cqs-audit 2.0.0 → 2.1.0

package/dist/cqs-mcp.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// cqs-mcp v2.0.0 — Code Quality Studio MCP Server
+// cqs-mcp v2.1.0 — Code Quality Studio MCP Server
 
 
 // bin/cqs-mcp.entry.js
@@ -1283,6 +1283,30 @@ await page.clock.fastForward('02:00'); // jump 2 hours`,
       }, disabled);
     }
   }
+  {
+    const hasTitleTag = /(?:test|describe)\s*(?:\.\w+)?\s*\(\s*['"`][^'"`]*@[\w-]+/.test(content);
+    const hasTagOption = /\btag\s*:\s*(?:['"`]@|\[)/.test(content);
+    const hasGrepAnnotation = /test\.info\s*\(\s*\)\s*\.annotations|annotation\s*:\s*\{/.test(content);
+    if (totalTests > 0 && !hasTitleTag && !hasTagOption && !hasGrepAnnotation) {
+      addFindingLocal(findings, {
+        ruleId: "PW-STD-007",
+        category: "coding_standards",
+        severity: "info",
+        title: "Tests carry no tag for selective runs",
+        description: "No test or describe in this file carries a @tag in its title or a tag option, so these tests cannot be selected with --grep.",
+        impact: "CI must run the whole suite on every commit \u2014 no smoke subset, and a flaky spec can only be excluded by skipping it outright.",
+        fix: `// Either in the title
+test('checkout completes @smoke', async ({ page }) => { /* ... */ });
+
+// Or as a tag option (Playwright 1.42+)
+test('checkout completes', { tag: ['@smoke', '@billing'] }, async ({ page }) => { /* ... */ });
+
+// then: npx playwright test --grep @smoke`,
+        line: lineMatches(content, /\btest\s*\(/)[0] ?? null,
+        reference: "https://playwright.dev/docs/test-annotations#tag-tests"
+      }, disabled);
+    }
+  }
   const categoryScores = Object.fromEntries(
     CATEGORY_IDS.map((id) => [id, scoreFromFindings(findings, id)])
   );
@@ -1973,6 +1997,7 @@ var CATEGORY_IDS2 = AUDIT_STACKS.java_api.categories.map((c) => c.id);
 function analyseJavaApiLocally(filename, content, options = {}) {
   const disabledRuleIds = options.disabledRuleIds ?? /* @__PURE__ */ new Set();
   const findings = [];
+  const lines = content.split(/\r?\n/);
   const sqlConcat = lineMatches2(content, /\+\s*["']|["']\s*\+.*SELECT|executeQuery\s*\(\s*["'][^"']*\+/i);
   if (sqlConcat.length || /Statement\s+\w+\s*=|createStatement\s*\(/.test(content)) {
     const stmt = lineMatches2(content, /createStatement\s*\(/);
@@ -2247,6 +2272,227 @@ class OrderServiceTest { ... }`,
     fix: "Resolve the item or link it to a tracked issue.",
     line: jTodo[0]
   }, disabledRuleIds);
+  const pathTraversal = lineMatches2(content, /new\s+File\s*\(\s*(?!["'])[\w.]*(?:request|param|input|userPath|fileName|filename)|Paths\.get\s*\(\s*(?!["'])[\w.]*(?:request|param|input|fileName|filename)/i);
+  if (pathTraversal.length) pushFinding(findings, {
+    ruleId: "JV-SEC-005",
+    category: "security",
+    severity: "critical",
+    title: "Path traversal risk \u2014 user input in a file path",
+    description: 'A file path is built from a request/user-supplied value without normalisation, so "../" segments can escape the intended directory.',
+    impact: "An attacker can read or overwrite arbitrary files on the server (CWE-22).",
+    fix: `Path base = Paths.get("/srv/uploads").toAbsolutePath().normalize();
+Path target = base.resolve(fileName).normalize();
+if (!target.startsWith(base)) throw new SecurityException("Invalid path");`,
+    line: pathTraversal[0],
+    reference: "https://cwe.mitre.org/data/definitions/22.html"
+  }, disabledRuleIds);
+  const deser = lineMatches2(content, /new\s+ObjectInputStream\s*\(|\.readObject\s*\(\s*\)/);
+  if (deser.length) pushFinding(findings, {
+    ruleId: "JV-SEC-006",
+    category: "security",
+    severity: "critical",
+    title: "Unsafe Java deserialization",
+    description: "ObjectInputStream.readObject() reconstructs arbitrary classes from the byte stream.",
