@fabriziosalmi/slopless 1.4.1

package/rules/VBC-025.yaml

@@ -0,0 +1,13 @@
+id: VBC-025
+name: missing-gitignore
+severity: error
+category: git
+tags:
+  - git
+  - project-health
+match:
+  git_check: missing_gitignore
+message: >-
+  Missing .gitignore file. This often lead to committed dependencies or secrets.
+tests:
+  external: 'git-checker.test.ts: needs a repository working tree'

package/rules/VBC-026.yaml

@@ -0,0 +1,17 @@
+id: VBC-026
+name: empty-file
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - project-health
+match:
+  ast_check:
+    type: empty-file
+message: Empty code file detected. This clutters the repository.
+tests:
+  fire:
+    - ''
+    - "   \n"
+  quiet:
+    - export const answer = 42;

package/rules/VBC-027.yaml

@@ -0,0 +1,27 @@
+id: VBC-027
+name: parallax-overuse
+severity: warning
+category: ux-dx
+tags:
+  - ux
+  - performance
+  - accessibility
+match:
+  regex: >-
+    (scrollY\s*\*\s*0\.[0-9]+|\.parallax\b|parallax[-_]container|data-parallax)
+  flags: i
+  file_types:
+    - js
+    - ts
+    - css
+    - scss
+message: >-
+  Parallax scrolling effect detected at line {line}. Parallax effects can trigger vestibular
+  disorders (nausea, dizziness) in sensitive users, carry significant GPU cost, and break
+  on mobile. Respect prefers-reduced-motion and consider whether the effect adds genuine value.
+tests:
+  fire:
+    - el.style.top = scrollY * 0.4 + "px";
+    - '.parallax { top: 0; }'
+  quiet:
+    - el.style.top = offset + "px";

package/rules/VBC-028.yaml

@@ -0,0 +1,18 @@
+id: VBC-028
+name: function-params-limit
+severity: warning
+category: core
+tags:
+  - clean-code
+match:
+  ast_check:
+    type: function-params-limit
+    threshold: 5
+message: >-
+  Function takes {count} parameters at line {line}, over the limit of {threshold}. Positional
+  arguments are easy to pass in the wrong order. Take an options object, or split the function.
+tests:
+  fire:
+    - function build(a, b, c, d, e, f) { return a; }
+  quiet:
+    - function build(a, b) { return a + b; }

package/rules/VBC-029.yaml

@@ -0,0 +1,22 @@
+id: VBC-029
+name: glassmorphism-overuse
+severity: warning
+category: ux-dx
+tags:
+  - ux
+  - performance
+match:
+  regex: backdrop-filter:\s*blur\(
+  file_types:
+    - css
+    - scss
+    - less
+message: >-
+  backdrop-filter:blur() (glassmorphism) at line {line}. This effect forces GPU compositing
+  on every frame, severely impacting performance on low-end and mobile devices. It also frequently
+  reduces text contrast below accessibility thresholds. Use sparingly and test on real hardware.
+tests:
+  fire:
+    - '.card { backdrop-filter: blur(12px); }'
+  quiet:
+    - '.card { background: var(--surface); }'

package/rules/VBC-030.yaml

@@ -0,0 +1,22 @@
+id: VBC-030
+name: confetti-overuse
+severity: warning
+category: ux-dx
+tags:
+  - ux
+  - performance
+match:
+  regex: (confetti\(|canvas-confetti|party\.js|tsParticles\.load)
+  flags: i
+  file_types:
+    - js
+    - ts
+message: >-
+  Confetti or particle animation library detected at line {line}. Overusing celebration effects
+  devalues them and creates visual noise. Reserve confetti for genuinely significant milestones
+  (first purchase, account creation) rather than every successful action.
+tests:
+  fire:
+    - 'confetti({ particleCount: 120 });'
+  quiet:
+    - showSuccessToast();

package/rules/VBC-032.yaml

@@ -0,0 +1,20 @@
+id: VBC-032
+name: css-important
+severity: warning
+category: core
+tags:
+  - style
+  - css
+match:
+  regex: '!important'
+  file_types:
+    - css
+    - scss
+    - less
+message: >-
+  Global '!important' detected in CSS at line {line}. This breaks the cascade.
+tests:
+  fire:
+    - '.card { color: red !important; }'
+  quiet:
+    - '.card { color: red; }'

