@rigour-labs/core 2.15.0 → 2.17.0

package/dist/gates/ast-handlers/python.d.ts

@@ -3,4 +3,5 @@ import { Failure } from '../../types/index.js';
 export declare class PythonHandler extends ASTHandler {
     supports(file: string): boolean;
     run(context: ASTHandlerContext): Promise<Failure[]>;
+    private getSecurityHint;
 }

package/dist/gates/ast-handlers/python.js

@@ -29,16 +29,19 @@ export class PythonHandler extends ASTHandler {
                 input: context.content,
                 cwd: context.cwd
             });
-            const metrics = JSON.parse(stdout);
-            if (metrics.error)
+            const result = JSON.parse(stdout);
+            if (result.error)
                 return [];
             const astConfig = this.config.ast || {};
+            const safetyConfig = this.config.safety || {};
             const maxComplexity = astConfig.complexity || 10;
             const maxParams = astConfig.max_params || 5;
             const maxMethods = astConfig.max_methods || 10;
+            // Process metrics (complexity, params, methods)
+            const metrics = result.metrics || [];
             for (const item of metrics) {
                 if (item.type === 'function') {
-                    if (item.parameters > maxParams) {
+                    if (item.parameters && item.parameters > maxParams) {
                         failures.push({
                             id: 'AST_MAX_PARAMS',
                             title: `Function '${item.name}' has ${item.parameters} parameters (max: ${maxParams})`,
@@ -47,7 +50,7 @@ export class PythonHandler extends ASTHandler {
                             hint: `Reduce number of parameters or use an options object.`
                         });
                     }
-                    if (item.complexity > maxComplexity) {
+                    if (item.complexity && item.complexity > maxComplexity) {
                         failures.push({
                             id: 'AST_COMPLEXITY',
                             title: `Function '${item.name}' has complexity of ${item.complexity} (max: ${maxComplexity})`,
@@ -58,7 +61,7 @@ export class PythonHandler extends ASTHandler {
                     }
                 }
                 else if (item.type === 'class') {
-                    if (item.methods > maxMethods) {
+                    if (item.methods && item.methods > maxMethods) {
                         failures.push({
                             id: 'AST_MAX_METHODS',
                             title: `Class '${item.name}' has ${item.methods} methods (max: ${maxMethods})`,
@@ -69,10 +72,41 @@ export class PythonHandler extends ASTHandler {
                     }
                 }
             }
+            // Process security issues (CSRF, hardcoded secrets, SQL injection, etc.)
+            const securityIssues = result.security || [];
+            for (const issue of securityIssues) {
+                const issueIdMap = {
+                    'hardcoded_secret': 'SECURITY_HARDCODED_SECRET',
+                    'csrf_disabled': 'SECURITY_CSRF_DISABLED',
+                    'code_injection': 'SECURITY_CODE_INJECTION',
+                    'insecure_deserialization': 'SECURITY_INSECURE_DESERIALIZATION',
+                    'command_injection': 'SECURITY_COMMAND_INJECTION',
+                    'sql_injection': 'SECURITY_SQL_INJECTION'
+                };
+                const id = issueIdMap[issue.issue] || 'SECURITY_ISSUE';
+                failures.push({
+                    id,
+                    title: issue.message,
+                    details: `Security issue in ${context.file} at line ${issue.lineno}: ${issue.name}`,
+                    files: [context.file],
+                    hint: this.getSecurityHint(issue.issue)
+                });
+            }
         }
         catch (e) {
             // If python3 is missing, we skip AST but other gates still run
         }
         return failures;
     }
+    getSecurityHint(issueType) {
+        const hints = {
+            'hardcoded_secret': 'Use environment variables: os.environ.get("SECRET_KEY")',
+            'csrf_disabled': 'Enable CSRF protection for all forms handling sensitive data',
+            'code_injection': 'Avoid eval/exec. Use safer alternatives like ast.literal_eval() for data parsing',
+            'insecure_deserialization': 'Use json.loads() instead of pickle for untrusted data',
+            'command_injection': 'Use subprocess with shell=False and pass arguments as a list',
+            'sql_injection': 'Use parameterized queries: cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))'
+        };
+        return hints[issueType] || 'Review and fix the security issue.';
+    }
 }

