@fabriziosalmi/slopless 1.4.1

package/rules/VBC-212.yaml

@@ -0,0 +1,19 @@
+id: VBC-212
+name: keyboard-focus-awareness
+severity: warning
+category: ux-dx
+tags:
+  - accessibility
+match:
+  regex: :focus\s*\{.*?outline:\s*none
+  file_types:
+    - css
+    - scss
+message: >-
+  Suppressing focus outline without providing an alternative at line {line}. This makes keyboard
+  navigation impossible.
+tests:
+  fire:
+    - 'a:focus { outline: none; }'
+  quiet:
+    - 'a:focus { outline: 2px solid; }'

package/rules/VBC-215.yaml

@@ -0,0 +1,24 @@
+id: VBC-215
+name: global-pollutant
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - security
+match:
+  regex: >-
+    window\.(?!location\b|on[a-z]+\b|name\b|opener\b|status\b|document\b|history\b|scrollX\b|scrollY\b|top\b|self\b|parent\b)[a-zA-Z0-9_$]+\s*=(?!=)
+  file_types:
+    - js
+    - ts
+message: >-
+  Assignment to a window property at line {line}. Globals collide across scripts and outlive
+  the code that set them. Export the value, or attach it under one namespaced object if a
+  global is genuinely needed.
+tests:
+  fire:
+    - window.myApp = createApp();
+  quiet:
+    - window.location = target;
+    - window.onload = init;
+    - if (window.myApp === undefined) { boot(); }

package/rules/VBC-305.yaml

@@ -0,0 +1,20 @@
+id: VBC-305
+name: hardcoded-font-size
+severity: warning
+category: ux-dx
+tags:
+  - ux
+  - accessibility
+match:
+  regex: font-size:\s*[0-9]+(px|pt|pc)
+  file_types:
+    - css
+    - scss
+message: >-
+  Hardcoded font size '{match}' detected at line {line}. Use relative units (rem/em) for better
+  accessibility and user scale preferences.
+tests:
+  fire:
+    - 'body { font-size: 14px; }'
+  quiet:
+    - 'body { font-size: 1rem; }'

package/rules/VBC-324.yaml

@@ -0,0 +1,24 @@
+id: VBC-324
+name: condescending-language
+severity: warning
+category: docs
+tags:
+  - docs
+match:
+  regex: >-
+    \b(?:simply|basically|obviously|clearly|everyone knows|as anyone can see)\b|\bjust\s+(?:run|do|add|use|call|type|install|click|open|set)\b|\beasily\b
+  flags: i
+  file_types:
+    - md
+    - txt
+opt_in: true
+message: >-
+  Condescending or vague language '{match}' detected at line {line}. Be direct and avoid assumptions
+  about the reader's knowledge.
+tests:
+  fire:
+    - Simply run the installer.
+    - Just run npm install.
+  quiet:
+    - Run the installer.
+    - We just released version 2.

package/rules/VBC-334.yaml

@@ -0,0 +1,23 @@
+id: VBC-334
+name: ai-generated-fluff
+severity: warning
+category: docs
+tags:
+  - docs
+  - content
+match:
+  regex: >-
+    (As an AI language model|It's important to remember that|In conclusion,|Let's dive into|the
+    landscape of|tapestry of|delve into|unleash|unlocking|delving into|testament to)
+  flags: i
+  file_types:
+    - md
+    - txt
+message: >-
+  Potential AI-generated fluff or overused cliché '{match}' detected at line {line}. Keep
+  documentation concise and human-centric.
+tests:
+  fire:
+    - Let's dive into the tapestry of configuration.
+  quiet:
+    - This section covers configuration.

package/rules/VBC-338.yaml

@@ -0,0 +1,32 @@
+id: VBC-338
+name: non-inclusive-terminology
+severity: warning
+category: docs
+tags:
+  - docs
+  - inclusive-language
+match:
+  regex: >-
+    \bmaster[\s/-]?slave\b|\bslaves?\b|\bmaster\s+(?:branch|node|server|database|db|key|process|replica|copy)\b|\b(?:origin/)?master\b(?=\s*(?:branch\b|$))|\bblacklist(?:ed|ing)?\b|\bwhitelist(?:ed|ing)?\b|\bsanity[-
+    ]check\b
+  flags: i
+  scan: all
+  file_types:
+    - md
+    - txt
+    - js
+    - ts
+    - py
+message: >-
+  Non-inclusive terminology at line {line}. Prefer main, primary/replica, allowlist/blocklist,
+  and a plain "check". Domain uses such as an audio master bus or a mastering chain are not
+  reported.
+tests:
+  fire:
+    - Push to the master branch.
+    - Add the host to the whitelist.
+  quiet:
+    - Push to the main branch.
+    - Add the host to the allowlist.
+    - Master section accent colour.
+    - The audio mastering chain.

