@fabriziosalmi/slopless 1.4.1

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@fabriziosalmi/slopless",
+  "version": "1.4.1",
+  "description": "",
+  "main": "dist/index.js",
+  "bin": {
+    "slopless": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "rules"
+  ],
+  "scripts": {
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "build": "tsup",
+    "docs:dev": "npm run docs:gen && vitepress dev docs",
+    "docs:gen": "ts-node scripts/generate-rule-docs.ts",
+    "docs:build": "npm run docs:gen && vitepress build docs",
+    "docs:preview": "vitepress preview docs",
+    "verify:bundle": "node scripts/verify-bundle.js",
+    "verify:action": "bash scripts/run-action-locally.sh . 'src/**/*.ts'",
+    "release:prep": "npm run docs:gen && npm run build && npm test && npm run verify:bundle"
+  },
+  "keywords": [
+    "linter",
+    "static-analysis",
+    "anti-vibecoding",
+    "sarif"
+  ],
+  "author": "Fabrizio Salmi",
+  "license": "MIT",
+  "type": "commonjs",
+  "devDependencies": {
+    "@types/glob": "^8.1.0",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^25.3.0",
+    "@vitest/coverage-v8": "^4.0.18",
+    "commander": "^14.0.3",
+    "glob": "^13.0.6",
+    "ignore": "^7.0.5",
+    "js-yaml": "^4.1.1",
+    "minimatch": "^10.2.6",
+    "ts-node": "^10.9.2",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitepress": "^1.6.4",
+    "vitest": "^4.1.11",
+    "zod": "^4.3.6"
+  },
+  "allowScripts": {
+    "esbuild": true,
+    "fsevents": true
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/rules/VBC-001.yaml

@@ -0,0 +1,33 @@
+id: VBC-001
+name: hardcoded-secret
+severity: error
+category: core
+tags:
+  - security
+  - secrets
+match:
+  regex: >-
+    \b(api_key|secret|password|token|bearer|auth[_-]?key|access[_-]?key)\b\s*[:=]\s*['\"`](?![^'\"`]*(?:secret|password|passwd|token|apikey|api[_-]?key|credential|dummy|example|sample|test|fake|changeme|placeholder|your[_-]|xxx|\.\.\.))([^'\"`]){8,}
+  flags: i
+  file_types:
+    - js
+    - ts
+    - py
+    - env
+    - yaml
+    - json
+message: >-
+  Hardcoded credential at line {line}. Read it from the environment. Values that name what
+  they are, such as CHANGEME or a fixture spelling out "secret", are not reported: they describe
+  a field rather than hold a key.
+tests:
+  fire:
+    - const password = "hunter2abc";
+    - 'api_key: "A9dK2mQ7xR4vL8nP1sT6wY3z"'
+    - token = "ghp_9fK2mQ7xR4vL8nP1sT6wY3zB5cE0"
+  quiet:
+    - const password = process.env.PASSWORD;
+    - const token = "";
+    - secret = "REAL-HMAC-SECRET"
+    - 'api_key: "your-api-key-here"'
+    - access_key = "AKIAIOSFODNN7EXAMPLE"

package/rules/VBC-002.yaml

@@ -0,0 +1,13 @@
+id: VBC-002
+name: committed-env
+severity: error
+category: core
+tags:
+  - security
+  - git
+match:
+  git_check: committed_env
+message: >-
+  Environment file (.env) detected in staged files. This is a security risk.
+tests:
+  external: 'git-checker.test.ts: needs a staged file list'

package/rules/VBC-003.yaml

@@ -0,0 +1,36 @@
+id: VBC-003
+name: chmod-777
+severity: error
+category: core
+tags:
+  - security
+match:
+  regex: chmod\s+777
+  file_types:
+    - sh
+    - py
+    - js
+  exclude_files:
+    - '**/test/**'
+    - '**/tests/**'
+    - '**/__tests__/**'
+    - '**/testdata/**'
+    - '**/fixtures/**'
+    - '**/test_*.py'
+    - '**/*_test.py'
+    - '**/test.py'
+    - '**/conftest.py'
+    - '**/*_test.go'
+    - '**/*_bench.go'
+    - '**/*.test.*'
+    - '**/*.spec.*'
+    - '**/bench/**'
+    - '**/benchmark*'
+    - '**/*corpus*'
+    - '**/*payload*'
+message: Insecure chmod 777 detected at line {line}
+tests:
+  fire:
+    - chmod 777 /srv/app
+  quiet:
+    - chmod 640 /srv/app

