Rules (64)
Every rule ships with a TP fixture + an FP fixture + a docs page + a registry entry — the PR bot enforces all four before a human reviews. Severity defaults are tunable per project via .codemorerc.json.
64 of 64
core-quality21 rules
Unused exports, complexity, dead conditionals, leftover prints, async-without-await — bug-class style smells.
core-bugs-loose-equality
core-bugs-loose-equality
MINOR· beta
core-bugs-todo-fixme
core-bugs-todo-fixme
INFO· beta
core-quality-async-without-await
core-quality-async-without-await
MINOR· beta
core-quality-cyclomatic-complexity
core-quality-cyclomatic-complexity
MAJOR· TypeScript, JavaScript· beta
core-quality-dead-conditional
core-quality-dead-conditional
MAJOR· TypeScript, JavaScript· beta
core-quality-duplicate-string
core-quality-duplicate-string
MINOR· TypeScript, JavaScript· experimental
core-quality-empty-catch
core-quality-empty-catch
MAJOR· beta
core-quality-empty-except
core-quality-empty-except
MAJOR· Python· beta
core-quality-leftover-console
core-quality-leftover-console
MINOR (test path: INFO)· beta
core-quality-leftover-print
core-quality-leftover-print
MINOR· Python· beta
core-quality-py-async-without-await
core-quality-py-async-without-await
MAJOR· Python· beta
core-quality-py-cyclomatic-complexity
core-quality-py-cyclomatic-complexity
MAJOR· Python· beta
core-quality-py-unreachable-code
core-quality-py-unreachable-code
MAJOR· Python· beta
core-quality-py-unused-import
core-quality-py-unused-import
MAJOR· Python· beta
core-quality-py-unused-variable
core-quality-py-unused-variable
MAJOR· Python· beta
core-quality-unreachable-code
core-quality-unreachable-code
MAJOR· TypeScript, JavaScript· beta
core-quality-unused-export
core-quality-unused-export
MAJOR· TypeScript, JavaScript· beta
core-quality-unused-import
core-quality-unused-import
MAJOR· TypeScript, JavaScript· beta
core-quality-unused-variable
core-quality-unused-variable
MAJOR· TypeScript, JavaScript· beta
core-typescript-as-any
core-typescript-as-any
MAJOR (test path: MINOR)· beta
core-typescript-non-null-assertion-abuse
core-typescript-non-null-assertion-abuse
MINOR (test path: INFO)· beta
core-security24 rules
Injection, weak crypto, secrets, path traversal, eval, deserialization — the universal SAST class.
core-security-eval
core-security-eval
BLOCKER· beta
core-security-hardcoded-password
core-security-hardcoded-password
CRITICAL· beta
core-security-hardcoded-secret-pattern
core-security-hardcoded-secret-pattern
BLOCKER· beta
core-security-innerhtml-assignment
core-security-innerhtml-assignment
BLOCKER (literal source: MAJOR)· beta
core-security-insecure-deserialization
core-security-insecure-deserialization
BLOCKER· beta
core-security-path-traversal
core-security-path-traversal
BLOCKER· beta
core-security-py-eval
core-security-py-eval
BLOCKER· Python· beta
core-security-py-shell-injection
core-security-py-shell-injection
BLOCKER· Python· beta
core-security-shell-injection
core-security-shell-injection
BLOCKER· beta
core-security-sql-injection-concat
core-security-sql-injection-concat
BLOCKER· beta
core-security-tls-disabled
core-security-tls-disabled
MAJOR· beta
core-security-weak-hash
core-security-weak-hash
MAJOR· beta
vibe-agent-tool-no-confirm
vibe-agent-tool-no-confirm
MAJOR· TypeScript, JavaScript, Python· beta
vibe-db-select-star-from-user-table
vibe-db-select-star-from-user-table
MAJOR· SQL, TypeScript, JavaScript· beta
vibe-db-write-without-where
vibe-db-write-without-where
BLOCKER· SQL, TypeScript, JavaScript· beta
vibe-hardcoded-jwt
vibe-hardcoded-jwt
BLOCKER (test paths: MAJOR)· beta
vibe-llm-output-to-sink
vibe-llm-output-to-sink
BLOCKER· TypeScript, JavaScript, Python· beta
vibe-prompt-injection-sink
vibe-prompt-injection-sink
BLOCKER· TypeScript, JavaScript· beta
vibe-py-secret-in-log
vibe-py-secret-in-log
MAJOR· Python· beta
vibe-py-ssrf-fetch-user-input
vibe-py-ssrf-fetch-user-input
MAJOR· Python· beta
vibe-secret-in-log
vibe-secret-in-log
MAJOR· TypeScript, JavaScript· beta
vibe-ssrf-fetch-user-input
vibe-ssrf-fetch-user-input
MAJOR· TypeScript, JavaScript· beta
vibe-supply-chain-hallucinated-import
vibe-supply-chain-hallucinated-import
MAJOR· TypeScript, JavaScript· beta
vibe-xss-dangerously-set
vibe-xss-dangerously-set
BLOCKER (literal: MAJOR)· beta
vibe-auth5 rules
Missing session checks, BOLA, inverted auth — the lovable Lovable bugs.
vibe-auth-bola
vibe-auth-bola
MAJOR· TypeScript, JavaScript· beta
vibe-auth-inverted
vibe-auth-inverted
BLOCKER· TypeScript, JavaScript· beta
vibe-auth-missing-session-check
vibe-auth-missing-session-check
MAJOR· TypeScript, JavaScript· beta
vibe-py-auth-bola
vibe-py-auth-bola
MAJOR· Python· beta
vibe-py-auth-missing-check
vibe-py-auth-missing-check
MAJOR· Python· beta
vibe-frontend8 rules
XSS, CORS, missing rate limits, cookie flags, file-upload validation.
vibe-cookie-missing-flags
vibe-cookie-missing-flags
MAJOR· TypeScript, JavaScript· beta
vibe-cors-wildcard-credentials
vibe-cors-wildcard-credentials
BLOCKER· beta
vibe-file-upload-no-validation
vibe-file-upload-no-validation
MAJOR· TypeScript, JavaScript, Python· beta
vibe-no-input-validation
vibe-no-input-validation
MAJOR· TypeScript, JavaScript· beta
vibe-no-rate-limit
vibe-no-rate-limit
MAJOR· TypeScript, JavaScript· beta
vibe-py-cookie-missing-flags
vibe-py-cookie-missing-flags
MAJOR· Python· beta
vibe-py-cors-wildcard-credentials
vibe-py-cors-wildcard-credentials
BLOCKER· Python· beta
vibe-py-no-input-validation
vibe-py-no-input-validation
MAJOR· Python· beta
vibe-secrets3 rules
Public env leaks, CI/CD secret echoes, MCP config secrets.
vibe-supabase3 rules
RLS disabled, permissive policies, anon-key reachable from client.