package/rules/VBC-033.yaml

@@ -0,0 +1,26 @@
+id: VBC-033
+name: placeholder-image-src
+severity: error
+category: ux-dx
+tags:
+  - ux
+  - slop
+match:
+  regex: >-
+    (src|href)=['"](https?://)?(via\.placeholder\.com|picsum\.photos|placehold\.co|dummyimage\.com|loremflickr\.com|placekitten\.com)[^'"]*['"]
+  flags: i
+  file_types:
+    - html
+    - js
+    - ts
+    - tsx
+    - jsx
+message: >-
+  Placeholder image service URL detected at line {line}. External placeholder services break
+  when the service is down, look unfinished, and represent content that was never completed.
+  Replace with real production images.
+tests:
+  fire:
+    - <img src="https://via.placeholder.com/400" alt="x" />
+  quiet:
+    - <img src="/assets/hero.png" alt="Hero" />

package/rules/VBC-034.yaml

@@ -0,0 +1,41 @@
+id: VBC-034
+name: http-not-https
+severity: error
+category: security
+tags:
+  - security
+match:
+  regex: >-
+    http://(?!localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|test\b|example\.(?:com|org)|www\.w3\.org|schemas?\.|json-schema\.org|purl\.org|ns\.adobe|www\.apache\.org)
+  scan: strings
+  file_types:
+    - js
+    - ts
+    - py
+    - html
+  exclude_files:
+    - '**/test/**'
+    - '**/tests/**'
+    - '**/__tests__/**'
+    - '**/testdata/**'
+    - '**/fixtures/**'
+    - '**/test_*.py'
+    - '**/*_test.py'
+    - '**/test.py'
+    - '**/conftest.py'
+    - '**/*_test.go'
+    - '**/*_bench.go'
+    - '**/*.test.*'
+    - '**/*.spec.*'
+    - '**/bench/**'
+    - '**/benchmark*'
+    - '**/*corpus*'
+    - '**/*payload*'
+message: Insecure http:// link detected at line {line}. Use https:// instead.
+tests:
+  fire:
+    - const api = 'http://api.example.com/v1';
+  quiet:
+    - const api = 'https://api.example.com/v1';
+    - const dev = 'http://localhost:3000';
+    - const svg = 'http://www.w3.org/2000/svg';

package/rules/VBC-035.yaml

@@ -0,0 +1,30 @@
+id: VBC-035
+name: aria-label-icon-button
+severity: error
+category: ux-dx
+tags:
+  - accessibility
+match:
+  regex: <button\b(?![^>]*(?:aria-label|aria-labelledby|title))[^>]*>\s*<svg
+  multiline: true
+  file_types:
+    - html
+    - tsx
+    - jsx
+message: >-
+  Icon-only button without aria-label at line {line}. A button containing only an SVG icon
+  has no accessible name, making it completely opaque to screen readers. Add aria-label="Descriptive
+  action" to every icon-only button.
+tests:
+  fire:
+    - file: fixture.tsx
+      code: |
+        <button onClick={close}>
+          <svg viewBox="0 0 24 24" />
+        </button>
+  quiet:
+    - file: fixture.tsx
+      code: |
+        <button aria-label="Close" onClick={close}>
+          <svg viewBox="0 0 24 24" />
+        </button>

package/rules/VBC-039.yaml

@@ -0,0 +1,18 @@
+id: VBC-039
+name: use-eval
+severity: error
+category: core
+tags:
+  - security
+match:
+  regex: eval\(
+  file_types:
+    - js
+    - ts
+message: >-
+  Use of 'eval()' detected at line {line}. This is a massive security risk.
+tests:
+  fire:
+    - eval(userInput);
+  quiet:
+    - JSON.parse(userInput);

package/rules/VBC-042.yaml

@@ -0,0 +1,26 @@
+id: VBC-042
+name: too-many-comments
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: (?:^[ \t]*//.*\n){10,}
+  flags: m
+  multiline: true
+  scan: all
+  file_types:
+    - js
+    - ts
+    - py
+message: >-
+  Too many consecutive comment lines at line {line}. Code should be self-documenting.
+tests:
+  fire:
+    - code: |
+        // filler comment line
+      repeat: 12
+  quiet:
+    - |
+      // one explanatory comment
+      const answer = 42;

package/rules/VBC-045.yaml

@@ -0,0 +1,13 @@
+id: VBC-045
+name: missing-license
+severity: warning
+category: git
+tags:
+  - git
+  - project-health
+match:
+  git_check: missing_license
+message: >-
+  Missing LICENSE file. Every open source project should define its terms of use.
+tests:
+  external: 'git-checker.test.ts: needs a repository working tree'

package/rules/VBC-046.yaml

@@ -0,0 +1,13 @@
+id: VBC-046
+name: binary-files-in-git
+severity: warning
+category: git
+tags:
+  - git
+  - performance
+match:
+  git_check: binary_file
+message: >-
+  Binary file committed to Git. Large binaries should use Git LFS or be stored externally.
+tests:
+  external: 'git-checker.test.ts: needs a staged file list'

