@fabriziosalmi/slopless 1.4.1

package/rules/VBC-910.yaml

@@ -0,0 +1,18 @@
+id: VBC-910
+name: console-table-leaks
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+match:
+  regex: console\.table\(
+  file_types:
+    - js
+    - ts
+message: >-
+  console.table() left in code at line {line}. Useful for debug, but clutters production logs.
+tests:
+  fire:
+    - console.table(rows);
+  quiet:
+    - renderTable(rows);

package/rules/VBC-911.yaml

@@ -0,0 +1,21 @@
+id: VBC-911
+name: meaningless-helper-names
+severity: warning
+category: clean-code
+tags:
+  - clean-code
+  - semantic
+match:
+  regex: class\s+[a-zA-Z0-9_]*(Manager|Helper|Common|Util|Base)\b
+  file_types:
+    - js
+    - ts
+    - py
+message: >-
+  Generic class name '{match}' detected. Use more specific semantic names (e.g., 'AuthValidator'
+  instead of 'AuthHelper').
+tests:
+  fire:
+    - class UserManager {}
+  quiet:
+    - class UserRepository {}

package/rules/VBC-913.yaml

@@ -0,0 +1,30 @@
+id: VBC-913
+name: outline-none-hazard
+severity: error
+category: ux-dx
+tags:
+  - accessibility
+  - ux
+match:
+  regex: >-
+    outline:\s*(?:none|0)\b(?![\s\S]{0,400}?:focus-visible[\s\S]{0,140}?outline\s*:\s*(?!none|0|\s*;))
+  multiline: true
+  file_types:
+    - css
+    - scss
+message: >-
+  Focus outline removed at line {line} with nothing replacing it. Keyboard users lose all
+  sense of position. Pair it with a :focus-visible rule that draws a visible ring, which is
+  what this rule looks for before reporting.
+tests:
+  fire:
+    - 'a:focus { outline: none; }'
+  quiet:
+    - 'a:focus { outline: 2px solid currentColor; }'
+    - |
+      *:focus {
+        outline: none;
+      }
+      *:focus-visible {
+        outline: 3px solid #0ff;
+      }

package/rules/VBC-914.yaml

@@ -0,0 +1,31 @@
+id: VBC-914
+name: cursor-pointer-on-text
+severity: warning
+category: ux-dx
+tags:
+  - ux
+match:
+  regex: cursor:\s*pointer
+  file_types:
+    - css
+  exclude_selectors:
+    - button
+    - a
+    - summary
+    - label
+    - '[role=''button'']'
+    - '[role="button"]'
+    - input[type='submit']
+    - input[type='button']
+    - .btn
+    - .button
+    - .clickable
+message: >-
+  cursor: pointer applied to potentially non-interactive element at line {line}. Don't lie
+  to the user about clickability. Only use for truly interactive components.
+tests:
+  fire:
+    - '.card { cursor: pointer; }'
+  quiet:
+    - 'button { cursor: pointer; }'
+    - 'a:hover { cursor: pointer; }'

package/rules/VBC-915.yaml

@@ -0,0 +1,19 @@
+id: VBC-915
+name: user-select-none-slop
+severity: warning
+category: ux-dx
+tags:
+  - ux
+  - accessibility
+match:
+  regex: user-select:\s*none
+  file_types:
+    - css
+message: >-
+  user-select: none detected at line {line}. Preventing users from copying text is usually
+  a dark pattern.
+tests:
+  fire:
+    - 'body { user-select: none; }'
+  quiet:
+    - 'body { user-select: text; }'

package/rules/VBC-916.yaml

@@ -0,0 +1,24 @@
+id: VBC-916
+name: vague-link-text-ux
+severity: warning
+category: ux-dx
+tags:
+  - ux
+  - accessibility
+match:
+  regex: '>\s*(click here|read more|learn more|here|this link)\s*<'
+  flags: i
+  file_types:
+    - html
+    - tsx
+    - jsx
+message: >-
+  Vague link text '{match}' detected at line {line}. Use descriptive labels (e.g., 'View detailed
+  report') for clarity and screen reader accessibility.
+tests:
+  fire:
+    - file: fixture.html
+      code: <a href="/x">click here</a>
+  quiet:
+    - file: fixture.html
+      code: <a href="/x">the deployment guide</a>

