@fabriziosalmi/slopless 1.4.1

package/rules/VBC-941.yaml

@@ -0,0 +1,28 @@
+id: VBC-941
+name: missing-input-sanitization
+severity: warning
+category: security
+tags:
+  - security
+  - ai-error
+match:
+  regex: >-
+    dangerouslySetInnerHTML\s*=\s*\{\{[^}]*__html\s*:\s*(?!\s|['\"`])|\.outerHTML\s*=(?!=)|\.insertAdjacentHTML\s*\(\s*[^,]+,\s*(?!\s|['\"`])
+  file_types:
+    - js
+    - ts
+    - jsx
+    - tsx
+supersedes:
+  - VBC-070
+message: >-
+  Unsanitized HTML sink at line {line}. dangerouslySetInnerHTML, outerHTML and insertAdjacentHTML
+  all bypass framework escaping. Sanitize with a library such as DOMPurify before assigning
+  untrusted markup.
+tests:
+  fire:
+    - '<div dangerouslySetInnerHTML={{ __html: userHtml }} />'
+    - el.outerHTML = markup;
+  quiet:
+    - '<div dangerouslySetInnerHTML={{ __html: "<b>static</b>" }} />'
+    - el.textContent = text;

package/rules/VBC-942.yaml

@@ -0,0 +1,23 @@
+id: VBC-942
+name: missing-access-control
+severity: warning
+category: security
+tags:
+  - security
+  - ai-error
+match:
+  regex: >-
+    (?:router|app)\.(?:get|post|put|delete|patch)\s*\(\s*['\"][^'\"]+['\"]\s*,\s*(?:async\s+)?\(?\s*(?:req|request)\b[^)]*\)?\s*(?:=>|\{)
+  file_types:
+    - js
+    - ts
+message: >-
+  Route handler at line {line} may be missing authentication middleware. AI-generated route
+  handlers frequently omit auth guards. Ensure every non-public endpoint is protected with
+  authentication and authorization middleware before the handler runs.
+tests:
+  fire:
+    - router.get('/users', async (req, res) => res.json(users));
+  quiet:
+    - >-
+      router.get('/users', requireAuth, async (req, res) => res.json(users));

package/rules/VBC-943.yaml

@@ -0,0 +1,22 @@
+id: VBC-943
+name: ignored-catch-variable
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - ai-error
+match:
+  regex: catch\s*\(\s*_[a-zA-Z]?\s*\)\s*\{
+  file_types:
+    - js
+    - ts
+message: >-
+  Catch clause with ignored error variable at line {line}. Using '_' as the catch binding
+  signals the exception is intentionally discarded. AI-generated code often silently suppresses
+  errors this way, hiding failures in production. Either log the error, re-throw with context,
+  or add an explicit comment explaining why suppression is safe here.
+tests:
+  fire:
+    - try { risky(); } catch (_e) { fallback(); }
+  quiet:
+    - try { risky(); } catch (error) { report(error); }

package/rules/VBC-944.yaml

@@ -0,0 +1,26 @@
+id: VBC-944
+name: xss-href-injection
+severity: error
+category: security
+tags:
+  - security
+  - ai-error
+match:
+  regex: >-
+    href\s*=\s*\{[^}]*\+|href\s*=\s*[`'"][^`'"]*\$\{|href\s*=\s*\{\s*`[^`]*\$\{
+  scan: all
+  file_types:
+    - js
+    - ts
+    - jsx
+    - tsx
+    - html
+message: >-
+  Dynamic href constructed with string interpolation at line {line}. If the value originates
+  from user input or an untrusted source, this is a javascript: URL injection vector. Validate
+  that URLs begin with http(s):// or are relative paths before assigning to href.
+tests:
+  fire:
+    - const link = `href="${untrusted}"`;
+  quiet:
+    - <a href="/static/page">page</a>

package/rules/VBC-945.yaml

@@ -0,0 +1,33 @@
+id: VBC-945
+name: ai-generated-placeholder-comment
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - ai-error
+match:
+  regex: >-
+    //\s*(?:TODO|FIXME|NOTE)?\s*[:\-]?\s*(?:PLACEHOLDER|ADD YOUR|YOUR CODE HERE|implement
+    (?:this|later|me)|fill in|handle this|replace this|update this later|rest of the (?:code|logic)|and
+    so on)\b
+  flags: i
+  scan: comments
+  file_types:
+    - js
+    - ts
+    - py
+    - go
+    - java
+supersedes:
+  - VBC-907
+  - VBC-150
+message: >-
+  AI-generated placeholder comment '{match}' at line {line}. AI tools frequently emit skeleton
+  code with stub comments instead of real implementations. Replace with the actual logic or
+  open a tracked issue.
+tests:
+  fire:
+    - '// TODO: implement this'
+    - // your code here
+  quiet:
+    - // parses the manifest and returns the entry point

package/rules/VBC-946.yaml

@@ -0,0 +1,26 @@
+id: VBC-946
+name: no-verification-after-operation
+severity: warning
+category: correctness
+tags:
+  - correctness
+  - ai-error
+match:
+  regex: >-
+    await\s+\w+\.(delete|remove|drop|truncate|destroy|unlink|rmdir|rm)\s*\([^)]*\)\s*;(?!\s*(?:\/\/|if|const|let|var|throw|assert|expect|check|verify|log))
+  multiline: true
+  file_types:
+    - js
+    - ts
+message: >-
+  Destructive async operation at line {line} with no verification of success. AI agents frequently
+  execute irreversible actions (delete, drop, rm) based on assumed success without checking
+  the return value or catching errors. Always verify the outcome of destructive operations
+  before proceeding.
+tests:
+  fire:
+    - await db.delete(id);
+  quiet:
+    - |-
+      await db.delete(id);
+      if (!(await db.find(id))) throw new Error("gone");

package/rules/VBC-947.yaml

@@ -0,0 +1,22 @@
+id: VBC-947
+name: prototype-pollution-risk
+severity: error
+category: security
+tags:
+  - security
+  - ai-error
+match:
+  regex: >-
+    Object\.assign\s*\(\s*(?:req\.body|request\.body|params|query|body)\s*\)|_\.merge\s*\(\s*(?:req\.body|request\.body|params)\s*\)|Object\.assign\s*\(\s*\{\s*\}\s*,\s*(?:req\.body|request\.body)
+  file_types:
+    - js
+    - ts
+message: >-
+  Merging untrusted request body directly at line {line}. This pattern enables prototype pollution:
+  an attacker can inject __proto__ or constructor.prototype to corrupt the application object
+  model. Validate and whitelist all accepted fields before merging user-supplied objects.
+tests:
+  fire:
+    - Object.assign({}, req.body);
+  quiet:
+    - Object.assign({}, defaults, options);

package/rules/VBC-948.yaml

@@ -0,0 +1,26 @@
+id: VBC-948
+name: em-dash-prose
+severity: warning
+category: docs
+tags:
+  - docs
+  - ai-slop
+match:
+  regex: —
+  file_types:
+    - md
+    - txt
+opt_in: true
+message: >-
+  Em dash at line {line}. They cluster heavily in generated prose, so a reader looking for
+  the seams finds them here first. If the break is explanatory use a colon, if it qualifies
+  use a comma, if it is an aside use parentheses, and if the two halves are separate thoughts
+  use a full stop. Keep it only where you chose it deliberately.
+tests:
+  fire:
+    - The scanner failed — silently.
+    - Four scopes — code, strings, comments, all — cover every case.
+  quiet:
+    - The scanner failed, silently.
+    - Four scopes (code, strings, comments, all) cover every case.
+    - Copyright 2020–2026 Acme Ltd.