package/dist/gates/ast-handlers/typescript.js

@@ -14,14 +14,136 @@ export class TypeScriptHandler extends ASTHandler {
     }
     analyzeSourceFile(sourceFile, relativePath, failures) {
         const astConfig = this.config.ast || {};
+        const stalenessConfig = this.config.staleness || {};
+        const stalenessRules = stalenessConfig.rules || {};
         const maxComplexity = astConfig.complexity || 10;
         const maxMethods = astConfig.max_methods || 10;
         const maxParams = astConfig.max_params || 5;
+        // Limit failures per file to avoid output bloat on large files
+        const MAX_FAILURES_PER_FILE = 50;
+        const fileFailureCount = {};
+        const addFailure = (failure) => {
+            const ruleId = failure.id;
+            fileFailureCount[ruleId] = (fileFailureCount[ruleId] || 0) + 1;
+            if (fileFailureCount[ruleId] <= MAX_FAILURES_PER_FILE) {
+                failures.push(failure);
+                return true;
+            }
+            // Add summary failure once when limit is reached
+            if (fileFailureCount[ruleId] === MAX_FAILURES_PER_FILE + 1) {
+                failures.push({
+                    id: `${ruleId}_LIMIT_EXCEEDED`,
+                    title: `More than ${MAX_FAILURES_PER_FILE} ${ruleId} violations in ${relativePath}`,
+                    details: `Truncated output: showing first ${MAX_FAILURES_PER_FILE} violations. Consider fixing the root cause.`,
+                    files: [relativePath],
+                    hint: `This file has many violations. Fix them systematically or exclude the file if it's legacy code.`
+                });
+            }
+            return false;
+        };
+        // Helper to check if a staleness rule is enabled
+        const isRuleEnabled = (rule) => {
+            if (!stalenessConfig.enabled)
+                return false;
+            return stalenessRules[rule] !== false; // Enabled by default if staleness is on
+        };
         const visit = (node) => {
+            // === STALENESS CHECKS (Rule-based) ===
+            // no-var: Forbid legacy 'var' keyword
+            if (isRuleEnabled('no-var') && ts.isVariableStatement(node)) {
+                const declarationList = node.declarationList;
+                // NodeFlags: Let = 1, Const = 2, None = 0 (var)
+                if ((declarationList.flags & (ts.NodeFlags.Let | ts.NodeFlags.Const)) === 0) {
+                    const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                    addFailure({
+                        id: 'STALENESS_NO_VAR',
+                        title: `Stale 'var' keyword at line ${line}`,
+                        details: `Use 'const' or 'let' instead of 'var' in ${relativePath}:${line}`,
+                        files: [relativePath],
+                        hint: `Replace 'var' with 'const' (preferred) or 'let' for modern JavaScript.`
+                    });
+                }
+            }
+            // no-commonjs: Forbid require() in favor of import
+            if (isRuleEnabled('no-commonjs') && ts.isCallExpression(node)) {
+                if (ts.isIdentifier(node.expression) && node.expression.text === 'require') {
+                    const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                    addFailure({
+                        id: 'STALENESS_NO_COMMONJS',
+                        title: `CommonJS require() at line ${line}`,
+                        details: `Use ES6 'import' instead of 'require()' in ${relativePath}:${line}`,
+                        files: [relativePath],
+                        hint: `Replace require('module') with import module from 'module'.`
+                    });
+                }
+            }
+            // no-arguments: Forbid 'arguments' object (use rest params)
+            if (isRuleEnabled('no-arguments') && ts.isIdentifier(node) && node.text === 'arguments') {
+                // Check if it's actually the arguments keyword and not a variable named arguments
+                const parent = node.parent;
+                if (!ts.isVariableDeclaration(parent) && !ts.isPropertyAccessExpression(parent)) {
+                    const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                    addFailure({
+                        id: 'STALENESS_NO_ARGUMENTS',
+                        title: `Legacy 'arguments' object at line ${line}`,
+                        details: `Use rest parameters (...args) instead of 'arguments' in ${relativePath}:${line}`,
+                        files: [relativePath],
+                        hint: `Replace 'arguments' with rest parameters: function(...args) { }`
+                    });
+                }
+            }
+            // === SECURITY CHECKS (Prototype Pollution) ===
+            // Check for direct __proto__ access: obj.__proto__
+            if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.name) && node.name.text === '__proto__') {
+                const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                addFailure({
+                    id: 'SECURITY_PROTOTYPE_POLLUTION',
+                    title: `Direct __proto__ access at line ${line}`,
+                    details: `Prototype pollution vulnerability in ${relativePath}:${line}`,
+                    files: [relativePath],
+                    hint: `Use Object.getPrototypeOf() or Object.setPrototypeOf() instead of __proto__.`
+                });
+            }
+            // Check for bracket notation __proto__ access: obj["__proto__"]
+            if (ts.isElementAccessExpression(node) && ts.isStringLiteral(node.argumentExpression)) {
+                const accessKey = node.argumentExpression.text;
+                if (accessKey === '__proto__' || accessKey === 'constructor' || accessKey === 'prototype') {
+                    const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                    addFailure({
+                        id: 'SECURITY_PROTOTYPE_POLLUTION',
+                        title: `Unsafe bracket notation access to '${accessKey}' at line ${line}`,
+                        details: `Potential prototype pollution via bracket notation in ${relativePath}:${line}`,
+                        files: [relativePath],
+                        hint: `Block access to '${accessKey}' property when handling user input. Use allowlist for object keys.`
+                    });
+                }
+            }
+            // Check for Object.assign with user-controllable input (common prototype pollution pattern)
+            if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+                const propAccess = node.expression;
+                if (ts.isIdentifier(propAccess.expression) && propAccess.expression.text === 'Object' &&
+                    ts.isIdentifier(propAccess.name) && propAccess.name.text === 'assign') {
+                    // This is Object.assign() - warn if first arg is empty object (merge pattern)
+                    if (node.arguments.length >= 2) {
+                        const firstArg = node.arguments[0];
+                        if (ts.isObjectLiteralExpression(firstArg) && firstArg.properties.length === 0) {
+                            const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                            addFailure({
+                                id: 'SECURITY_PROTOTYPE_POLLUTION_MERGE',
+                                title: `Object.assign() merge pattern at line ${line}`,
+                                details: `Object.assign({}, ...) can propagate prototype pollution in ${relativePath}:${line}`,
+                                files: [relativePath],
+                                hint: `Validate and sanitize source objects before merging. Block __proto__ and constructor keys.`
+                            });
+                        }
+                    }
+                }
+            }
+            // === COMPLEXITY CHECKS ===
             if (ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node) || ts.isArrowFunction(node)) {
                 const name = this.getNodeName(node);
                 if (node.parameters.length > maxParams) {
-                    failures.push({
+                    addFailure({
                         id: 'AST_MAX_PARAMS',
                         title: `Function '${name}' has ${node.parameters.length} parameters (max: ${maxParams})`,
                         details: `High parameter count detected in ${relativePath}`,
@@ -46,7 +168,7 @@ export class TypeScriptHandler extends ASTHandler {
                 };
                 ts.forEachChild(node, countComplexity);
                 if (complexity > maxComplexity) {
-                    failures.push({
+                    addFailure({
                         id: 'AST_COMPLEXITY',
                         title: `Function '${name}' has cyclomatic complexity of ${complexity} (max: ${maxComplexity})`,
                         details: `High complexity detected in ${relativePath}`,
@@ -59,7 +181,7 @@ export class TypeScriptHandler extends ASTHandler {
                 const name = node.name?.text || 'Anonymous Class';
                 const methods = node.members.filter(ts.isMethodDeclaration);
                 if (methods.length > maxMethods) {
-                    failures.push({
+                    addFailure({
                         id: 'AST_MAX_METHODS',
                         title: `Class '${name}' has ${methods.length} methods (max: ${maxMethods})`,
                         details: `God Object pattern detected in ${relativePath}`,