package/rules/VBC-340.yaml

@@ -0,0 +1,22 @@
+id: VBC-340
+name: gendered-address
+severity: warning
+category: docs
+tags:
+  - inclusive-language
+match:
+  regex: >-
+    \b(?:hey|you)\s+guys\b|\bguys\b|\bhe\s*/\s*she\b|\bhis\s*/\s*her\b|\bs\s*/\s*he\b
+  flags: i
+  file_types:
+    - md
+    - txt
+message: >-
+  Gendered language detected at line {line}. Use 'folks', 'everyone', or 'they'.
+tests:
+  fire:
+    - Hey guys, run the migration first.
+    - The reviewer must confirm he/she read it.
+  quiet:
+    - Run the migration first.
+    - She reviewed the pull request.

package/rules/VBC-344.yaml

@@ -0,0 +1,19 @@
+id: VBC-344
+name: non-iso-date
+severity: warning
+category: docs
+tags:
+  - docs
+match:
+  regex: >-
+    \b(0[1-9]|1[0-2])/(0[1-9]|[12][0-9]|3[01])/(19|20)\d\d\b|\d{1,2}-\d{1,2}-\d{4}
+  file_types:
+    - md
+    - txt
+message: >-
+  Non-ISO 8601 date found at line {line}. Use YYYY-MM-DD to avoid regional confusion.
+tests:
+  fire:
+    - Released on 03/14/2026.
+  quiet:
+    - Released on 2026-03-14.

package/rules/VBC-347.yaml

@@ -0,0 +1,21 @@
+id: VBC-347
+name: passive-voice
+severity: warning
+category: docs
+tags:
+  - docs
+  - style
+match:
+  regex: \b(?:is|are|was|were|be|been|being)\s+(?:\w+\s+)?\w+ed\s+by\b
+  flags: i
+  file_types:
+    - md
+opt_in: true
+message: >-
+  Potential passive voice at line {line}. Consider using active voice for clarity.
+tests:
+  fire:
+    - The schema is validated by the loader.
+  quiet:
+    - The loader validates the schema.
+    - The cache is advanced automatically.

package/rules/VBC-348.yaml

@@ -0,0 +1,19 @@
+id: VBC-348
+name: click-here-links
+severity: warning
+category: docs
+tags:
+  - accessibility
+  - docs
+match:
+  regex: \[(click here|read more|here)\]\(.*?\)
+  flags: i
+  file_types:
+    - md
+message: >-
+  Vague link text found at line {line}. Describe the destination for better accessibility.
+tests:
+  fire:
+    - See [click here](./guide.md).
+  quiet:
+    - See [the deployment guide](./guide.md).

package/rules/VBC-385.yaml

@@ -0,0 +1,21 @@
+id: VBC-385
+name: success-message-grammar
+severity: warning
+category: docs
+tags:
+  - ux
+  - copy
+match:
+  regex: '[''"]Data save success[''"]|[''"]Save success[''"]'
+  flags: i
+  scan: strings
+  file_types:
+    - js
+    - ts
+message: >-
+  Improper success message grammar at line {line}. Use 'Data saved successfully'.
+tests:
+  fire:
+    - toast('Data save success');
+  quiet:
+    - toast('Data saved successfully');

package/rules/VBC-398.yaml

@@ -0,0 +1,22 @@
+id: VBC-398
+name: panic-punctuation
+severity: warning
+category: docs
+tags:
+  - ux
+  - copy
+match:
+  regex: \w[!?]{2,}(?=[\s)\]\"'`]|$)
+  file_types:
+    - md
+    - txt
+opt_in: true
+message: >-
+  Excessive punctuation at line {line}. Professional copy should avoid multiple symbols like
+  '!!!'.
+tests:
+  fire:
+    - This matters!!!
+  quiet:
+    - This matters.
+    - const value = a ?? b;

package/rules/VBC-401.yaml

@@ -0,0 +1,12 @@
+id: VBC-401
+name: broken-links
+severity: warning
+category: docs
+tags:
+  - docs
+  - maintenance
+match:
+  heuristic_check: link-checker
+message: Broken link '{match}' ({url}) detected at line {line}.
+tests:
+  external: 'heuristic-checker.test.ts: resolves links against the filesystem'

package/rules/VBC-414.yaml

@@ -0,0 +1,23 @@
+id: VBC-414
+name: please-in-cli
+severity: warning
+category: docs
+tags:
+  - ux
+  - cli
+match:
+  regex: Please run|Please make sure
+  flags: i
+  file_types:
+    - md
+    - sh
+message: >-
+  Avoid using 'Please' in technical instructions at line {line}. Use direct imperative mood
+  (e.g., 'Run...' instead of 'Please run...').
+tests:
+  fire:
+    - file: fixture.md
+      code: Please run the migration first.
+  quiet:
+    - file: fixture.md
+      code: Run the migration first.