+    impact: "If the stream is attacker-controlled this is remote code execution via gadget chains (CWE-502).",
+    fix: `// Prefer a data format that does not instantiate arbitrary types
+ObjectMapper mapper = new ObjectMapper();
+MyDto dto = mapper.readValue(json, MyDto.class);`,
+    line: deser[0],
+    reference: "https://cwe.mitre.org/data/definitions/502.html"
+  }, disabledRuleIds);
+  const xmlParser = lineMatches2(content, /DocumentBuilderFactory\.newInstance|SAXParserFactory\.newInstance|XMLInputFactory\.newInstance/);
+  const xxeGuarded = /disallow-doctype-decl|XMLConstants\.FEATURE_SECURE_PROCESSING|setExpandEntityReferences\s*\(\s*false|IS_SUPPORTING_EXTERNAL_ENTITIES/.test(content);
+  if (xmlParser.length && !xxeGuarded) pushFinding(findings, {
+    ruleId: "JV-SEC-007",
+    category: "security",
+    severity: "critical",
+    title: "XML parser without XXE protection",
+    description: "An XML parser factory is created without disabling DOCTYPE declarations or external entities.",
+    impact: "XML External Entity attacks can read local files or trigger SSRF from parsed documents (CWE-611).",
+    fix: `DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
+f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+f.setXIncludeAware(false);
+f.setExpandEntityReferences(false);`,
+    line: xmlParser[0],
+    reference: "https://cwe.mitre.org/data/definitions/611.html"
+  }, disabledRuleIds);
+  const logSensitive = lineMatches2(content, /log(?:ger)?\s*\.\s*(?:info|debug|warn|error|trace)\s*\([^)]*(?:password|passwd|secret|token|apiKey|api_key|ssn|creditCard|cvv)/i);
+  if (logSensitive.length) pushFinding(findings, {
+    ruleId: "JV-SEC-008",
+    category: "security",
+    severity: "critical",
+    title: "Sensitive data written to logs",
+    description: `A log statement at line ${logSensitive[0]} interpolates a credential or personal identifier.`,
+    impact: "Secrets and PII leak into log aggregators and backups, where they are rarely access-controlled or rotated.",
+    fix: `// Log an identifier, never the secret itself
+log.info("Authenticated userId={}", user.getId());`,
+    line: logSensitive[0],
+    reference: "https://cwe.mitre.org/data/definitions/532.html"
+  }, disabledRuleIds);
+  const unsafeFormatter = lineMatches2(content, /(?:private|public|protected|static)[\w\s]*\b(?:SimpleDateFormat|Calendar)\s+\w+\s*=/);
+  if (unsafeFormatter.length) pushFinding(findings, {
+    ruleId: "JV-CON-003",
+    category: "concurrency",
+    severity: "critical",
+    title: "SimpleDateFormat / Calendar held as a shared field",
+    description: "SimpleDateFormat and Calendar are mutable and not thread-safe, but this one is a field shared across requests.",
+    impact: "Under concurrency this silently produces wrong dates or throws \u2014 a bug that never reproduces in single-threaded tests.",
+    fix: `// Thread-safe and immutable
+private static final DateTimeFormatter FMT =
+    DateTimeFormatter.ofPattern("yyyy-MM-dd");`,
+    line: unsafeFormatter[0],
+    reference: "https://docs.oracle.com/javase/8/docs/api/java/time/format/DateTimeFormatter.html"
+  }, disabledRuleIds);
+  const unboundedPool = lineMatches2(content, /Executors\.newCachedThreadPool\s*\(|Executors\.newFixedThreadPool\s*\(\s*\d{3,}/);
+  if (unboundedPool.length) pushFinding(findings, {
+    ruleId: "JV-CON-004",
+    category: "concurrency",
+    severity: "warning",
+    title: "Unbounded or oversized thread pool",
+    description: "newCachedThreadPool() grows without limit; a very large fixed pool has the same effect.",
+    impact: "A traffic spike creates threads until the JVM exhausts memory, taking the service down rather than shedding load.",
+    fix: `new ThreadPoolExecutor(8, 32, 60L, TimeUnit.SECONDS,