package/dist/pattern-index/staleness.js

@@ -145,6 +145,128 @@ const BUILT_IN_DEPRECATIONS = [
         replacement: "useRouter from 'next/navigation' in App Router",
         severity: 'info',
         reason: 'Use next/navigation for App Router projects'
+    },
+    // ============================================================
+    // SECURITY PATTERNS - Cross-language security vulnerabilities
+    // ============================================================
+    // Python CSRF disabled
+    {
+        pattern: 'csrf\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Never disable CSRF protection. Remove 'csrf = False' and use proper CSRF tokens.",
+        severity: 'error',
+        reason: 'CSRF protection is critical for security. Disabling it exposes users to cross-site request forgery attacks.'
+    },
+    {
+        pattern: 'WTF_CSRF_ENABLED\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Never disable CSRF. Remove 'WTF_CSRF_ENABLED = False' from config.",
+        severity: 'error',
+        reason: 'Flask-WTF CSRF protection should never be disabled in production.'
+    },
+    {
+        pattern: "@csrf_exempt",
+        deprecatedIn: 'security',
+        replacement: "Remove @csrf_exempt decorator. Use proper CSRF token handling instead.",
+        severity: 'error',
+        reason: 'csrf_exempt bypasses CSRF protection, creating security vulnerabilities.'
+    },
+    // Python hardcoded secrets
+    {
+        pattern: "SECRET_KEY\\s*=\\s*['\"][^'\"]{1,50}['\"]",
+        deprecatedIn: 'security',
+        replacement: "Use os.environ.get('SECRET_KEY') or secrets.token_hex(32)",
+        severity: 'error',
+        reason: 'Hardcoded secrets are exposed in version control and logs. Use environment variables.'
+    },
+    {
+        pattern: "API_KEY\\s*=\\s*['\"][^'\"]+['\"]",
+        deprecatedIn: 'security',
+        replacement: "Use os.environ.get('API_KEY') for API credentials",
+        severity: 'error',
+        reason: 'Hardcoded API keys are a security risk. Use environment variables.'
+    },
+    {
+        pattern: "PASSWORD\\s*=\\s*['\"][^'\"]+['\"]",
+        deprecatedIn: 'security',
+        replacement: "Never hardcode passwords. Use environment variables or secret managers.",
+        severity: 'error',
+        reason: 'Hardcoded passwords are a critical security vulnerability.'
+    },
+    // JavaScript/TypeScript prototype pollution
+    {
+        pattern: '\\.__proto__',
+        deprecatedIn: 'security',
+        replacement: "Use Object.getPrototypeOf() or Object.setPrototypeOf() instead of __proto__",
+        severity: 'error',
+        reason: 'Direct __proto__ access enables prototype pollution attacks.'
+    },
+    {
+        pattern: '\\[\\s*[\'"]__proto__[\'"]\\s*\\]',
+        deprecatedIn: 'security',
+        replacement: "Never allow user input to access __proto__. Validate and sanitize object keys.",
+        severity: 'error',
+        reason: 'Bracket notation access to __proto__ is a prototype pollution vector.'
+    },
+    {
+        pattern: '\\[\\s*[\'"]constructor[\'"]\\s*\\]\\s*\\[',
+        deprecatedIn: 'security',
+        replacement: "Block access to constructor property from user input.",
+        severity: 'error',
+        reason: 'constructor[constructor] pattern enables prototype pollution.'
+    },
+    // SQL Injection patterns
+    {
+        pattern: 'cursor\\.execute\\s*\\(\\s*f[\'"]',
+        deprecatedIn: 'security',
+        replacement: "Use parameterized queries: cursor.execute('SELECT * FROM users WHERE id = %s', (user_id,))",
+        severity: 'error',
+        reason: 'F-string SQL queries are vulnerable to SQL injection attacks.'
+    },
+    {
+        pattern: '\\.execute\\s*\\([^)]*\\+[^)]*\\)',
+        deprecatedIn: 'security',
+        replacement: "Use parameterized queries instead of string concatenation.",
+        severity: 'error',
+        reason: 'String concatenation in SQL queries enables SQL injection.'
+    },
+    // XSS patterns
+    {
+        pattern: 'dangerouslySetInnerHTML',
+        deprecatedIn: 'security',
+        replacement: "Sanitize HTML with DOMPurify before using dangerouslySetInnerHTML, or use safe alternatives.",
+        severity: 'warning',
+        reason: 'dangerouslySetInnerHTML can lead to XSS vulnerabilities if content is not sanitized.'
+    },
+    {
+        pattern: '\\.innerHTML\\s*=',
+        deprecatedIn: 'security',
+        replacement: "Use textContent for text, or sanitize HTML before setting innerHTML.",
+        severity: 'warning',
+        reason: 'Direct innerHTML assignment can lead to XSS attacks.'
+    },
+    // Insecure session/cookie settings
+    {
+        pattern: 'SESSION_COOKIE_SECURE\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Set SESSION_COOKIE_SECURE = True in production",
+        severity: 'error',
+        reason: 'Insecure cookies can be intercepted over HTTP connections.'
+    },
+    {
+        pattern: 'SESSION_COOKIE_HTTPONLY\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Set SESSION_COOKIE_HTTPONLY = True to prevent XSS cookie theft",
+        severity: 'error',
+        reason: 'Non-HTTPOnly cookies are accessible via JavaScript, enabling XSS attacks.'
+    },
+    // Debug mode in production
+    {
+        pattern: 'DEBUG\\s*=\\s*True',
+        deprecatedIn: 'security',
+        replacement: "Use DEBUG = os.environ.get('DEBUG', 'False') == 'True'",
+        severity: 'warning',
+        reason: 'Debug mode in production exposes sensitive information and stack traces.'
     }
 ];
 /**

package/dist/templates/index.js

@@ -192,6 +192,19 @@ export const UNIVERSAL_CONFIG = {
             auto_classify: true,
             doc_sources: {},
         },
+        staleness: {
+            enabled: false,
+            rules: {
+                'no-var': true,
+                'no-commonjs': false,
+                'no-arguments': false,
+                'prefer-arrow': false,
+                'prefer-template': false,
+                'prefer-spread': false,
+                'prefer-rest': false,
+                'prefer-const': false,
+            },
+        },
     },
     output: {
         report_path: 'rigour-report.json',

