These are the rules run by packages/core-engine, the engine behind the CLI
and the GitHub Action. Rule IDs appear in CLI output, JSON and SARIF reports,
and CI failure messages, so this page is the place to look one up by name.
Web and API scans run a different engine. It covers the same 11 categories but
at a finer granularity, and additionally generates and evolves candidate fixes,
which the CLI does not do. See Issue Type Catalog
for what those scans emit, and Detectors for
the category descriptions, which apply to both.
Rules by category
35 rules across 11 categories. Severity is the rule’s default; some detections
raise or lower it based on context.
Loops (6)
| Rule ID |
Name |
Severity |
loop/regex-in-loop |
Regex in Loop |
high |
loop/json-parse-in-loop |
JSON.parse in Loop |
high |
loop/sequential-await |
Sequential Await in Loop |
high |
loop/nested-loops |
Nested Loops |
high |
loop/nested-array-methods |
Nested Array Methods |
medium |
loop/chained-array-methods |
Chained Array Methods |
medium |
Memory (6)
| Rule ID |
Name |
Severity |
memory/missing-effect-cleanup |
Missing useEffect Cleanup |
critical |
memory/missing-event-removal |
Missing Event Listener Removal |
high |
memory/missing-timer-cleanup |
Missing Timer Cleanup |
high |
memory/missing-subscription |
Missing Subscription Cleanup |
high |
memory/missing-lifecycle-cleanup |
Missing Lifecycle Cleanup |
high |
memory/missing-observer-disconnect |
Missing Observer Disconnect |
medium |
Blocking I/O (4)
| Rule ID |
Name |
Severity |
blocking-io/sync-database-operation |
Sync Database Operation |
critical |
blocking-io/sync-file-operation |
Sync File Operation |
high |
blocking-io/sync-child-process |
Sync Child Process |
high |
blocking-io/sync-crypto-operation |
Sync Crypto Operation |
medium |
Database Indexes (4)
| Rule ID |
Name |
Severity |
index/missing-fk-index |
Missing FK Index |
high |
index/missing-filter-index |
Missing Filter Index |
high |
index/missing-sort-index |
Missing Sort Index |
medium |
index/missing-composite |
Missing Composite Index |
medium |
These four are the only rules that do not parse JavaScript. missing-fk-index
and missing-sort-index read your Prisma schema; missing-filter-index and
missing-composite read TypeScript sources as text rather than as an AST. A
project with no Prisma schema will never trigger the first two.
DOM (3)
| Rule ID |
Name |
Severity |
dom/innerhtml-user-input |
innerHTML with User Input |
critical |
dom/manipulation-in-loop |
DOM Manipulation in Loop |
high |
dom/document-write |
document.write() Usage |
high |
Resource Leaks (3)
| Rule ID |
Name |
Severity |
resource/unclosed-connection |
Unclosed Connection |
high |
resource/unclosed-stream |
Unclosed Stream |
high |
resource/unclosed-file-handle |
Unclosed File Handle |
high |
Payload (2)
| Rule ID |
Name |
Severity |
payload/large-return |
Large Return Payload |
high |
payload/unbounded-query |
Unbounded Query |
medium |
Bundle Size (2)
| Rule ID |
Name |
Severity |
bundle/namespace-import |
Namespace Import |
high |
bundle/heavy-package-import |
Heavy Package Import |
medium |
ReDoS (2)
| Rule ID |
Name |
Severity |
redos/dangerous-pattern |
Dangerous Regex Pattern |
critical |
redos/regex-user-input |
Regex on User Input |
high |
Caching (2)
| Rule ID |
Name |
Severity |
caching/repeated-expensive-call |
Repeated Expensive Call |
medium |
caching/api-without-cache |
API Call Without Cache |
medium |
N+1 Queries (1)
| Rule ID |
Name |
Severity |
n1/query-in-loop |
N+1 Query in Loop |
high |
What a finding carries
Beyond the rule ID, each finding includes a file, line and column, a title and
description, the offending source line, a recommendation, and a confidence
score between 0 and 1. Confidence varies by rule and by how certain the
detection is — caching/api-without-cache is heuristic and reports low
confidence, while n1/query-in-loop reports high.
Rules may also carry a studyReference naming the empirical study the rule
came from.
Rule IDs are not config keys
Three naming schemes exist and they are not interchangeable:
- Rule IDs (
loop/sequential-await) — this page. Used in CLI and CI output.
- Detector slugs (
loop, n1, memory) — the scan API’s detector picker.
- Config keys (
inefficient-loop, n1-query) — .codeevolutionrc.json.
The category segment of a rule ID matches the detector slug, so
loop/sequential-await belongs to the loop detector. The config keys do not
match either.
Hand-maintained. The source of truth is the exported rule arrays in
packages/core-engine/src/rules/, collected by getAllRules().