package/rules/VBC-917.yaml

@@ -0,0 +1,21 @@
+id: VBC-917
+name: shouting-documentation
+severity: warning
+category: docs
+tags:
+  - documentation
+  - style
+match:
+  regex: \b[A-Z]{3,}\b(?:\s+\b[A-Z]{2,}\b){3,}
+  file_types:
+    - md
+    - txt
+opt_in: true
+message: >-
+  Sustained all-caps text at line {line}. Shouting does not add emphasis, it costs readability.
+  Use bold or a callout instead.
+tests:
+  fire:
+    - READ THIS BEFORE YOU DEPLOY ANYTHING
+  quiet:
+    - Read this before you deploy.

package/rules/VBC-918.yaml

@@ -0,0 +1,22 @@
+id: VBC-918
+name: we-detected-tone
+severity: warning
+category: docs
+tags:
+  - documentation
+  - style
+match:
+  regex: We detected|We have identified
+  flags: i
+  file_types:
+    - md
+    - txt
+opt_in: true
+message: >-
+  Avoid first-person collective ('We') in system messages at line {line}. Use neutral or user-centric
+  language.
+tests:
+  fire:
+    - We detected a problem with your configuration.
+  quiet:
+    - The configuration is missing a database URL.

package/rules/VBC-920.yaml

@@ -0,0 +1,20 @@
+id: VBC-920
+name: relative-link-format
+severity: warning
+category: docs
+tags:
+  - documentation
+  - maintenance
+match:
+  regex: \]\((?![a-z]+:|/|\.)
+  file_types:
+    - md
+message: >-
+  Relative local link missing './' prefix at line {line}. Use [link](./path/to/file) for better
+  tool compatibility.
+tests:
+  fire:
+    - See [the guide](guide.md).
+  quiet:
+    - See [the guide](./guide.md).
+    - See [the site](https://example.com).

package/rules/VBC-921.yaml

@@ -0,0 +1,45 @@
+id: VBC-921
+name: hardcoded-outdated-year
+severity: warning
+category: docs
+tags:
+  - documentation
+  - maintenance
+match:
+  file_types:
+    - md
+    - txt
+    - js
+    - ts
+    - tsx
+    - jsx
+    - css
+    - py
+    - go
+    - rs
+    - html
+  exclude_files:
+    - '**/test/**'
+    - '**/tests/**'
+    - '**/__tests__/**'
+    - '**/testdata/**'
+    - '**/fixtures/**'
+    - '**/test_*.py'
+    - '**/*_test.py'
+    - '**/test.py'
+    - '**/conftest.py'
+    - '**/*_test.go'
+    - '**/*_bench.go'
+    - '**/*.test.*'
+    - '**/*.spec.*'
+    - '**/bench/**'
+    - '**/benchmark*'
+    - '**/*corpus*'
+    - '**/*payload*'
+  heuristic_check: stale-copyright-year
+message: >-
+  Copyright notice ends at a year that has passed: {match}. It is now {year}. Use a range
+  ending in the current year, or generate the year at build time.
+tests:
+  external: >-
+    heuristic-checker.test.ts: compares against the year the run happens in

package/rules/VBC-922.yaml

@@ -0,0 +1,15 @@
+id: VBC-922
+name: too-many-staged-files
+severity: warning
+category: git
+tags:
+  - git
+  - dx
+match:
+  git_check: too_many_staged_files
+  threshold: 30
+message: >-
+  Staging {count} files (limit: {threshold}). Large commits are harder to review. Split your
+  work.
+tests:
+  external: 'git-checker.test.ts: needs a staged file list'

package/rules/VBC-923.yaml

@@ -0,0 +1,15 @@
+id: VBC-923
+name: filename-too-long-hazard
+severity: warning
+category: git
+tags:
+  - git
+  - cross-platform
+match:
+  git_check: filename_too_long
+  threshold: 50
+message: >-
+  Filename length {length} exceeds {threshold} characters. This might cause issues on some
+  systems.
+tests:
+  external: 'git-checker.test.ts: needs a staged file list'