package/dist/types/index.d.ts

@@ -30,6 +30,16 @@ export declare const GatesSchema: z.ZodObject<{
         max_class_dependencies?: number | undefined;
         max_function_lines?: number | undefined;
     }>>>;
+    staleness: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        rules: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        rules: Record<string, boolean>;
+    }, {
+        enabled?: boolean | undefined;
+        rules?: Record<string, boolean> | undefined;
+    }>>>;
     dependencies: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         forbid: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
         trusted_registry: z.ZodOptional<z.ZodString>;
@@ -140,6 +150,10 @@ export declare const GatesSchema: z.ZodObject<{
         max_class_dependencies: number;
         max_function_lines: number;
     };
+    staleness: {
+        enabled: boolean;
+        rules: Record<string, boolean>;
+    };
     dependencies: {
         forbid: string[];
         trusted_registry?: string | undefined;
@@ -188,6 +202,10 @@ export declare const GatesSchema: z.ZodObject<{
         max_class_dependencies?: number | undefined;
         max_function_lines?: number | undefined;
     } | undefined;
+    staleness?: {
+        enabled?: boolean | undefined;
+        rules?: Record<string, boolean> | undefined;
+    } | undefined;
     dependencies?: {
         forbid?: string[] | undefined;
         trusted_registry?: string | undefined;
@@ -289,6 +307,16 @@ export declare const ConfigSchema: z.ZodObject<{
             max_class_dependencies?: number | undefined;
             max_function_lines?: number | undefined;
         }>>>;
+        staleness: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            rules: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            rules: Record<string, boolean>;
+        }, {
+            enabled?: boolean | undefined;
+            rules?: Record<string, boolean> | undefined;
+        }>>>;
         dependencies: z.ZodDefault<z.ZodOptional<z.ZodObject<{
             forbid: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
             trusted_registry: z.ZodOptional<z.ZodString>;
@@ -399,6 +427,10 @@ export declare const ConfigSchema: z.ZodObject<{
             max_class_dependencies: number;
             max_function_lines: number;
         };
+        staleness: {
+            enabled: boolean;
+            rules: Record<string, boolean>;
+        };
         dependencies: {
             forbid: string[];
             trusted_registry?: string | undefined;
@@ -447,6 +479,10 @@ export declare const ConfigSchema: z.ZodObject<{
             max_class_dependencies?: number | undefined;
             max_function_lines?: number | undefined;
         } | undefined;
+        staleness?: {
+            enabled?: boolean | undefined;
+            rules?: Record<string, boolean> | undefined;
+        } | undefined;
         dependencies?: {
             forbid?: string[] | undefined;
             trusted_registry?: string | undefined;
@@ -514,6 +550,10 @@ export declare const ConfigSchema: z.ZodObject<{
             max_class_dependencies: number;
             max_function_lines: number;
         };
+        staleness: {
+            enabled: boolean;
+            rules: Record<string, boolean>;
+        };
         dependencies: {
             forbid: string[];
             trusted_registry?: string | undefined;
@@ -580,6 +620,10 @@ export declare const ConfigSchema: z.ZodObject<{
             max_class_dependencies?: number | undefined;
             max_function_lines?: number | undefined;
         } | undefined;
+        staleness?: {
+            enabled?: boolean | undefined;
+            rules?: Record<string, boolean> | undefined;
+        } | undefined;
         dependencies?: {
             forbid?: string[] | undefined;
             trusted_registry?: string | undefined;

package/dist/types/index.js

@@ -19,6 +19,20 @@ export const GatesSchema = z.object({
         max_class_dependencies: z.number().optional().default(5),
         max_function_lines: z.number().optional().default(50),
     }).optional().default({}),
+    staleness: z.object({
+        enabled: z.boolean().optional().default(false),
+        // Rule-based staleness detection (toggle individual rules)
+        rules: z.record(z.boolean()).optional().default({
+            'no-var': true, // var → const/let (ES6+)
+            'no-commonjs': false, // require() → import
+            'no-arguments': false, // arguments → rest params
+            'prefer-arrow': false, // function → arrow function
+            'prefer-template': false, // 'a' + b → `a${b}`
+            'prefer-spread': false, // apply() → spread
+            'prefer-rest': false, // arguments → ...args
+            'prefer-const': false, // let (unchanged) → const
+        }),
+    }).optional().default({}),
     dependencies: z.object({
         forbid: z.array(z.string()).optional().default([]),
         trusted_registry: z.string().optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "2.15.0",
+  "version": "2.17.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/gates/ast-handlers/python.ts

@@ -6,6 +6,29 @@ import { fileURLToPath } from 'url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
+interface SecurityIssue {
+    type: string;
+    issue: string;
+    name: string;
+    lineno: number;
+    message: string;
+}
+
+interface MetricItem {
+    type: string;
+    name: string;
+    complexity?: number;
+    parameters?: number;
+    methods?: number;
+    lineno: number;
+}
+
+interface PythonAnalysisResult {
+    metrics?: MetricItem[];
+    security?: SecurityIssue[];
+    error?: string;
+}
+
 export class PythonHandler extends ASTHandler {
     supports(file: string): boolean {
         return /\.py$/.test(file);
@@ -34,17 +57,20 @@ export class PythonHandler extends ASTHandler {
                 cwd: context.cwd
             });
 
-            const metrics = JSON.parse(stdout);
-            if (metrics.error) return [];
+            const result: PythonAnalysisResult = JSON.parse(stdout);
+            if (result.error) return [];
 
             const astConfig = this.config.ast || {};
+            const safetyConfig = this.config.safety || {};
             const maxComplexity = astConfig.complexity || 10;
             const maxParams = astConfig.max_params || 5;
             const maxMethods = astConfig.max_methods || 10;
 
