Rules that explain the risk, evidence, and fix.
Review security, dependency, and code-health rules with concrete examples, detection boundaries, remediation guidance, and reproducible local commands.
rules
16Rules that explain the risk, evidence, and fix.
Primary coverage02
01Detect cross-site scripting (XSS) before merge.See how cross-site scripting (XSS) fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.02Detect SQL injection before merge.See how SQL injection fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.
Extended coverage14
03Detect duplicate code before merge.See how duplicate code fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.04Detect command injection before merge.See how command injection fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.05Detect path traversal before merge.See how path traversal fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.06Detect server-side request forgery (SSRF) before merge.See how server-side request forgery (SSRF) fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.07Detect JWT security weaknesses before merge.See how JWT security weaknesses fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.08Detect CORS misconfiguration before merge.See how CORS misconfiguration fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.09Detect CSP misconfiguration before merge.See how CSP misconfiguration fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.10Detect weak cryptography before merge.See how weak cryptography fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.11Detect weak randomness before merge.See how weak randomness fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.12Detect dead code before merge.See how dead code fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.13Detect dependency cycles before merge.See how dependency cycles fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.14Detect oversized files before merge.See how oversized files fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.15Detect malicious packages before merge.See how malicious packages fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.16Detect vulnerable dependencies before merge.See how vulnerable dependencies fits local review, which evidence Code Radar produces, where coverage ends, and how trusted findings move into CI.
Use Rules that explain the risk, evidence, and fix. as a decision directory.
Review security, dependency, and code-health rules with concrete examples, detection boundaries, remediation guidance, and reproducible local commands. Open the page that matches the concrete decision in front of you, verify its evidence and limits, then continue to the relevant implementation or proof page.
- Scope: Review security, dependency, and code-health rules with concrete examples, detection boundaries, remediation guidance, and reproducible local commands.
- Evidence: Inspect the unsafe pattern, safer alternative, rule identifier, severity, confidence, detection scope, common false positives, and reproducible scan command.
- Boundary: A rule detects a defined code pattern, not every possible exploit path; reviewers still need context, configuration, and tests for the affected system.
Continue with implementation evidence.
For Rules that explain the risk, evidence, and fix., use these routes to inspect a real artifact, confirm the product boundary, or implement the workflow described in this directory.
Validate the workflow on your own code.
Start with one local scan, inspect the evidence, and expand to reports, agents, or CI only when the signal is useful.