package/rules/VBC-004.yaml

@@ -0,0 +1,33 @@
+id: VBC-004
+name: sql-injection-concatenation
+severity: error
+category: security
+tags:
+  - security
+match:
+  regex: >-
+    (?:"[^"\n]*|'[^'\n]*|`[^`\n]*)(?:\bSELECT\b[^\n]{0,80}?\bFROM\b|\bINSERT\s+INTO\b|\bUPDATE\b[^\n]{0,80}?\bSET\b|\bDELETE\b[^\n]{0,80}?\bFROM\b|\bWHERE\b|\bVALUES\s*\()[^\n]{0,120}?["'`]\s*\+|\+=?\s*["'`][^\n]{0,80}?\b(?:WHERE\s|VALUES\s*\(|SET\s+\w+\s*=|ORDER\s+BY|GROUP\s+BY|LIMIT\s+\d|AND\s+\w+\s*=|OR\s+\w+\s*=)
+  flags: i
+  scan: all
+  file_types:
+    - js
+    - ts
+    - tsx
+    - jsx
+    - py
+    - go
+    - php
+    - rb
+    - java
+    - cs
+message: >-
+  SQL built by string concatenation at line {line}. An attacker controlling the interpolated
+  value can rewrite the statement. Use parameterized queries or a query builder that binds
+  values separately.
+tests:
+  fire:
+    - db.query("SELECT * FROM users WHERE id = " + id);
+    - sql += " AND status = " + status;
+  quiet:
+    - db.query("SELECT * FROM users WHERE id = $1", [id]);
+    - const label = 'Update ' + count + ' items';

package/rules/VBC-005.yaml

@@ -0,0 +1,24 @@
+id: VBC-005
+name: use-var
+severity: error
+category: core
+tags:
+  - best-practice
+match:
+  regex: (?<!\bdeclare\s{1,4})\bvar\b
+  file_types:
+    - js
+    - ts
+fix:
+  regex_replace:
+    pattern: \bvar\b
+    replacement: let
+message: Use of 'var' detected at line {line}. Use 'let' or 'const' instead.
+tests:
+  fire:
+    - var total = 0;
+  quiet:
+    - const total = 0;
+    - let total = 0;
+    - file: global.d.ts
+      code: 'declare var sampleRate: number;'

package/rules/VBC-006.yaml

@@ -0,0 +1,16 @@
+id: VBC-006
+name: committed-node-modules
+severity: error
+category: git
+tags:
+  - git
+  - security
+  - performance
+match:
+  git_check: node_modules
+message: >-
+  node_modules directory detected in staged files. Add node_modules/ to .gitignore and use
+  package.json for dependency management. This bloats the repository and causes cross-platform
+  dependency hell.
+tests:
+  external: 'git-checker.test.ts: needs a staged file list'

package/rules/VBC-007.yaml

@@ -0,0 +1,28 @@
+id: VBC-007
+name: float-for-currency
+severity: error
+category: security
+tags:
+  - security
+  - clean-code
+match:
+  regex: >-
+    \b(?:(?:price|cost|fee|fees|tax|subtotal|payment|invoice|salary|refund|charge)(?![a-z])|[a-z_$]+(?:Price|Cost|Fee|Fees|Tax|Subtotal|Payment|Invoice|Salary|Refund|Charge)(?![a-z]))[A-Za-z_$]*\s*[:=]\s*[0-9]+\.[0-9]+
+  file_types:
+    - js
+    - ts
+    - py
+message: >-
+  Monetary value declared as a floating point literal at line {line}. Binary floats cannot
+  represent decimal cents exactly. Store money as integer minor units or use a decimal type.
+tests:
+  fire:
+    - const unitPrice = 19.99;
+    - let taxRate = 0.22;
+    - 'totalCost: 4.50'
+  quiet:
+    - const unitPriceCents = 1999;
+    - const ratio = 0.22;
+    - const feedback = 0.5;
+    - const amount = 0.5;
+    - const coffee = 1.5;