package/rules/VBC-924.yaml

@@ -0,0 +1,12 @@
+id: VBC-924
+name: missing-readme-root
+severity: error
+category: git
+tags:
+  - git
+  - project-health
+match:
+  git_check: missing_readme
+message: No README file found in project root. Documentation is non-negotiable.
+tests:
+  external: 'git-checker.test.ts: needs a repository working tree'

package/rules/VBC-925.yaml

@@ -0,0 +1,14 @@
+id: VBC-925
+name: large-file-staged
+severity: warning
+category: git
+tags:
+  - git
+  - performance
+match:
+  git_check: large_file_size
+  threshold: 1048576
+message: >-
+  File is over 1MB ({size} bytes). Consider using Git LFS or external storage.
+tests:
+  external: 'git-checker.test.ts: needs files on disk'

package/rules/VBC-926.yaml

@@ -0,0 +1,14 @@
+id: VBC-926
+name: short-commit-message-check
+severity: warning
+category: git
+tags:
+  - git
+  - dx
+match:
+  git_check: commit_message_too_short
+  threshold: 10
+message: >-
+  Commit message is likely too short. Provide more context about the 'why' of your changes.
+tests:
+  external: 'git-checker.test.ts: needs .git/COMMIT_EDITMSG'

package/rules/VBC-927.yaml

@@ -0,0 +1,24 @@
+id: VBC-927
+name: vague-button-label
+severity: warning
+category: docs
+tags:
+  - ux
+  - documentation
+match:
+  regex: <button.*?>\s*(Click|Submit|OK|Go)\s*</button>
+  flags: i
+  file_types:
+    - html
+    - tsx
+    - jsx
+message: >-
+  Vague button label '{match}' detected at line {line}. Use action-oriented labels (e.g.,
+  'Save Changes', 'Create Account').
+tests:
+  fire:
+    - file: fixture.html
+      code: <button>Submit</button>
+  quiet:
+    - file: fixture.html
+      code: <button>Create account</button>

package/rules/VBC-928.yaml

@@ -0,0 +1,25 @@
+id: VBC-928
+name: lorem-ipsum-docs
+severity: error
+category: docs
+tags:
+  - documentation
+  - slop
+match:
+  regex: Lorem ipsum dolor sit amet
+  flags: i
+  scan: strings
+  file_types:
+    - md
+    - txt
+    - html
+    - js
+    - ts
+message: >-
+  Placeholder text 'Lorem ipsum' detected at line {line}. Replace with real content before
+  committing.
+tests:
+  fire:
+    - Lorem ipsum dolor sit amet, consectetur.
+  quiet:
+    - Real documentation content.

package/rules/VBC-929.yaml

@@ -0,0 +1,21 @@
+id: VBC-929
+name: technical-jargon-slop
+severity: warning
+category: docs
+tags:
+  - documentation
+match:
+  regex: >-
+    (architectural paradigm|synergistic integration|leverage fundamental|cross-platform interoperability|holistic
+    approach)
+  flags: i
+  file_types:
+    - md
+    - txt
+opt_in: true
+message: Avoid buzzword-heavy jargon at line {line}. Be direct and clear.
+tests:
+  fire:
+    - A holistic approach to synergistic integration.
+  quiet:
+    - The loader reads YAML rules from disk.

package/rules/VBC-930.yaml

@@ -0,0 +1,16 @@
+id: VBC-930
+name: missing-contributing
+severity: warning
+category: git
+tags:
+  - git
+  - project-health
+  - dx
+match:
+  git_check: missing_contributing
+message: >-
+  Missing CONTRIBUTING.md file. Without contribution guidelines, external contributors must
+  guess how to set up the dev environment, run tests, and submit pull requests. A CONTRIBUTING.md
+  reduces friction and sets expectations for code quality standards.
+tests:
+  external: 'git-checker.test.ts: needs a repository working tree'

package/rules/VBC-931.yaml

@@ -0,0 +1,16 @@
+id: VBC-931
+name: missing-security-policy
+severity: warning
+category: git
+tags:
+  - git
+  - security
+  - project-health
+match:
+  git_check: missing_security
+message: >-
+  Missing SECURITY.md file. Without a security disclosure policy, researchers who find vulnerabilities
+  in your project have no private channel to report them and may resort to public disclosure.
+  Add a SECURITY.md with a contact email and responsible disclosure policy.
+tests:
+  external: 'git-checker.test.ts: needs a repository working tree'