+            // Process metrics (complexity, params, methods)
+            const metrics = result.metrics || [];
             for (const item of metrics) {
                 if (item.type === 'function') {
-                    if (item.parameters > maxParams) {
+                    if (item.parameters && item.parameters > maxParams) {
                         failures.push({
                             id: 'AST_MAX_PARAMS',
                             title: `Function '${item.name}' has ${item.parameters} parameters (max: ${maxParams})`,
@@ -53,7 +79,7 @@ export class PythonHandler extends ASTHandler {
                             hint: `Reduce number of parameters or use an options object.`
                         });
                     }
-                    if (item.complexity > maxComplexity) {
+                    if (item.complexity && item.complexity > maxComplexity) {
                         failures.push({
                             id: 'AST_COMPLEXITY',
                             title: `Function '${item.name}' has complexity of ${item.complexity} (max: ${maxComplexity})`,
@@ -63,7 +89,7 @@ export class PythonHandler extends ASTHandler {
                         });
                     }
                 } else if (item.type === 'class') {
-                    if (item.methods > maxMethods) {
+                    if (item.methods && item.methods > maxMethods) {
                         failures.push({
                             id: 'AST_MAX_METHODS',
                             title: `Class '${item.name}' has ${item.methods} methods (max: ${maxMethods})`,
@@ -75,10 +101,45 @@ export class PythonHandler extends ASTHandler {
                 }
             }
 
+            // Process security issues (CSRF, hardcoded secrets, SQL injection, etc.)
+            const securityIssues = result.security || [];
+            for (const issue of securityIssues) {
+                const issueIdMap: Record<string, string> = {
+                    'hardcoded_secret': 'SECURITY_HARDCODED_SECRET',
+                    'csrf_disabled': 'SECURITY_CSRF_DISABLED',
+                    'code_injection': 'SECURITY_CODE_INJECTION',
+                    'insecure_deserialization': 'SECURITY_INSECURE_DESERIALIZATION',
+                    'command_injection': 'SECURITY_COMMAND_INJECTION',
+                    'sql_injection': 'SECURITY_SQL_INJECTION'
+                };
+
+                const id = issueIdMap[issue.issue] || 'SECURITY_ISSUE';
+
+                failures.push({
+                    id,
+                    title: issue.message,
+                    details: `Security issue in ${context.file} at line ${issue.lineno}: ${issue.name}`,
+                    files: [context.file],
+                    hint: this.getSecurityHint(issue.issue)
+                });
+            }
+
         } catch (e: any) {
             // If python3 is missing, we skip AST but other gates still run
         }
 
         return failures;
     }
+
+    private getSecurityHint(issueType: string): string {
+        const hints: Record<string, string> = {
+            'hardcoded_secret': 'Use environment variables: os.environ.get("SECRET_KEY")',
+            'csrf_disabled': 'Enable CSRF protection for all forms handling sensitive data',
+            'code_injection': 'Avoid eval/exec. Use safer alternatives like ast.literal_eval() for data parsing',
+            'insecure_deserialization': 'Use json.loads() instead of pickle for untrusted data',
+            'command_injection': 'Use subprocess with shell=False and pass arguments as a list',
+            'sql_injection': 'Use parameterized queries: cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))'
+        };
+        return hints[issueType] || 'Review and fix the security issue.';
+    }
 }

package/src/gates/ast-handlers/python_parser.py

@@ -1,6 +1,7 @@
 import ast
 import sys
 import json
+import re
 
 class MetricsVisitor(ast.NodeVisitor):
     def __init__(self):
@@ -33,7 +34,7 @@ class MetricsVisitor(ast.NodeVisitor):
                 complexity += len(n.values) - 1
             elif isinstance(n, ast.IfExp):
                 complexity += 1
-        
+
         params = len(node.args.args) + len(node.args.kwonlyargs)
         if node.args.vararg: params += 1
         if node.args.kwarg: params += 1
@@ -46,12 +47,132 @@ class MetricsVisitor(ast.NodeVisitor):
             "lineno": node.lineno
         })
 