package/rules/VBC-008.yaml

@@ -0,0 +1,21 @@
+id: VBC-008
+name: sleep-race-condition
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - robustness
+match:
+  regex: await\s+new\s+Promise\s*\([^)]*setTimeout
+  file_types:
+    - js
+    - ts
+message: >-
+  Using setTimeout as a sleep to paper over a race condition at line {line}. This is a flaky
+  band-aid that slows the app down. Fix the underlying async coordination with proper event
+  handling or promises instead.
+tests:
+  fire:
+    - await new Promise(resolve => setTimeout(resolve, 500));
+  quiet:
+    - await waitForReady();

package/rules/VBC-009.yaml

@@ -0,0 +1,24 @@
+id: VBC-009
+name: jquery-modern-project
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - performance
+match:
+  regex: (require\(['"]jquery['"]\)|from\s+['"]jquery['"])
+  file_types:
+    - js
+    - ts
+    - tsx
+    - jsx
+message: >-
+  jQuery dependency detected at line {line}. In 2026, native DOM APIs (querySelector, fetch,
+  classList, addEventListener) are sufficient and far lighter. Dropping jQuery reduces bundle
+  size and removes an unnecessary abstraction layer.
+tests:
+  fire:
+    - import $ from 'jquery';
+    - const $ = require('jquery');
+  quiet:
+    - import { render } from 'react-dom';

package/rules/VBC-010.yaml

@@ -0,0 +1,24 @@
+id: VBC-010
+name: div-onclick-non-semantic
+severity: error
+category: ux-dx
+tags:
+  - accessibility
+  - html
+match:
+  regex: <div[^>]*\s(onclick|onClick)=
+  file_types:
+    - html
+    - js
+    - ts
+    - tsx
+    - jsx
+message: >-
+  Clickable <div> with onclick handler at line {line}. Use <button> or <a> for interactive
+  elements. Non-semantic clickable divs are invisible to keyboard navigation and screen readers,
+  excluding users with disabilities.
+tests:
+  fire:
+    - <div onClick={handleClick}>Save</div>
+  quiet:
+    - <button onClick={handleClick}>Save</button>

package/rules/VBC-011.yaml

@@ -0,0 +1,21 @@
+id: VBC-011
+name: document-cookie-direct
+severity: warning
+category: security
+tags:
+  - security
+  - clean-code
+match:
+  regex: document\.cookie\s*=(?!=)
+  file_types:
+    - js
+    - ts
+message: >-
+  Direct document.cookie write at line {line}. Manual cookie manipulation is error-prone and
+  easy to misconfigure. Use a cookie library that enforces proper security flags (HttpOnly,
+  Secure, SameSite) by default.
+tests:
+  fire:
+    - document.cookie = "session=abc";
+  quiet:
+    - if (document.cookie === "") { init(); }

package/rules/VBC-012.yaml

@@ -0,0 +1,21 @@
+id: VBC-012
+name: redundant-promise-constructor
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - performance
+match:
+  regex: new Promise\s*\(\s*(resolve|res)\s*=>\s*(resolve|res)\s*\(
+  file_types:
+    - js
+    - ts
+message: >-
+  Redundant Promise constructor wrapping at line {line}. This is an anti-pattern called "Promise
+  constructor anti-pattern". Use Promise.resolve() directly or return the value/promise without
+  wrapping it.
+tests:
+  fire:
+    - const p = new Promise(resolve => resolve(value));
+  quiet:
+    - const p = Promise.resolve(value);

package/rules/VBC-013.yaml

@@ -0,0 +1,17 @@
+id: VBC-013
+name: empty-catch
+severity: error
+category: core
+tags:
+  - robustness
+match:
+  ast_check:
+    type: empty-catch
+message: >-
+  Empty catch block detected at line {line}. Swallowing errors makes debugging impossible.
+tests:
+  fire:
+    - try { risky(); } catch (error) {}
+  quiet:
+    - try { risky(); } catch (error) { report(error); }
+    - try { risky(); } catch (error) { /* nothing to do here */ }