package/rules/VBC-932.yaml

@@ -0,0 +1,16 @@
+id: VBC-932
+name: missing-changelog
+severity: warning
+category: git
+tags:
+  - git
+  - project-health
+  - dx
+match:
+  git_check: missing_changelog
+message: >-
+  Missing CHANGELOG.md (or HISTORY.md) file. Developers who depend on your project need to
+  know exactly what changed between versions to assess upgrade risk. Follow "Keep a Changelog"
+  standards with Added, Changed, Deprecated, Removed, Fixed, and Security sections per release.
+tests:
+  external: 'git-checker.test.ts: needs a repository working tree'

package/rules/VBC-933.yaml

@@ -0,0 +1,28 @@
+id: VBC-933
+name: coming-soon-docs
+severity: warning
+category: docs
+tags:
+  - docs
+  - maintenance
+match:
+  regex: (coming soon|under construction|not yet written|🚧\s*wip|todo:\s*write)
+  flags: i
+  file_types:
+    - md
+    - txt
+message: >-
+  Placeholder documentation content '{match}' at line {line}. Documentation stubs with "coming
+  soon" text signal an abandoned project to new contributors. Either write the section or
+  remove the header entirely. Git history preserves the intent if you need to revisit it later.
+tests:
+  fire:
+    - |
+      ## Configuration
+
+      Coming soon.
+  quiet:
+    - |
+      ## Configuration
+
+      Set DATABASE_URL.

package/rules/VBC-934.yaml

@@ -0,0 +1,24 @@
+id: VBC-934
+name: personal-opinion-docs
+severity: warning
+category: docs
+tags:
+  - docs
+  - style
+match:
+  regex: \b(I think|I believe|I feel that|in my opinion|IMO|IMHO|personally,)\b
+  flags: i
+  file_types:
+    - md
+    - txt
+opt_in: true
+message: >-
+  Personal opinion language '{match}' in documentation at line {line}. Technical documentation
+  should be objective and factual. Personal opinions erode credibility and confuse readers
+  about whether a recommendation is a design constraint or a preference. Use "this approach"
+  or cite evidence instead.
+tests:
+  fire:
+    - I think this is the better default.
+  quiet:
+    - This is the default because it is safer.

package/rules/VBC-935.yaml

@@ -0,0 +1,26 @@
+id: VBC-935
+name: colloquial-language
+severity: warning
+category: docs
+tags:
+  - docs
+  - style
+match:
+  regex: >-
+    \b(touch base|circle back|deep dive|low-hanging fruit|move the needle|game changer|paradigm
+    shift|the whole nine yards|ballpark figure|boil the ocean|drink the kool-aid|drink the
+    koolaid)\b
+  flags: i
+  file_types:
+    - md
+    - txt
+opt_in: true
+message: >-
+  Corporate colloquialism or buzzword '{match}' in documentation at line {line}. Jargon and
+  idioms are confusing for non-native English speakers and make documentation sound unprofessional.
+  Use plain, direct language.
+tests:
+  fire:
+    - Let's circle back on the deep dive.
+  quiet:
+    - We will review the design on Tuesday.

package/rules/VBC-936.yaml

@@ -0,0 +1,24 @@
+id: VBC-936
+name: outdated-experimental-tag
+severity: warning
+category: docs
+tags:
+  - docs
+  - maintenance
+match:
+  regex: >-
+    \[\s*(?:EXPERIMENTAL|ALPHA|UNSTABLE|PREVIEW)\s*\]|(?:⚠️|:warning:)\s*\*{0,2}(?:experimental|alpha|unstable)\b|^\s*>\s*\*{0,2}(?:experimental|unstable)\b
+  flags: im
+  file_types:
+    - md
+    - txt
+message: >-
+  Experimental or alpha status tag '{match}' at line {line}. If this feature has been in production
+  for more than six months, remove the disclaimer. Stale warnings erode trust in documentation
+  accuracy and prevent users from adopting stable APIs.
+tests:
+  fire:
+    - '[EXPERIMENTAL] The plugin API may change.'
+  quiet:
+    - Sort the entries in alphabetical order.
+    - The plugin API is stable.