+    new ArrayBlockingQueue<>(500),
+    new ThreadPoolExecutor.CallerRunsPolicy());`,
+    line: unboundedPool[0]
+  }, disabledRuleIds);
+  const repoWrites = countMatches2(content, /\.(?:save|saveAll|delete|deleteAll|update|persist|merge)\s*\(/g);
+  const isService = /@Service\b|@Component\b/.test(content);
+  if (isService && repoWrites >= 2 && !/@Transactional/.test(content)) pushFinding(findings, {
+    ruleId: "JV-DAT-002",
+    category: "data_access",
+    severity: "critical",
+    title: "Multiple writes without @Transactional",
+    description: `This service performs ${repoWrites} repository write calls but declares no @Transactional boundary.`,
+    impact: "A failure part-way through leaves the database in a half-written state that no rollback will undo.",
+    fix: `@Transactional
+public void transfer(Long from, Long to, BigDecimal amount) {
+    accounts.debit(from, amount);
+    accounts.credit(to, amount);
+}`,
+    line: lineMatches2(content, /\.(?:save|delete|update|persist|merge)\s*\(/)[0] ?? null
+  }, disabledRuleIds);
+  const unpaged = lineMatches2(content, /\.findAll\s*\(\s*\)/);
+  if (unpaged.length) pushFinding(findings, {
+    ruleId: "JV-DAT-003",
+    category: "data_access",
+    severity: "warning",
+    title: "findAll() without pagination",
+    description: "findAll() with no Pageable loads the entire table into memory.",
+    impact: "Fine on a seeded dev database, then OOMs in production once the table grows.",
+    fix: `Page<User> page = userRepository.findAll(PageRequest.of(0, 50));`,
+    line: unpaged[0]
+  }, disabledRuleIds);
+  const optionalGet = lineMatches2(content, /\.get\s*\(\s*\)/).filter((ln) => {
+    const l = lines[ln - 1] || "";
+    return /Optional|findBy|findById/.test(l) && !/isPresent|isEmpty|orElse|ifPresent/.test(l);
+  });
+  if (optionalGet.length) pushFinding(findings, {
+    ruleId: "JV-ERR-004",
+    category: "error_handling",
+    severity: "warning",
+    title: "Optional.get() without a presence check",
+    description: `Line ${optionalGet[0]} unwraps an Optional directly instead of handling the empty case.`,
+    impact: "Throws NoSuchElementException, which surfaces as an opaque HTTP 500 rather than a meaningful 404.",
+    fix: `User user = userRepository.findById(id)
+    .orElseThrow(() -> new ResourceNotFoundException("User " + id));`,
+    line: optionalGet[0]
+  }, disabledRuleIds);
+  const rawResource = lineMatches2(content, /=\s*new\s+(?:FileInputStream|FileOutputStream|FileReader|FileWriter|BufferedReader|Socket|Scanner)\s*\(/).filter((ln) => !/try\s*\(/.test(lines[ln - 1] || ""));
+  if (rawResource.length) pushFinding(findings, {
+    ruleId: "JV-ERR-005",
+    category: "error_handling",
+    severity: "warning",
+    title: "Closeable opened outside try-with-resources",
+    description: `A stream or reader is opened at line ${rawResource[0]} without try-with-resources.`,
+    impact: "An exception before close() leaks the file handle or socket; enough leaks exhaust the descriptor limit.",
+    fix: `try (BufferedReader reader = new BufferedReader(new FileReader(path))) {
+    return reader.lines().toList();
+}`,
+    line: rawResource[0]
+  }, disabledRuleIds);
+  const stringVars = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    const m = /\bString\s+(\w+)\s*=/.exec(line);
+    if (m) stringVars.add(m[1]);
+  }
+  const isStringAccum = (text) => {
+    for (const re of [/(\w+)\s*\+=\s*[^;]+;/g, /(\w+)\s*=\s*\1\s*\+\s*[^;]+;/g]) {
+      let m;
+      while (m = re.exec(text)) if (stringVars.has(m[1])) return true;
+    }
+    return false;
+  };
+  const concatInLoop = [];
+  lines.forEach((line, idx) => {
+    if (!/\b(?:for|while)\s*\(/.test(line)) return;
+    let depth = (line.match(/\{/g) || []).length - (line.match(/\}/g) || []).length;