package/rules/VBC-014.yaml

@@ -0,0 +1,15 @@
+id: VBC-014
+name: committed-ide-settings
+severity: warning
+category: git
+tags:
+  - git
+  - dx
+match:
+  git_check: committed_ide_settings
+message: >-
+  IDE settings file '{file}' detected in staged files. Add .vscode/ and .idea/ to .gitignore.
+  Committing personal IDE settings enforces your preferences on the entire team and creates
+  unnecessary merge conflicts.
+tests:
+  external: 'git-checker.test.ts: needs a staged file list'

package/rules/VBC-015.yaml

@@ -0,0 +1,40 @@
+id: VBC-015
+name: magic-numbers
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: >-
+    (?<!\w)(?<!(?:const|let|var|static|final)\s{1,4}[A-Za-z_$][\w$]{0,60}\s{0,4}=\s{0,4})(?:86400|3600|1000|60)(?![\w.])
+  file_types:
+    - js
+    - ts
+    - py
+  exclude_files:
+    - '**/test/**'
+    - '**/tests/**'
+    - '**/__tests__/**'
+    - '**/testdata/**'
+    - '**/fixtures/**'
+    - '**/test_*.py'
+    - '**/*_test.py'
+    - '**/test.py'
+    - '**/conftest.py'
+    - '**/*_test.go'
+    - '**/*_bench.go'
+    - '**/*.test.*'
+    - '**/*.spec.*'
+    - '**/bench/**'
+    - '**/benchmark*'
+    - '**/*corpus*'
+    - '**/*payload*'
+message: >-
+  Magic number '{match}' detected at line {line}. Consider using a named constant (e.g., SECONDS_IN_DAY).
+tests:
+  fire:
+    - setTimeout(retry, 1000);
+    - const expiry = now + 86400;
+  quiet:
+    - const ONE_SECOND_MS = 1000;
+    - const port = 10001;

package/rules/VBC-016.yaml

@@ -0,0 +1,21 @@
+id: VBC-016
+name: commented-out-code
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: >-
+    ^\s*//\s*(function|const|let|var|if|for|while|return|class|export|import)\b
+  scan: comments
+  file_types:
+    - js
+    - ts
+message: >-
+  Potential commented-out code detected at line {line}. If the code is no longer needed, delete
+  it. Use Git for history.
+tests:
+  fire:
+    - // const legacy = compute();
+  quiet:
+    - // computes the running total

package/rules/VBC-017.yaml

@@ -0,0 +1,23 @@
+id: VBC-017
+name: fake-test-assertion
+severity: error
+category: core
+tags:
+  - testing
+  - clean-code
+match:
+  regex: >-
+    (expect\(true\)\.(toBe|toEqual|toStrictEqual)\(true\)|expect\(1\)\.(toBe|toEqual)\(1\)|assert\.equal\(true,\s*true\)|assert\.ok\(true\)|assert\.isTrue\(true\))
+  file_types:
+    - js
+    - ts
+message: >-
+  Trivially true test assertion at line {line}. This test always passes regardless of the
+  code under test and provides zero confidence. Write a real assertion that can actually fail
+  when the implementation is broken.
+tests:
+  fire:
+    - expect(true).toBe(true);
+    - assert.ok(true);
+  quiet:
+    - expect(sum(1, 2)).toBe(3);

package/rules/VBC-018.yaml

@@ -0,0 +1,19 @@
+id: VBC-018
+name: console-logs-detected
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: console\.(log|info|debug|dir)\(
+  file_types:
+    - js
+    - ts
+message: >-
+  Production code with console usage '{match}' found at line {line}. Consider a professional
+  logging library.
+tests:
+  fire:
+    - console.log("debug me");
+  quiet:
+    - logger.info("started");

package/rules/VBC-019.yaml

@@ -0,0 +1,42 @@
+id: VBC-019
+name: absolute-paths
+severity: error
+category: core
+tags:
+  - security
+  - portability
+match:
+  regex: '[''"]/Users/|[''"]/home/|[''"]C:\\'
+  scan: strings
+  file_types:
+    - js
+    - ts
+    - py
+    - sh
+  exclude_files:
+    - '**/test/**'
+    - '**/tests/**'
+    - '**/__tests__/**'
+    - '**/testdata/**'
+    - '**/fixtures/**'
+    - '**/test_*.py'
+    - '**/*_test.py'
+    - '**/test.py'
+    - '**/conftest.py'
+    - '**/*_test.go'
+    - '**/*_bench.go'
+    - '**/*.test.*'
+    - '**/*.spec.*'
+    - '**/bench/**'
+    - '**/benchmark*'
+    - '**/*corpus*'
+    - '**/*payload*'
+message: >-
+  Hardcoded absolute path '{match}' detected at line {line}. This breaks system portability
+  and leaks local structure.
+tests:
+  fire:
+    - const home = '/Users/fab/project';
+    - const win = 'C:\\Users\\fab';
+  quiet:
+    - const home = path.join(os.homedir(), 'project');