+
+class SecurityVisitor(ast.NodeVisitor):
+    """Detects security issues in Python code via AST analysis."""
+
+    def __init__(self, content):
+        self.issues = []
+        self.content = content
+        self.lines = content.split('\n')
+
+    def visit_Assign(self, node):
+        """Check for hardcoded secrets and CSRF disabled."""
+        for target in node.targets:
+            if isinstance(target, ast.Name):
+                name = target.id
+                # Check for hardcoded SECRET_KEY
+                if name == 'SECRET_KEY':
+                    if isinstance(node.value, ast.Constant) and isinstance(node.value.value, str):
+                        self.issues.append({
+                            "type": "security",
+                            "issue": "hardcoded_secret",
+                            "name": "SECRET_KEY",
+                            "lineno": node.lineno,
+                            "message": "Hardcoded SECRET_KEY detected. Use environment variables instead."
+                        })
+                # Check for hardcoded passwords/tokens
+                if name.upper() in ('PASSWORD', 'API_KEY', 'TOKEN', 'AUTH_TOKEN', 'PRIVATE_KEY', 'AWS_SECRET_KEY'):
+                    if isinstance(node.value, ast.Constant) and isinstance(node.value.value, str):
+                        self.issues.append({
+                            "type": "security",
+                            "issue": "hardcoded_secret",
+                            "name": name,
+                            "lineno": node.lineno,
+                            "message": f"Hardcoded {name} detected. Use environment variables instead."
+                        })
+                # Check for csrf = False
+                if name.lower() in ('csrf', 'csrf_enabled', 'wtf_csrf_enabled'):
+                    if isinstance(node.value, ast.Constant) and node.value.value == False:
+                        self.issues.append({
+                            "type": "security",
+                            "issue": "csrf_disabled",
+                            "name": name,
+                            "lineno": node.lineno,
+                            "message": "CSRF protection is disabled. This is a security vulnerability."
+                        })
+        self.generic_visit(node)
+
+    def visit_Call(self, node):
+        """Check for dangerous function calls."""
+        func_name = None
+        if isinstance(node.func, ast.Name):
+            func_name = node.func.id
+        elif isinstance(node.func, ast.Attribute):
+            func_name = node.func.attr
+
+        # Check for eval/exec usage
+        if func_name in ('eval', 'exec'):
+            self.issues.append({
+                "type": "security",
+                "issue": "code_injection",
+                "name": func_name,
+                "lineno": node.lineno,
+                "message": f"Use of {func_name}() detected. This can lead to code injection vulnerabilities."
+            })
+
+        # Check for pickle usage (insecure deserialization)
+        if func_name in ('loads', 'load') and isinstance(node.func, ast.Attribute):
+            if isinstance(node.func.value, ast.Name) and node.func.value.id == 'pickle':
+                self.issues.append({
+                    "type": "security",
+                    "issue": "insecure_deserialization",
+                    "name": "pickle",
+                    "lineno": node.lineno,
+                    "message": "Pickle deserialization is unsafe. Use json instead for untrusted data."
+                })
+
+        # Check for shell=True in subprocess
+        if func_name in ('run', 'call', 'Popen', 'check_output', 'check_call'):
+            for keyword in node.keywords:
+                if keyword.arg == 'shell' and isinstance(keyword.value, ast.Constant) and keyword.value.value == True:
+                    self.issues.append({
+                        "type": "security",
+                        "issue": "command_injection",
+                        "name": func_name,
+                        "lineno": node.lineno,
+                        "message": "shell=True in subprocess can lead to command injection."
+                    })
+
+        self.generic_visit(node)
+
+    def check_sql_injection(self):
+        """Check for SQL injection patterns using regex on source."""
+        sql_patterns = [
+            (r'execute\s*\(\s*["\'].*%s', 'SQL string formatting with %s'),
+            (r'execute\s*\(\s*f["\']', 'SQL f-string'),
+            (r'execute\s*\(\s*["\'].*\+', 'SQL string concatenation'),
+            (r'cursor\.execute\s*\(\s*["\'].*\.format\s*\(', 'SQL .format()'),
+        ]
+        for pattern, desc in sql_patterns:
+            for i, line in enumerate(self.lines, 1):
+                if re.search(pattern, line, re.IGNORECASE):
+                    self.issues.append({
+                        "type": "security",
+                        "issue": "sql_injection",
+                        "name": desc,
+                        "lineno": i,
+                        "message": f"Potential SQL injection: {desc}. Use parameterized queries."
+                    })
+
+
 def analyze_code(content):
     try:
         tree = ast.parse(content)
+
+        # Collect metrics
         visitor = MetricsVisitor()
         visitor.visit(tree)
-        return visitor.metrics
+
+        # Collect security issues
+        security_visitor = SecurityVisitor(content)
+        security_visitor.visit(tree)
+        security_visitor.check_sql_injection()
+
+        return {
+            "metrics": visitor.metrics,
+            "security": security_visitor.issues
+        }
     except Exception as e:
         return {"error": str(e)}
 

package/src/gates/ast-handlers/typescript.ts

@@ -18,16 +18,149 @@ export class TypeScriptHandler extends ASTHandler {
 
     private analyzeSourceFile(sourceFile: ts.SourceFile, relativePath: string, failures: Failure[]) {
         const astConfig = this.config.ast || {};
+        const stalenessConfig = (this.config as any).staleness || {};
+        const stalenessRules = stalenessConfig.rules || {};
         const maxComplexity = astConfig.complexity || 10;
         const maxMethods = astConfig.max_methods || 10;
         const maxParams = astConfig.max_params || 5;
 
