
CH-SEC-008 | medium | enabled | INSERT/UPDATE RLS policy without a WITH CHECK expression. |
CH-SEC-009 | critical | enabled | Service-role Supabase client used in a route handler processing user input. |
CH-SEC-010 | high | enabled | Route handler uses params to look up a resource without an ownership constraint. |
CH-SEC-011 | high | enabled | Mutation handler (POST/PUT/PATCH/DELETE) without an identifiable auth check. |
CH-SEC-012 | medium | enabled | select("*") on a table that may contain sensitive columns. |
CH-SEC-013 | medium | enabled | Redirect target derived from user input without validation. |
CH-SEC-014 | high | enabled | Server-side fetch with a user-controlled URL target. |
CH-SEC-015 | high | enabled | Filesystem path constructed from user input without containment. |
Performance (11 rules, 11 enabled)
| Rule | Severity | Default | Description |
|---|---|---|---|
CAND-010 | medium | enabled | Unbounded database query on growing table (Alpha, E1.3: Prisma/Drizzle). |
CAND-024 | medium | enabled | Fetch-all then filter/sort in JavaScript (Alpha, E1.3). |
CH-PERF-001 | medium | enabled | Database query executed inside a loop (potential N+1). |
CH-PERF-002 | medium | enabled | Network request executed inside a loop. |
CH-PERF-003 | medium | enabled | Sequential independent await operations that could run concurrently. |
CH-PERF-004 | high | enabled | Potential N+1 database query pattern. |
CH-PERF-005 | low | enabled | Repeated identical database query within the same function. |
CH-PERF-006 | low | enabled | Repeated identical network request within the same function. |
CH-PERF-007 | medium | enabled | Synchronous blocking operation in a request handler path. |
CH-PERF-008 | medium | enabled | Excessive client boundary causing large client-reachable graph. |
CH-PERF-011 | low | enabled | useEffect with unstable constructed dependency causing unnecessary re-runs. |
Code Health (20 rules, 14 enabled)
| Rule | Severity | Default | Description |
|---|---|---|---|
CAND-027 | medium | enabled | Unsafe type-safety escape in high-risk production logic (Alpha). |
CAND-028 | medium | enabled | Type-check suppression (@ts-ignore/@ts-nocheck) in production code (Alpha). |
CAND-029 | medium | enabled insight | High change blast radius: module with top-percentile transitive dependents (Alpha). |
CAND-030 | medium | disabled | Excessive coupling: module with top-percentile fan-out (Alpha). |
CAND-031 | medium | disabled | Architectural hotspot: high fan-in combined with a large implementation (Alpha). |
CAND-032 | high | enabled insight | Workspace dependency cycle detected (Alpha). |
CAND-033 | medium | enabled insight | Cross-workspace dependency risk: app-to-app internal imports (Alpha). |
CH-HEALTH-001 | medium | enabled | Oversized function (many statements or lines, with composite severity). |
CH-HEALTH-002 | low | enabled | Oversized file (many effective lines). |
CH-HEALTH-003 | medium | enabled | Circular dependency detected in the import graph. |
CH-HEALTH-004 | low | disabled | Source file not reachable from any known entrypoint. |
CH-HEALTH-005 | low | disabled | Exported symbol not used by any reachable file. |
CH-HEALTH-006 | low | enabled | Dependency declared in package.json but not imported. |
CH-HEALTH-007 | medium | disabled | Package imported but not declared in package.json. |
CH-HEALTH-008 | medium | disabled | Functions with high structural similarity (duplicated logic). |
CH-HEALTH-009 | medium | enabled | Function with excessive cyclomatic complexity. |
CH-HEALTH-010 | low | enabled | Function with excessive nesting depth. |
CH-HEALTH-011 | medium | enabled | Module that accumulates multiple risk signals (hotspot). |
CH-HEALTH-012 | low | enabled | Suspicious cross-layer dependency (e.g. domain importing UI). |
CH-HEALTH-014 | medium | enabled | Exception caught and silently swallowed (empty catch or silent fallback). |
AI Quality (7 rules, 7 enabled)
| Rule | Severity | Default | Description |
|---|---|---|---|
CH-AIQ-001 | low | enabled | Redundant pass-through abstraction chain (multiple forwarding layers with no added behavior). |
CH-AIQ-002 | medium | enabled | Multiple independently maintained implementations of the same significant business operation. |
CH-AIQ-003 | high | enabled | Similar implementations use inconsistent authorization or security safeguards. |
CH-AIQ-004 | high | enabled | Silent failure (empty catch or silent fallback) around a critical operation. |
CH-AIQ-005 | medium | enabled | High-risk logic (database mutations, authorization, security-sensitive) without identifiable related tests. |
CH-AIQ-006 | medium | enabled | Module significantly diverges from the dominant architecture pattern of comparable modules. |
CH-AIQ-007 | low | enabled | Multiple abstractions appear to serve the same repository-level responsibility. |
Notes
- Insights (insight) are informational architecture observations. They appear in every report format but never reduce scores, trigger
--fail-on, or count as release-gate failures. - Disabled rules are opt-in only:
codygiene scan --enable CAND-030or{"rules":{"enable":["CAND-030"]}in.codygiene.json.