package/rules/VBC-020.yaml

@@ -0,0 +1,22 @@
+id: VBC-020
+name: justify-text-web
+severity: warning
+category: ux-dx
+tags:
+  - ux
+  - accessibility
+match:
+  regex: text-align:\s*justify
+  file_types:
+    - css
+    - scss
+    - less
+message: >-
+  text-align:justify detected at line {line}. Justified text creates uneven "rivers of white
+  space" between words that make text significantly harder to read, particularly for users
+  with dyslexia. Use left-aligned text for body copy.
+tests:
+  fire:
+    - 'p { text-align: justify; }'
+  quiet:
+    - 'p { text-align: left; }'

package/rules/VBC-021.yaml

@@ -0,0 +1,22 @@
+id: VBC-021
+name: thin-font-weight
+severity: warning
+category: ux-dx
+tags:
+  - ux
+  - accessibility
+match:
+  regex: font-weight:\s*(?:100|200)\b
+  file_types:
+    - css
+    - scss
+    - less
+message: >-
+  Thin font weight (100-199) detected at line {line}. Ultra-thin typefaces look elegant on
+  high-DPI Retina screens but become nearly invisible on standard monitors. Use a minimum
+  of 300 (Light) for body text and 400 (Regular) for critical UI copy.
+tests:
+  fire:
+    - 'body { font-weight: 100; }'
+  quiet:
+    - 'body { font-weight: 400; }'

package/rules/VBC-022.yaml

@@ -0,0 +1,21 @@
+id: VBC-022
+name: custom-cursor-css
+severity: warning
+category: ux-dx
+tags:
+  - ux
+match:
+  regex: cursor:\s*url\s*\(
+  file_types:
+    - css
+    - scss
+    - less
+message: >-
+  Custom cursor via CSS url() at line {line}. Custom cursors are often laggy, pixel-inaccurate,
+  and confusing for users who rely on their cursor to interact with native OS elements. This
+  is a hallmark of style-over-function design.
+tests:
+  fire:
+    - 'body { cursor: url(cat.png), auto; }'
+  quiet:
+    - 'body { cursor: default; }'

package/rules/VBC-023.yaml

@@ -0,0 +1,22 @@
+id: VBC-023
+name: notification-permission-eager
+severity: error
+category: ux-dx
+tags:
+  - ux
+  - security
+match:
+  regex: Notification\.requestPermission\(
+  file_types:
+    - js
+    - ts
+message: >-
+  Notification.requestPermission() detected at line {line}. Requesting browser notification
+  permissions immediately on page load is hostile UX that causes most users to click "Block"
+  by default. Only request permissions in direct response to an explicit user action that
+  requires notifications.
+tests:
+  fire:
+    - Notification.requestPermission();
+  quiet:
+    - button.addEventListener("click", askForNotifications);

package/rules/VBC-024.yaml

@@ -0,0 +1,26 @@
+id: VBC-024
+name: autoplay-video-unmuted
+severity: error
+category: ux-dx
+tags:
+  - ux
+  - accessibility
+match:
+  regex: <video[^>]*\bautoplay(?![^>]*\bmuted\b)[^>]*>
+  multiline: true
+  file_types:
+    - html
+    - js
+    - ts
+    - tsx
+    - jsx
+message: >-
+  Autoplay video without the muted attribute at line {line}. Autoplaying audio is one of the
+  most hostile UX patterns: it embarrasses users in quiet environments, eats mobile data,
+  and is blocked by most browsers anyway. Add muted or remove autoplay.
+tests:
+  fire:
+    - <video autoplay src="clip.mp4"></video>
+  quiet:
+    - <video autoplay muted src="clip.mp4"></video>
+    - <video controls></video>