+    if (depth <= 0) {
+      if (isStringAccum(line.slice(line.indexOf("{") + 1))) concatInLoop.push(idx + 1);
+      return;
+    }
+    for (let j = idx + 1; j < lines.length && depth > 0; j++) {
+      if (isStringAccum(lines[j])) {
+        concatInLoop.push(j + 1);
+        break;
+      }
+      depth += (lines[j].match(/\{/g) || []).length - (lines[j].match(/\}/g) || []).length;
+    }
+  });
+  if (concatInLoop.length) pushFinding(findings, {
+    ruleId: "JV-PER-002",
+    category: "performance",
+    severity: "warning",
+    title: "String concatenation inside a loop",
+    description: `Line ${concatInLoop[0]} builds a String with + inside a loop, allocating a new String each iteration.`,
+    impact: "Quadratic time and garbage churn; noticeable once the loop runs thousands of times.",
+    fix: `StringBuilder sb = new StringBuilder();
+for (String part : parts) sb.append(part);
+return sb.toString();`,
+    line: concatInLoop[0]
+  }, disabledRuleIds);
+  const httpClient = lineMatches2(content, /new\s+RestTemplate\s*\(\s*\)|HttpClient\.newHttpClient\s*\(\s*\)/);
+  const hasTimeout = /setConnectTimeout|setReadTimeout|connectTimeout|HttpComponentsClientHttpRequestFactory|\.timeout\s*\(/.test(content);
+  if (httpClient.length && !hasTimeout) pushFinding(findings, {
+    ruleId: "JV-PER-003",
+    category: "performance",
+    severity: "critical",
+    title: "HTTP client without timeouts",
+    description: "A RestTemplate or HttpClient is created with default settings, which means no connect or read timeout.",
+    impact: "One slow upstream ties up request threads until the pool is exhausted \u2014 the classic cascading outage.",
+    fix: `RestTemplate rt = new RestTemplateBuilder()
+    .setConnectTimeout(Duration.ofSeconds(2))
+    .setReadTimeout(Duration.ofSeconds(5))
+    .build();`,
+    line: httpClient[0]
+  }, disabledRuleIds);
+  const isController = /@RestController\b|@Controller\b/.test(content);
+  if (isController && /@Entity\b/.test(content)) pushFinding(findings, {
+    ruleId: "JV-API-004",
+    category: "api_design",
+    severity: "warning",
+    title: "JPA entity exposed by a controller",
+    description: "A @Entity type is referenced directly in a controller instead of a dedicated response DTO.",
+    impact: "Every column becomes part of the public contract, lazy associations blow up during serialisation, and a schema rename silently breaks clients.",
+    fix: `public record UserResponse(Long id, String email) {
+    static UserResponse from(User u) { return new UserResponse(u.getId(), u.getEmail()); }
+}`,
+    line: lineMatches2(content, /@Entity\b/)[0] ?? null
+  }, disabledRuleIds);
+  const hasEquals = /public\s+boolean\s+equals\s*\(\s*Object/.test(content);
+  const hasHashCode = /public\s+int\s+hashCode\s*\(\s*\)/.test(content);
+  if (hasEquals !== hasHashCode) pushFinding(findings, {
+    ruleId: "JV-STD-003",
+    category: "java_standards",
+    severity: "warning",
+    title: `${hasEquals ? "equals() without hashCode()" : "hashCode() without equals()"}`,
+    description: "equals() and hashCode() must be overridden together to honour the Object contract.",
+    impact: "Objects that are equal land in different hash buckets, so HashMap/HashSet lookups silently miss.",
+    fix: `@Override public boolean equals(Object o) { /* ... */ }
+@Override public int hashCode() { return Objects.hash(id); }`,
+    line: lineMatches2(content, hasEquals ? /public\s+boolean\s+equals\s*\(/ : /public\s+int\s+hashCode\s*\(/)[0] ?? null,
+    reference: "https://docs.oracle.com/javase/8/docs/api/java/lang/Object.html#hashCode--"
+  }, disabledRuleIds);
   const crit = findings.filter((f) => f.severity === "critical").length;