package/rules/VBC-937.yaml

@@ -0,0 +1,24 @@
+id: VBC-937
+name: client-side-auth-check
+severity: error
+category: security
+tags:
+  - security
+  - ai-error
+match:
+  regex: >-
+    (localStorage|sessionStorage)\.(getItem|setItem)\s*\(\s*['"](?:token|auth|role|user|admin|permission)['"]\s*\)
+  file_types:
+    - js
+    - ts
+    - jsx
+    - tsx
+message: >-
+  Authentication token or role stored/read from browser storage at line {line}. Client-side
+  auth logic is trivially bypassable. Validate identity server-side on every request. Never
+  trust data in localStorage or sessionStorage for access control decisions.
+tests:
+  fire:
+    - const role = localStorage.getItem('role');
+  quiet:
+    - const theme = localStorage.getItem('theme');

package/rules/VBC-938.yaml

@@ -0,0 +1,23 @@
+id: VBC-938
+name: command-injection-risk
+severity: error
+category: security
+tags:
+  - security
+  - ai-error
+match:
+  regex: >-
+    (exec|execSync|spawn|spawnSync|system|popen)\s*\(\s*[`'"][^`'"]*\$\{|child_process\.(exec|execSync)\s*\(\s*[^)]*\+
+  file_types:
+    - js
+    - ts
+    - py
+message: >-
+  Potential command injection at line {line}. Shell commands constructed with string interpolation
+  or concatenation allow attackers to execute arbitrary commands. Use parameterized commands
+  (e.g. execFile with an args array) and never interpolate untrusted input into shell strings.
+tests:
+  fire:
+    - exec(`ls ${userDir}`);
+  quiet:
+    - execFile('ls', [userDir]);

package/rules/VBC-939.yaml

@@ -0,0 +1,23 @@
+id: VBC-939
+name: unrestricted-file-upload
+severity: error
+category: security
+tags:
+  - security
+  - ai-error
+match:
+  regex: >-
+    (multer|formidable|busboy|diskStorage)\s*\(\s*\{[^}]*\}|req\.files?\s*\[\s*['"][^'"]+['"]\s*\]\s*\.(?:mv|pipe|save)\s*\(
+  file_types:
+    - js
+    - ts
+message: >-
+  File upload handler at line {line} may lack type/size restrictions. Without validating MIME
+  type, file extension, and size, attackers can upload malicious executables or exhaust disk
+  space. Add allowlist-based extension validation and a strict size limit before processing
+  any uploaded file.
+tests:
+  fire:
+    - 'const upload = multer({ dest: "uploads/" });'
+  quiet:
+    - const upload = multer(storageConfig);

package/rules/VBC-940.yaml

@@ -0,0 +1,30 @@
+id: VBC-940
+name: float-currency-arithmetic
+severity: error
+category: security
+tags:
+  - security
+  - correctness
+  - ai-error
+match:
+  regex: >-
+    \b(?:(?:price|cost|fee|fees|tax|subtotal|payment|invoice|salary|refund|charge)(?![a-z])|[a-z_$]+(?:Price|Cost|Fee|Fees|Tax|Subtotal|Payment|Invoice|Salary|Refund|Charge)(?![a-z]))[A-Za-z_$]*\s*[*/+\-]=?\s*0\.[0-9]|\b(?:(?:price|cost|fee|fees|tax|subtotal|payment|invoice|salary|refund|charge)(?![a-z])|[a-z_$]+(?:Price|Cost|Fee|Fees|Tax|Subtotal|Payment|Invoice|Salary|Refund|Charge)(?![a-z]))[A-Za-z_$]*\s*=\s*[a-zA-Z_$][\w$]*\s*[*/]\s*[a-zA-Z_$][\w$]*
+  file_types:
+    - js
+    - ts
+    - py
+supersedes:
+  - VBC-007
+message: >-
+  Floating-point arithmetic on monetary value '{match}' at line {line}. Float imprecision
+  causes rounding errors in financial calculations (e.g. 0.1 + 0.2 != 0.3). Use integer cents/minor
+  units or a dedicated decimal library (decimal.js, big.js, Python's Decimal) for all money
+  math.
+tests:
+  fire:
+    - const total = price * 0.22;
+  quiet:
+    - const totalCents = priceCents * 22;
+    - const wet = amount * 0.5;
+    - const pan = balance * 0.5;
+    - const g = rate * 0.35;