package/rules/VBC-421.yaml

@@ -0,0 +1,20 @@
+id: VBC-421
+name: filler-words
+severity: warning
+category: docs
+tags:
+  - docs
+  - style
+match:
+  regex: \b(essentially|actually|literally)\b
+  flags: i
+  file_types:
+    - md
+opt_in: true
+message: >-
+  Filler word detected at line {line}. Be more direct in your documentation.
+tests:
+  fire:
+    - This is essentially a cache.
+  quiet:
+    - This is a cache.

package/rules/VBC-501.yaml

@@ -0,0 +1,18 @@
+id: VBC-501
+name: boolean-naming-vibes
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - semantic
+match:
+  semantic_check: boolean-naming
+message: >-
+  Boolean variable '{name}' has no standard prefix. Consider is{name}, has{name}, or can{name}
+  for clarity.
+tests:
+  fire:
+    - const ready = true;
+  quiet:
+    - const isReady = true;
+    - const count = 3;

package/rules/VBC-502.yaml

@@ -0,0 +1,23 @@
+id: VBC-502
+name: redundant-boolean-logic
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - semantic
+match:
+  semantic_check: boolean-redundancy
+message: >-
+  Redundant boolean return detected. This if/else block can be replaced by a single 'return'
+  with a boolean expression.
+tests:
+  fire:
+    - |
+      function check(a) {
+        if (a) { return true; } else { return false; }
+      }
+  quiet:
+    - |
+      function check(a) {
+        return Boolean(a);
+      }

package/rules/VBC-503.yaml

@@ -0,0 +1,18 @@
+id: VBC-503
+name: collection-naming-vibes
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - semantic
+match:
+  semantic_check: collection-suffix
+message: >-
+  Array named '{name}' is missing a plural 's' or a collection suffix (List, Array). This
+  makes code less intuitive.
+tests:
+  fire:
+    - const user = [1, 2, 3];
+  quiet:
+    - const users = [1, 2, 3];
+    - const userList = [1];

package/rules/VBC-504.yaml

@@ -0,0 +1,20 @@
+id: VBC-504
+name: semantic-shadowing
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - semantic
+match:
+  semantic_check: semantic-shadowing
+message: >-
+  Variable '{name}' shadows a common library or system keyword. This can cause confusion during
+  debugging.
+tests:
+  fire:
+    - const path = req.query.path;
+    - const fs = createFakeFs();
+  quiet:
+    - const filePath = req.query.path;
+    - const fakeFs = createFakeFs();
+    - const res = await api.getNotes();

package/rules/VBC-800.yaml

@@ -0,0 +1,17 @@
+id: VBC-800
+name: floating-promise
+severity: error
+category: core
+tags:
+  - correctness
+  - async
+match:
+  file_types:
+    - ts
+    - tsx
+  type_check: floating-promise
+message: >-
+  Unawaited Promise detected. Expected await or return, but got {match}. Floating promises
+  can cause unhandled rejections and race conditions.
+tests:
+  external: 'type-checker.test.ts: needs a ts.Program and TypeChecker'

package/rules/VBC-901.yaml

@@ -0,0 +1,48 @@
+id: VBC-901
+name: hardcoded-ip-v4
+severity: warning
+category: security
+tags:
+  - security
+match:
+  regex: >-
+    \b(?!127\.|0\.0\.0\.0\b)(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b
+  scan: strings
+  file_types:
+    - js
+    - ts
+    - py
+    - go
+    - java
+    - json
+    - env
+  exclude_files:
+    - '**/test/**'
+    - '**/tests/**'
+    - '**/__tests__/**'
+    - '**/testdata/**'
+    - '**/fixtures/**'
+    - '**/test_*.py'
+    - '**/*_test.py'
+    - '**/test.py'
+    - '**/conftest.py'
+    - '**/*_test.go'
+    - '**/*_bench.go'
+    - '**/*.test.*'
+    - '**/*.spec.*'
+    - '**/bench/**'
+    - '**/benchmark*'
+    - '**/*corpus*'
+    - '**/*payload*'
+message: >-
+  Hardcoded IP address at line {line}. It pins the code to one environment. Read it from configuration.
+  Loopback and 0.0.0.0 are not reported: they name this machine rather than a particular host.
+tests:
+  fire:
+    - const host = '192.168.1.50';
+    - const dns = "8.8.8.8";
+  quiet:
+    - const host = process.env.DB_HOST;
+    - const version = '1.2';
+    - const local = '127.0.0.1';
+    - const bind = '0.0.0.0';