   const summary = crit > 0 ? `Java API scan of ${filename}: ${findings.length} finding(s), ${crit} critical (security/data).` : `Java API scan of ${filename}: ${findings.length} finding(s) from standard JVM/API rules.`;
   return buildAuditResult({
@@ -2729,7 +2975,8 @@ void setUp() { page = context.newPage(); page.navigate("/app"); }`,
     line: screenshot[0],
     reference: "https://playwright.dev/java/docs/trace-viewer"
   }, disabledRuleIds);
-  if (/Playwright\.create\s*\(/.test(content) && !/try\s*\(/.test(content)) pushFinding(findings, {
+  const closedInTeardown = /@(?:AfterAll|AfterClass|AfterEach|After)\b[\s\S]{0,400}?\b(?:playwright|browser)\s*\.\s*close\s*\(/i.test(content);
+  if (/Playwright\.create\s*\(/.test(content) && !/try\s*\(/.test(content) && !closedInTeardown) pushFinding(findings, {
     ruleId: "PWJ-RES-001",
     category: "resource_mgmt",
     severity: "warning",
@@ -2790,6 +3037,212 @@ page.navigate("/login");`,
     line: absUrl[0],
     reference: "https://playwright.dev/java/docs/test-runners"
   }, disabledRuleIds);
+  const testStarts = [];
+  lines.forEach((l, i) => {
+    if (/^\s*@Test\b/.test(l)) testStarts.push(i);
+  });
+  const blockOf = (k) => {
+    const start = testStarts[k];
+    const rest = lines.slice(start + 1);
+    const nextAnn = rest.findIndex((l) => /^\s*@(?:Test|BeforeEach|BeforeAll|AfterEach|AfterAll|ParameterizedTest)\b/.test(l));
+    return rest.slice(0, nextAnn === -1 ? rest.length : nextAnn).join("\n");
+  };
+  const querySelector = lineMatches2(content, /\.querySelector(?:All)?\s*\(/);
+  if (querySelector.length) pushFinding(findings, {
+    ruleId: "PWJ-SEL-004",
+    category: "selectors",
+    severity: "warning",
+    title: "Legacy querySelector API",
+    description: `querySelector()/querySelectorAll() returns an ElementHandle on line ${querySelector[0]}.`,
+    impact: "ElementHandles resolve once and never re-query, so they go stale after a re-render and skip Playwright's auto-waiting.",
+    fix: `// Before
+ElementHandle el = page.querySelector(".row");
+// After
+Locator row = page.locator(".row");
+assertThat(row).isVisible();`,
+    line: querySelector[0],
+    reference: "https://playwright.dev/java/docs/locators"
+  }, disabledRuleIds);
+  const waitForNav = lineMatches2(content, /waitForNavigation\s*\(/);
+  if (waitForNav.length) pushFinding(findings, {
+    ruleId: "PWJ-REL-005",
+    category: "reliability",
+    severity: "warning",
+    title: "Deprecated waitForNavigation()",
+    description: `waitForNavigation() is used on line ${waitForNav[0]}.`,
+    impact: "Deprecated and inherently racy \u2014 the navigation can complete before the waiter is attached, which hangs the test until timeout.",
+    fix: `// Before
+page.waitForNavigation(() -> page.getByRole(AriaRole.LINK).click());
+// After
+page.getByRole(AriaRole.LINK).click();
+assertThat(page).hasURL(Pattern.compile("/orders"));`,
+    line: waitForNav[0],
+    reference: "https://playwright.dev/java/docs/navigations"
+  }, disabledRuleIds);
+  const networkIdle = lineMatches2(content, /WaitUntilState\.NETWORKIDLE|setWaitUntil\s*\([^)]*NETWORKIDLE/i);
+  if (networkIdle.length) pushFinding(findings, {
+    ruleId: "PWJ-REL-006",
+    category: "reliability",
+    severity: "warning",
+    title: "Waiting on NETWORKIDLE",
+    description: `A NETWORKIDLE wait state is requested on line ${networkIdle[0]}.`,
+    impact: "Discouraged by Playwright: polling, analytics beacons or websockets keep the network busy, so the wait times out or resolves at an arbitrary moment.",
+    fix: `// Before
+page.navigate("/dashboard", new Page.NavigateOptions().setWaitUntil(WaitUntilState.NETWORKIDLE));
+// After
+page.navigate("/dashboard");
+assertThat(page.getByRole(AriaRole.HEADING, new Page.GetByRoleOptions().setName("Dashboard"))).isVisible();`,
+    line: networkIdle[0],