+        // Limit failures per file to avoid output bloat on large files
+        const MAX_FAILURES_PER_FILE = 50;
+        const fileFailureCount: Record<string, number> = {};
+
+        const addFailure = (failure: Failure): boolean => {
+            const ruleId = failure.id;
+            fileFailureCount[ruleId] = (fileFailureCount[ruleId] || 0) + 1;
+            if (fileFailureCount[ruleId] <= MAX_FAILURES_PER_FILE) {
+                failures.push(failure);
+                return true;
+            }
+            // Add summary failure once when limit is reached
+            if (fileFailureCount[ruleId] === MAX_FAILURES_PER_FILE + 1) {
+                failures.push({
+                    id: `${ruleId}_LIMIT_EXCEEDED`,
+                    title: `More than ${MAX_FAILURES_PER_FILE} ${ruleId} violations in ${relativePath}`,
+                    details: `Truncated output: showing first ${MAX_FAILURES_PER_FILE} violations. Consider fixing the root cause.`,
+                    files: [relativePath],
+                    hint: `This file has many violations. Fix them systematically or exclude the file if it's legacy code.`
+                });
+            }
+            return false;
+        };
+
+        // Helper to check if a staleness rule is enabled
+        const isRuleEnabled = (rule: string): boolean => {
+            if (!stalenessConfig.enabled) return false;
+            return stalenessRules[rule] !== false; // Enabled by default if staleness is on
+        };
+
         const visit = (node: ts.Node) => {
+            // === STALENESS CHECKS (Rule-based) ===
+
+            // no-var: Forbid legacy 'var' keyword
+            if (isRuleEnabled('no-var') && ts.isVariableStatement(node)) {
+                const declarationList = node.declarationList;
+                // NodeFlags: Let = 1, Const = 2, None = 0 (var)
+                if ((declarationList.flags & (ts.NodeFlags.Let | ts.NodeFlags.Const)) === 0) {
+                    const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                    addFailure({
+                        id: 'STALENESS_NO_VAR',
+                        title: `Stale 'var' keyword at line ${line}`,
+                        details: `Use 'const' or 'let' instead of 'var' in ${relativePath}:${line}`,
+                        files: [relativePath],
+                        hint: `Replace 'var' with 'const' (preferred) or 'let' for modern JavaScript.`
+                    });
+                }
+            }
+
+            // no-commonjs: Forbid require() in favor of import
+            if (isRuleEnabled('no-commonjs') && ts.isCallExpression(node)) {
+                if (ts.isIdentifier(node.expression) && node.expression.text === 'require') {
+                    const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                    addFailure({
+                        id: 'STALENESS_NO_COMMONJS',
+                        title: `CommonJS require() at line ${line}`,
+                        details: `Use ES6 'import' instead of 'require()' in ${relativePath}:${line}`,
+                        files: [relativePath],
+                        hint: `Replace require('module') with import module from 'module'.`
+                    });
+                }
+            }
+
+            // no-arguments: Forbid 'arguments' object (use rest params)
+            if (isRuleEnabled('no-arguments') && ts.isIdentifier(node) && node.text === 'arguments') {
+                // Check if it's actually the arguments keyword and not a variable named arguments
+                const parent = node.parent;
+                if (!ts.isVariableDeclaration(parent) && !ts.isPropertyAccessExpression(parent)) {
+                    const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                    addFailure({
+                        id: 'STALENESS_NO_ARGUMENTS',
+                        title: `Legacy 'arguments' object at line ${line}`,
+                        details: `Use rest parameters (...args) instead of 'arguments' in ${relativePath}:${line}`,
+                        files: [relativePath],
+                        hint: `Replace 'arguments' with rest parameters: function(...args) { }`
+                    });
+                }
+            }
+
+            // === SECURITY CHECKS (Prototype Pollution) ===
+
+            // Check for direct __proto__ access: obj.__proto__
+            if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.name) && node.name.text === '__proto__') {
+                const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                addFailure({
+                    id: 'SECURITY_PROTOTYPE_POLLUTION',
+                    title: `Direct __proto__ access at line ${line}`,
+                    details: `Prototype pollution vulnerability in ${relativePath}:${line}`,
+                    files: [relativePath],
+                    hint: `Use Object.getPrototypeOf() or Object.setPrototypeOf() instead of __proto__.`
+                });
+            }
+
+            // Check for bracket notation __proto__ access: obj["__proto__"]
+            if (ts.isElementAccessExpression(node) && ts.isStringLiteral(node.argumentExpression)) {
+                const accessKey = node.argumentExpression.text;
+                if (accessKey === '__proto__' || accessKey === 'constructor' || accessKey === 'prototype') {
+                    const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                    addFailure({
+                        id: 'SECURITY_PROTOTYPE_POLLUTION',
+                        title: `Unsafe bracket notation access to '${accessKey}' at line ${line}`,
+                        details: `Potential prototype pollution via bracket notation in ${relativePath}:${line}`,
+                        files: [relativePath],
+                        hint: `Block access to '${accessKey}' property when handling user input. Use allowlist for object keys.`
+                    });
+                }
+            }
+
+            // Check for Object.assign with user-controllable input (common prototype pollution pattern)
+            if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+                const propAccess = node.expression;
+                if (ts.isIdentifier(propAccess.expression) && propAccess.expression.text === 'Object' &&
+                    ts.isIdentifier(propAccess.name) && propAccess.name.text === 'assign') {
+                    // This is Object.assign() - warn if first arg is empty object (merge pattern)
+                    if (node.arguments.length >= 2) {
+                        const firstArg = node.arguments[0];
+                        if (ts.isObjectLiteralExpression(firstArg) && firstArg.properties.length === 0) {
+                            const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                            addFailure({
+                                id: 'SECURITY_PROTOTYPE_POLLUTION_MERGE',
+                                title: `Object.assign() merge pattern at line ${line}`,
+                                details: `Object.assign({}, ...) can propagate prototype pollution in ${relativePath}:${line}`,
+                                files: [relativePath],
+                                hint: `Validate and sanitize source objects before merging. Block __proto__ and constructor keys.`
+                            });
+                        }
+                    }
+                }
+            }
+
+            // === COMPLEXITY CHECKS ===
+
             if (ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node) || ts.isArrowFunction(node)) {
                 const name = this.getNodeName(node);
 
                 if (node.parameters.length > maxParams) {
-                    failures.push({
+                    addFailure({
                         id: 'AST_MAX_PARAMS',
                         title: `Function '${name}' has ${node.parameters.length} parameters (max: ${maxParams})`,
                         details: `High parameter count detected in ${relativePath}`,
@@ -54,7 +187,7 @@ export class TypeScriptHandler extends ASTHandler {
                 ts.forEachChild(node, countComplexity);
 
                 if (complexity > maxComplexity) {
-                    failures.push({
+                    addFailure({
                         id: 'AST_COMPLEXITY',
                         title: `Function '${name}' has cyclomatic complexity of ${complexity} (max: ${maxComplexity})`,
                         details: `High complexity detected in ${relativePath}`,
@@ -69,7 +202,7 @@ export class TypeScriptHandler extends ASTHandler {
                 const methods = node.members.filter(ts.isMethodDeclaration);
 
                 if (methods.length > maxMethods) {
-                    failures.push({
+                    addFailure({
                         id: 'AST_MAX_METHODS',
                         title: `Class '${name}' has ${methods.length} methods (max: ${maxMethods})`,
                         details: `God Object pattern detected in ${relativePath}`,