package/rules/VBC-048.yaml

@@ -0,0 +1,23 @@
+id: VBC-048
+name: meaningless-variable-names
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: >-
+    \b(?:let|const|var)\s+(?:temp|tmp|obj|variable|thing|stuff|foo|bar|baz|qux|myVar|test1|data2)\b
+  file_types:
+    - js
+    - ts
+    - py
+message: >-
+  Meaningless variable name '{match}' detected at line {line}. Use descriptive names that
+  convey intent.
+tests:
+  fire:
+    - const temp = load();
+    - let thing = compute();
+  quiet:
+    - const invoiceTotal = load();
+    - const data = await response.json();

package/rules/VBC-049.yaml

@@ -0,0 +1,19 @@
+id: VBC-049
+name: magic-boolean
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: \b[a-zA-Z0-9_]+\((true|false)\s*,
+  file_types:
+    - js
+    - ts
+message: >-
+  Magic boolean passed as first argument at line {line}. Use named parameters or a descriptive
+  variable.
+tests:
+  fire:
+    - renderList(true, items);
+  quiet:
+    - 'renderList({ compact: true }, items);'

package/rules/VBC-051.yaml

@@ -0,0 +1,23 @@
+id: VBC-051
+name: mixed-casing
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - style
+match:
+  regex: >-
+    ((?<![.'\"])\b[a-z]+_[a-z]+\b(?!\s*[:?]).*?\b[a-z]+[A-Z][a-z]+\b)|(\b[a-z]+[A-Z][a-z]+\b.*?(?<![.'\"])\b[a-z]+_[a-z]+\b(?!\s*[:?]))
+  file_types:
+    - js
+    - ts
+message: >-
+  snake_case and camelCase mixed at line {line}. Pick one convention per file. Object keys
+  are not reported: a wire format often dictates those names.
+tests:
+  fire:
+    - const user_name = userName;
+  quiet:
+    - const userName = firstName;
+    - 'max_tokens: Math.min(maxTokens, 1024),'
+    - 'const body = { used_tokens: usedTokens };'

package/rules/VBC-052.yaml

@@ -0,0 +1,19 @@
+id: VBC-052
+name: single-letter-variables
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: \b(?:let|const|var)\s+(?!(?:i|j|k|n|x|y|z|e|t|_)\b)[a-z]\b
+  file_types:
+    - js
+    - ts
+message: >-
+  Single-letter variable name detected at line {line}. Use more descriptive names.
+tests:
+  fire:
+    - const p = loadProfile();
+  quiet:
+    - const profile = loadProfile();
+    - for (const i of items) { use(i); }

package/rules/VBC-053.yaml

@@ -0,0 +1,19 @@
+id: VBC-053
+name: redundant-interpolation
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: '`\$\{[a-zA-Z0-9_]+\}`'
+  scan: all
+  file_types:
+    - js
+    - ts
+message: >-
+  Redundant string interpolation detected at line {line}. Use the variable directly.
+tests:
+  fire:
+    - const label = `${count}`;
+  quiet:
+    - const label = `${count} items`;

package/rules/VBC-054.yaml

@@ -0,0 +1,29 @@
+id: VBC-054
+name: unnecessary-else
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: \breturn\b[^\n]*;?\s*\n?\s*\}\s*else\s*\{
+  multiline: true
+  file_types:
+    - js
+    - ts
+message: >-
+  Unnecessary 'else' after 'return' at line {line}. Remove the else and flatten the code.
+tests:
+  fire:
+    - |
+      if (ready) {
+        return 1;
+      } else {
+        return 2;
+      }
+  quiet:
+    - |
+      if (ready) {
+        start();
+      } else {
+        stop();
+      }

package/rules/VBC-056.yaml

@@ -0,0 +1,28 @@
+id: VBC-056
+name: stale-todo
+severity: warning
+category: clean-code
+tags:
+  - docs
+match:
+  regex: >-
+    \b(?:TODO|FIXME|HACK)\b[^\n]{0,90}?\b(?:temporar\w+|for now|quick fix|before (?:launch|release|prod\w*)|remove
+    (?:this|later|before)|revisit|come back)\b
+  flags: i
+  scan: comments
+  file_types:
+    - js
+    - ts
+    - py
+    - sh
+supersedes:
+  - VBC-907
+  - VBC-150
+message: >-
+  Debt marker that admits it is temporary at line {line}. Temporary code that ships is permanent
+  code. Give it an owner and a deadline, or finish it.
+tests:
+  fire:
+    - '// TODO: temporary shim until the new API lands'
+  quiet:
+    - '// TODO(fab): rework the cache key'