+    reference: "https://playwright.dev/java/docs/api/class-page#page-navigate"
+  }, disabledRuleIds);
+  const defaultTimeout = lineMatches2(content, /setDefault(?:Navigation)?Timeout\s*\(/);
+  if (defaultTimeout.length) pushFinding(findings, {
+    ruleId: "PWJ-REL-007",
+    category: "reliability",
+    severity: "warning",
+    title: "Timeout tuned inside the test",
+    description: `setDefaultTimeout()/setDefaultNavigationTimeout() is called on line ${defaultTimeout[0]}.`,
+    impact: "Inflating the timeout locally hides genuine slowness and drifts out of sync with the project's CI budget.",
+    fix: `// Configure timeouts once in the shared fixture/options class, then rely on auto-waiting assertions
+assertThat(page.getByRole(AriaRole.TABLE)).isVisible();`,
+    line: defaultTimeout[0],
+    reference: "https://playwright.dev/java/docs/test-runners"
+  }, disabledRuleIds);
+  const noAssertTests = /assertThat\s*\(/.test(content) ? testStarts.filter((_, k) => !/assertThat\s*\(|\bassert[A-Z]\w*\s*\(|\bAssertions\s*\.|\bassert\s+\w/.test(blockOf(k))).map((i) => i + 1) : [];
+  if (noAssertTests.length) pushFinding(findings, {
+    ruleId: "PWJ-AST-003",
+    category: "assertions",
+    severity: "warning",
+    title: "Test method with no assertion",
+    description: `The @Test at line ${noAssertTests[0]} drives the UI but never asserts anything.`,
+    impact: "It only fails when an action throws, so a silently broken page still reports green.",
+    fix: `@Test
+void checkout() {
+  page.getByRole(AriaRole.BUTTON, new Page.GetByRoleOptions().setName("Pay")).click();
+  assertThat(page.getByRole(AriaRole.HEADING, new Page.GetByRoleOptions().setName("Order confirmed"))).isVisible();
+}`,
+    line: noAssertTests[0],
+    reference: "https://playwright.dev/java/docs/best-practices"
+  }, disabledRuleIds);
+  const rawPageCalls = countMatches2(content, /\bpage\.(?:navigate|locator|getBy\w+|click|fill|press|check|selectOption)\s*\(/g);
+  if (hasTests && rawPageCalls >= 15 && !/class\s+\w*Page\b|import\s+[\w.]*\.pages?\./.test(content)) pushFinding(findings, {
+    ruleId: "PWJ-STR-002",
+    category: "structure",
+    severity: "info",
+    title: "No page-object abstraction",
+    description: `${rawPageCalls} raw page.* interactions with no page-object class or pages package import.`,
+    impact: "Selectors and flows are duplicated across test classes, so one UI change forces edits in many files.",
+    fix: `public class LoginPage {
+  private final Locator submit;
+  public LoginPage(Page page) { this.submit = page.getByRole(AriaRole.BUTTON, new Page.GetByRoleOptions().setName("Sign in")); }
+  public void signIn(String user, String secret) { /* ... */ }
+}`,
+    line: null,
+    reference: "https://playwright.dev/java/docs/pom"
+  }, disabledRuleIds);
+  const launches = lineMatches2(content, /\.launch\s*\(|newContext\s*\(/);
+  if (launches.length && !/\.close\s*\(/.test(content) && !/try\s*\(/.test(content)) pushFinding(findings, {
+    ruleId: "PWJ-RES-002",
+    category: "resource_mgmt",
+    severity: "warning",
+    title: "Browser/context opened but never closed",
+    description: `launch()/newContext() on line ${launches[0]} with no matching close() and no try-with-resources.`,
+    impact: "Every run leaks a browser process and its profile directory, so long CI jobs exhaust memory and file handles.",
+    fix: `@AfterAll
+static void tearDown() {
+  context.close();
+  browser.close();
+}`,
+    line: launches[0],
+    reference: "https://playwright.dev/java/docs/browsers"
+  }, disabledRuleIds);
+  const createInTest = testStarts.filter((_, k) => /Playwright\.create\s*\(/.test(blockOf(k))).map((i) => i + 1);
+  if (createInTest.length) pushFinding(findings, {
+    ruleId: "PWJ-RES-003",
+    category: "resource_mgmt",