package/src/pattern-index/staleness.ts

@@ -159,6 +159,136 @@ const BUILT_IN_DEPRECATIONS: DeprecationEntry[] = [
         replacement: "useRouter from 'next/navigation' in App Router",
         severity: 'info',
         reason: 'Use next/navigation for App Router projects'
+    },
+
+    // ============================================================
+    // SECURITY PATTERNS - Cross-language security vulnerabilities
+    // ============================================================
+
+    // Python CSRF disabled
+    {
+        pattern: 'csrf\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Never disable CSRF protection. Remove 'csrf = False' and use proper CSRF tokens.",
+        severity: 'error',
+        reason: 'CSRF protection is critical for security. Disabling it exposes users to cross-site request forgery attacks.'
+    },
+    {
+        pattern: 'WTF_CSRF_ENABLED\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Never disable CSRF. Remove 'WTF_CSRF_ENABLED = False' from config.",
+        severity: 'error',
+        reason: 'Flask-WTF CSRF protection should never be disabled in production.'
+    },
+    {
+        pattern: "@csrf_exempt",
+        deprecatedIn: 'security',
+        replacement: "Remove @csrf_exempt decorator. Use proper CSRF token handling instead.",
+        severity: 'error',
+        reason: 'csrf_exempt bypasses CSRF protection, creating security vulnerabilities.'
+    },
+
+    // Python hardcoded secrets
+    {
+        pattern: "SECRET_KEY\\s*=\\s*['\"][^'\"]{1,50}['\"]",
+        deprecatedIn: 'security',
+        replacement: "Use os.environ.get('SECRET_KEY') or secrets.token_hex(32)",
+        severity: 'error',
+        reason: 'Hardcoded secrets are exposed in version control and logs. Use environment variables.'
+    },
+    {
+        pattern: "API_KEY\\s*=\\s*['\"][^'\"]+['\"]",
+        deprecatedIn: 'security',
+        replacement: "Use os.environ.get('API_KEY') for API credentials",
+        severity: 'error',
+        reason: 'Hardcoded API keys are a security risk. Use environment variables.'
+    },
+    {
+        pattern: "PASSWORD\\s*=\\s*['\"][^'\"]+['\"]",
+        deprecatedIn: 'security',
+        replacement: "Never hardcode passwords. Use environment variables or secret managers.",
+        severity: 'error',
+        reason: 'Hardcoded passwords are a critical security vulnerability.'
+    },
+
+    // JavaScript/TypeScript prototype pollution
+    {
+        pattern: '\\.__proto__',
+        deprecatedIn: 'security',
+        replacement: "Use Object.getPrototypeOf() or Object.setPrototypeOf() instead of __proto__",
+        severity: 'error',
+        reason: 'Direct __proto__ access enables prototype pollution attacks.'
+    },
+    {
+        pattern: '\\[\\s*[\'"]__proto__[\'"]\\s*\\]',
+        deprecatedIn: 'security',
+        replacement: "Never allow user input to access __proto__. Validate and sanitize object keys.",
+        severity: 'error',
+        reason: 'Bracket notation access to __proto__ is a prototype pollution vector.'
+    },
+    {
+        pattern: '\\[\\s*[\'"]constructor[\'"]\\s*\\]\\s*\\[',
+        deprecatedIn: 'security',
+        replacement: "Block access to constructor property from user input.",
+        severity: 'error',
+        reason: 'constructor[constructor] pattern enables prototype pollution.'
+    },
+
+    // SQL Injection patterns
+    {
+        pattern: 'cursor\\.execute\\s*\\(\\s*f[\'"]',
+        deprecatedIn: 'security',
+        replacement: "Use parameterized queries: cursor.execute('SELECT * FROM users WHERE id = %s', (user_id,))",
+        severity: 'error',
+        reason: 'F-string SQL queries are vulnerable to SQL injection attacks.'
+    },
+    {
+        pattern: '\\.execute\\s*\\([^)]*\\+[^)]*\\)',
+        deprecatedIn: 'security',
+        replacement: "Use parameterized queries instead of string concatenation.",
+        severity: 'error',
+        reason: 'String concatenation in SQL queries enables SQL injection.'
+    },
+
+    // XSS patterns
+    {
+        pattern: 'dangerouslySetInnerHTML',
+        deprecatedIn: 'security',
+        replacement: "Sanitize HTML with DOMPurify before using dangerouslySetInnerHTML, or use safe alternatives.",
+        severity: 'warning',
+        reason: 'dangerouslySetInnerHTML can lead to XSS vulnerabilities if content is not sanitized.'
+    },
+    {
+        pattern: '\\.innerHTML\\s*=',
+        deprecatedIn: 'security',
+        replacement: "Use textContent for text, or sanitize HTML before setting innerHTML.",
+        severity: 'warning',
+        reason: 'Direct innerHTML assignment can lead to XSS attacks.'
+    },
+
+    // Insecure session/cookie settings
+    {
+        pattern: 'SESSION_COOKIE_SECURE\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Set SESSION_COOKIE_SECURE = True in production",
+        severity: 'error',
+        reason: 'Insecure cookies can be intercepted over HTTP connections.'
+    },
+    {
+        pattern: 'SESSION_COOKIE_HTTPONLY\\s*=\\s*False',
+        deprecatedIn: 'security',
+        replacement: "Set SESSION_COOKIE_HTTPONLY = True to prevent XSS cookie theft",
+        severity: 'error',
+        reason: 'Non-HTTPOnly cookies are accessible via JavaScript, enabling XSS attacks.'
+    },
+
+    // Debug mode in production
+    {
+        pattern: 'DEBUG\\s*=\\s*True',
+        deprecatedIn: 'security',
+        replacement: "Use DEBUG = os.environ.get('DEBUG', 'False') == 'True'",
+        severity: 'warning',
+        reason: 'Debug mode in production exposes sensitive information and stack traces.'
     }
 ];
 

package/src/templates/index.ts

@@ -208,6 +208,19 @@ export const UNIVERSAL_CONFIG: Config = {
             auto_classify: true,
             doc_sources: {},
         },
+        staleness: {
+            enabled: false,
+            rules: {
+                'no-var': true,
+                'no-commonjs': false,
+                'no-arguments': false,
+                'prefer-arrow': false,
+                'prefer-template': false,
+                'prefer-spread': false,
+                'prefer-rest': false,
+                'prefer-const': false,
+            },
+        },
     },
     output: {
         report_path: 'rigour-report.json',

package/src/types/index.ts

@@ -20,6 +20,20 @@ export const GatesSchema = z.object({
         max_class_dependencies: z.number().optional().default(5),
         max_function_lines: z.number().optional().default(50),
     }).optional().default({}),
+    staleness: z.object({
+        enabled: z.boolean().optional().default(false),
+        // Rule-based staleness detection (toggle individual rules)
+        rules: z.record(z.boolean()).optional().default({
+            'no-var': true,              // var → const/let (ES6+)
+            'no-commonjs': false,        // require() → import
+            'no-arguments': false,       // arguments → rest params
+            'prefer-arrow': false,       // function → arrow function
+            'prefer-template': false,    // 'a' + b → `a${b}`
+            'prefer-spread': false,      // apply() → spread
+            'prefer-rest': false,        // arguments → ...args
+            'prefer-const': false,       // let (unchanged) → const
+        }),
+    }).optional().default({}),
     dependencies: z.object({
         forbid: z.array(z.string()).optional().default([]),
         trusted_registry: z.string().optional(),