package/rules/VBC-057.yaml

@@ -0,0 +1,18 @@
+id: VBC-057
+name: use-any
+severity: warning
+category: core
+tags:
+  - typescript
+match:
+  regex: :\s*any\b
+  file_types:
+    - ts
+    - tsx
+message: >-
+  Avoid using 'any' type at line {line}. Use a more specific type or 'unknown'.
+tests:
+  fire:
+    - 'function parse(input: any) { return input; }'
+  quiet:
+    - 'function parse(input: unknown) { return input; }'

package/rules/VBC-058.yaml

@@ -0,0 +1,18 @@
+id: VBC-058
+name: overly-long-variable-name
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: \b(let|const|var)\s+[a-zA-Z0-9_]{35,}\b
+  file_types:
+    - js
+    - ts
+message: >-
+  Overly long variable name (>35 chars) detected at line {line}. This is getting too vibey.
+tests:
+  fire:
+    - const theAbsolutelyEnormousConfigurationObject = {};
+  quiet:
+    - const config = {};

package/rules/VBC-059.yaml

@@ -0,0 +1,21 @@
+id: VBC-059
+name: file-length-limit
+severity: warning
+category: core
+tags:
+  - clean-code
+match:
+  ast_check:
+    type: file-length-limit
+    threshold: 500
+message: >-
+  File is too long ({count} lines). Consider splitting it into smaller modules. Max recommended:
+  {threshold}.
+tests:
+  fire:
+    - code: |
+        const line = 1;
+      repeat: 520
+  quiet:
+    - |
+      const line = 1;

package/rules/VBC-063-B.yaml

@@ -0,0 +1,15 @@
+id: VBC-063-B
+name: empty-block
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  ast_check:
+    type: empty-block
+message: Empty block detected at line {line}. This code does nothing.
+tests:
+  fire:
+    - function noop() {}
+  quiet:
+    - function run() { start(); }

package/rules/VBC-063.yaml

@@ -0,0 +1,18 @@
+id: VBC-063
+name: empty-else
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: else\s*\{\s*\}
+  file_types:
+    - js
+    - ts
+    - py
+message: Empty else block detected at line {line}. This clutters the code.
+tests:
+  fire:
+    - if (ready) { start(); } else {}
+  quiet:
+    - if (ready) { start(); } else { stop(); }

package/rules/VBC-065.yaml

@@ -0,0 +1,33 @@
+id: VBC-065
+name: hadouken-nested-logic
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  ast_check:
+    type: nested-blocks-limit
+    threshold: 4
+message: >-
+  Nested logic is {count} levels deep at line {line}, over the limit of {threshold}. Return
+  early, extract the inner block, or invert a condition.
+tests:
+  fire:
+    - |
+      function deep(a) {
+        if (a) {
+          for (;;) {
+            while (a) {
+              if (a) {
+                switch (a) { default: break; }
+              }
+            }
+          }
+        }
+      }
+  quiet:
+    - |
+      function shallow(a) {
+        if (a) { return 1; }
+        return 0;
+      }

package/rules/VBC-066.yaml

@@ -0,0 +1,16 @@
+id: VBC-066
+name: redundant-if-true
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  ast_check:
+    type: redundant-if-true
+message: >-
+  Redundant 'if(true)' detected at line {line}. This logic is either debug code or unnecessary.
+tests:
+  fire:
+    - if (true) { start(); }
+  quiet:
+    - if (ready) { start(); }

package/rules/VBC-068.yaml

@@ -0,0 +1,21 @@
+id: VBC-068
+name: overuse-ternary
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: >-
+    \?(?![.:])[^\n]*?:[^\n]*?\?(?![.:])[^\n]*?:|\?(?![.:])[^\n]*?\?(?![.:])[^\n]*?:[^\n]*?:
+  file_types:
+    - js
+    - ts
+message: >-
+  Chained or nested ternary at line {line}. Stacked conditionals are hard to read and hard
+  to debug; use an if/else block or a lookup table.
+tests:
+  fire:
+    - 'const size = big ? ''lg'' : medium ? ''md'' : ''sm'';'
+  quiet:
+    - 'const size = big ? ''lg'' : ''sm'';'
+    - 'function f(a?: string, b?: number) {}'

package/rules/VBC-070.yaml

@@ -0,0 +1,19 @@
+id: VBC-070
+name: use-innerhtml
+severity: error
+category: core
+tags:
+  - security
+match:
+  regex: \.innerHTML\s*=(?!=)
+  file_types:
+    - js
+    - ts
+message: >-
+  Use of 'innerHTML' detected at line {line}. Use 'textContent' or a sanitizer to avoid XSS.
+tests:
+  fire:
+    - el.innerHTML = markup;
+  quiet:
+    - el.textContent = text;
+    - if (el.innerHTML === "") { init(); }