+    severity: "warning",
+    title: "Playwright.create() inside a test method",
+    description: `The @Test at line ${createInTest[0]} creates its own Playwright instance instead of taking one from a fixture.`,
+    impact: "Each test pays full driver + browser startup and manages its own teardown, which is where leaked processes come from.",
+    fix: `@BeforeAll
+static void launchBrowser() {
+  playwright = Playwright.create();
+  browser = playwright.chromium().launch();
+}
+// \u2026or use @UsePlaywright to let the JUnit extension own the lifecycle.`,
+    line: createInTest[0],
+    reference: "https://playwright.dev/java/docs/junit"
+  }, disabledRuleIds);
+  const emptyCatch = [];
+  lines.forEach((l, i) => {
+    if (/catch\s*\([^)]*\)\s*\{\s*\}/.test(l)) emptyCatch.push(i + 1);
+    else if (/catch\s*\([^)]*\)\s*\{\s*$/.test(l) && /^\s*\}\s*$/.test(lines[i + 1] ?? "")) emptyCatch.push(i + 1);
+  });
+  if (emptyCatch.length) pushFinding(findings, {
+    ruleId: "PWJ-STD-004",
+    category: "coding_standards",
+    severity: "warning",
+    title: "Exception swallowed by an empty catch",
+    description: `An empty catch block appears on line ${emptyCatch[0]}.`,
+    impact: "Real failures are converted into passes \u2014 this is how a broken flow stays green for weeks.",
+    fix: `// Assert the expected end state instead of guarding with try/catch
+assertThat(page.getByRole(AriaRole.ALERT)).hasText("Saved");`,
+    line: emptyCatch[0],
+    reference: "https://playwright.dev/java/docs/best-practices"
+  }, disabledRuleIds);
+  const disabledTests = lineMatches2(content, /^\s*@(?:Disabled|Ignore)\b/);
+  if (disabledTests.length) pushFinding(findings, {
+    ruleId: "PWJ-STD-005",
+    category: "coding_standards",
+    severity: "info",
+    title: "Disabled test",
+    description: `A test is switched off with @Disabled/@Ignore on line ${disabledTests[0]}.`,
+    impact: "Permanently disabled tests rot silently while the dashboard still counts them as coverage.",
+    fix: `@Disabled("blocked by BUG-1234 \u2014 re-enable once the fix ships") // always give a reason + ticket`,
+    line: disabledTests[0],
+    reference: "https://junit.org/junit5/docs/current/user-guide/#writing-tests-disabling"
+  }, disabledRuleIds);
+  const headed = lineMatches2(content, /setHeadless\s*\(\s*false\s*\)/i);
+  if (headed.length) pushFinding(findings, {
+    ruleId: "PWJ-CI-002",
+    category: "ci_config",
+    severity: "warning",
+    title: "Headed mode hardcoded",
+    description: `setHeadless(false) is committed on line ${headed[0]}.`,
+    impact: "CI agents have no display, so the job hangs or crashes; locally it just makes the suite slower.",
+    fix: `// Let the environment decide
+new BrowserType.LaunchOptions().setHeadless(!Boolean.getBoolean("headed"));`,
+    line: headed[0],
+    reference: "https://playwright.dev/java/docs/debug"
+  }, disabledRuleIds);
+  if (launches.length && !/tracing\s*\(\s*\)\s*\.\s*start|setRecordVideoDir|setRecordHarPath/.test(content)) pushFinding(findings, {
+    ruleId: "PWJ-CI-003",
+    category: "ci_config",
+    severity: "info",
+    title: "No trace, video or HAR capture configured",
+    description: `A browser/context is created on line ${launches[0]} with no tracing, video or HAR recording.`,
+    impact: "A CI-only failure leaves nothing to debug with, so the flake gets retried instead of fixed.",
+    fix: `context = browser.newContext(new Browser.NewContextOptions().setRecordVideoDir(Paths.get("target/videos")));
+context.tracing().start(new Tracing.StartOptions().setScreenshots(true).setSnapshots(true));`,
+    line: launches[0],
+    reference: "https://playwright.dev/java/docs/trace-viewer"
+  }, disabledRuleIds);
+  {
+    const hasTag = /@Tag\s*\(|@Category\s*\(|groups\s*=\s*[{"']/.test(content);