package/rules/VBC-902.yaml

@@ -0,0 +1,19 @@
+id: VBC-902
+name: document-write-slop
+severity: error
+category: security
+tags:
+  - security
+  - performance
+match:
+  regex: document\.write\(
+  file_types:
+    - js
+    - ts
+message: >-
+  document.write() is prohibited at line {line}. It is insecure and performance-heavy.
+tests:
+  fire:
+    - document.write("<p>hi</p>");
+  quiet:
+    - container.append(paragraph);

package/rules/VBC-903.yaml

@@ -0,0 +1,17 @@
+id: VBC-903
+name: eval-like-timers
+severity: error
+category: security
+tags:
+  - security
+match:
+  regex: (setTimeout|setInterval)\s*\(\s*['"].*?['"]
+  file_types:
+    - js
+    - ts
+message: Passing strings to timers is eval-like and insecure at line {line}.
+tests:
+  fire:
+    - setTimeout("poll()", 100);
+  quiet:
+    - setTimeout(poll, 100);

package/rules/VBC-904.yaml

@@ -0,0 +1,21 @@
+id: VBC-904
+name: magic-string
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: >-
+    (?<![.\w$])(?!(?:Error|TypeError|RangeError|SyntaxError|EvalError|URIError|log|info|warn|error|debug|trace|assert|describe|it|test|expect|require|import|t|_|gettext|translate|print)\s*\()[a-zA-Z_$][\w$]*\(\s*['\"][a-zA-Z0-9_\s]{10,}['\"]\s*\)
+  file_types:
+    - js
+    - ts
+message: >-
+  Magic string literal passed to function at line {line}. Use a named constant instead.
+tests:
+  fire:
+    - configure("some long option value");
+  quiet:
+    - throw new Error('failed to reach the database');
+    - console.log('worker pool started');
+    - describe('the retry scheduler', run);

package/rules/VBC-905.yaml

@@ -0,0 +1,17 @@
+id: VBC-905
+name: debug-console-usage
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: console\.(count|time|timeEnd|trace|profile)\(
+  file_types:
+    - js
+    - ts
+message: Debug console method '{line}' left in code. Remove before committing.
+tests:
+  fire:
+    - console.time("boot");
+  quiet:
+    - metrics.start("boot");

package/rules/VBC-906.yaml

@@ -0,0 +1,29 @@
+id: VBC-906
+name: fixme-technical-debt
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: >-
+    \bFIXME\b[^\n]{0,90}?\b(?:broken|crash\w*|leak\w*|race|deadlock|security|vulnerab\w+|data
+    ?loss|corrupt\w*|unsafe)\b
+  flags: i
+  scan: comments
+  file_types:
+    - js
+    - ts
+    - py
+    - sh
+    - css
+supersedes:
+  - VBC-907
+  - VBC-150
+message: >-
+  FIXME describing a live defect at line {line}. This is not style debt, it is a known bug
+  in shipped code. Open an issue and fix it.
+tests:
+  fire:
+    - // FIXME the parser crashes on empty input
+  quiet:
+    - '// FIXME(fab): tidy the parser'

package/rules/VBC-907.yaml

@@ -0,0 +1,24 @@
+id: VBC-907
+name: anonymous-todo
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: >-
+    \b(?:TODO|FIXME|HACK|XXX)\b(?!\s*[\(\[][^)\]\n]+[\)\]])(?!\s*:?\s*(?:#\d+|[A-Z][A-Z0-9]+-\d+))
+  scan: comments
+  file_types:
+    - js
+    - ts
+    - py
+    - sh
+message: >-
+  Unattributed debt marker at line {line}. Nobody owns it, so nobody will fix it. Use TODO(owner):
+  or reference an issue such as TODO: #123.
+tests:
+  fire:
+    - '// TODO: wire up retries'
+  quiet:
+    - '// TODO(fab): wire up retries'
+    - '// TODO: #123 wire up retries'

package/rules/VBC-908.yaml

@@ -0,0 +1,22 @@
+id: VBC-908
+name: long-inline-style
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - css
+match:
+  regex: style\s*=\s*['"].{50,}['"]
+  file_types:
+    - html
+    - js
+    - ts
+    - tsx
+message: >-
+  Overly long inline style attribute at line {line}. Move styles to a CSS file or component.
+tests:
+  fire:
+    - >-
+      <div style="display:flex;align-items:center;justify-content:space-between;padding:8px">x</div>
+  quiet:
+    - <div className="row">x</div>

package/rules/VBC-909.yaml

@@ -0,0 +1,21 @@
+id: VBC-909
+name: empty-interface-ts
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - typescript
+match:
+  ast_check:
+    type: empty-interface
+message: >-
+  Empty interface detected. If intentional, add a comment; otherwise, remove it.
+tests:
+  fire:
+    - file: fixture.ts
+      code: interface Options {}
+  quiet:
+    - file: fixture.ts
+      code: interface Options extends BaseOptions {}
+    - file: fixture.ts
+      code: 'interface Options { retries: number; }'