+    if (/@Test\b/.test(content) && !hasTag) pushFinding(findings, {
+      ruleId: "PWJ-STD-006",
+      category: "coding_standards",
+      severity: "info",
+      title: "Tests carry no @Tag or TestNG group",
+      description: "No @Tag, @Category or groups= appears in this file, so its tests cannot be selected by the runner.",
+      impact: "CI must run everything on every commit \u2014 no smoke subset, and a flaky test can only be excluded by deleting it.",
+      fix: `@Test
+@Tag("smoke")
+void loadsDashboard() { }`,
+      line: lineMatches2(content, /@Test\b/)[0] ?? null,
+      reference: "https://junit.org/junit5/docs/current/user-guide/#writing-tests-tagging-and-filtering"
+    }, disabledRuleIds);
+  }
   const crit = findings.filter((f) => f.severity === "critical").length;
   const summary = crit > 0 ? `Playwright (Java) scan of ${filename}: ${findings.length} finding(s), ${crit} critical.` : `Playwright (Java) scan of ${filename}: ${findings.length} finding(s) from standard rules.`;
   return buildAuditResult({
@@ -2996,6 +3449,236 @@ page.goto("/login")`,
     fix: "Configure screenshot on failure instead.",
     line: screenshot[0]
   });
+  const queryAPI = lineMatches2(content, /\.query_selector(?:_all)?\s*\(/);
+  if (queryAPI.length) add({
+    ruleId: "PWPY-SEL-004",
+    category: "selectors",
+    severity: "warning",
+    title: "Legacy query_selector API",
+    description: `query_selector()/query_selector_all() returns an ElementHandle on line ${queryAPI[0]}.`,
+    impact: "ElementHandles are resolved once and do not auto-wait or re-query, so they go stale after a re-render.",
+    fix: `# Before
+el = page.query_selector(".row")
+# After
+row = page.locator(".row")
+expect(row).to_be_visible()`,
+    line: queryAPI[0],
+    reference: "https://playwright.dev/python/docs/locators"
+  });
+  const networkIdle = lineMatches2(content, /wait_until\s*=\s*["']networkidle["']|wait_for_load_state\s*\(\s*["']networkidle["']/);
+  if (networkIdle.length) add({
+    ruleId: "PWPY-REL-005",
+    category: "reliability",
+    severity: "warning",
+    title: "Waiting on networkidle",
+    description: `A networkidle wait is used on line ${networkIdle[0]}.`,
+    impact: "Discouraged by Playwright: polling, analytics beacons or websockets keep the network busy and the wait times out or resolves arbitrarily.",
+    fix: `# Before
+page.goto("/dashboard", wait_until="networkidle")
+# After
+page.goto("/dashboard")
+expect(page.get_by_role("heading", name="Dashboard")).to_be_visible()`,
+    line: networkIdle[0],
+    reference: "https://playwright.dev/python/docs/api/class-page#page-goto"
+  });
+  const defaultTimeout = lineMatches2(content, /set_default_(?:navigation_)?timeout\s*\(/);
+  if (defaultTimeout.length) add({
+    ruleId: "PWPY-REL-006",
+    category: "reliability",
+    severity: "warning",
+    title: "Timeout tuned inside the test file",
+    description: `set_default_timeout()/set_default_navigation_timeout() is called on line ${defaultTimeout[0]}.`,
+    impact: "Per-file timeout inflation hides real slowness and drifts out of sync with the project's CI budget.",
+    fix: `# pytest.ini / pyproject.toml
+# [tool.pytest.ini_options]
+# ... configure timeout centrally, then rely on auto-waiting assertions
+expect(page.get_by_role("table")).to_be_visible()`,
+    line: defaultTimeout[0],
+    reference: "https://playwright.dev/python/docs/test-timeouts"
+  });
+  const mixedApi = /from\s+playwright\.sync_api\s+import|playwright\.sync_api\./.test(content) && /from\s+playwright\.async_api\s+import|playwright\.async_api\./.test(content);
+  const isAsyncApi = !mixedApi && /async\s+def\s+test_/.test(content);
+  const missingAwait = isAsyncApi ? lines.map((l, i) => [l, i + 1]).filter(([l]) => /(?:\bexpect\s*\(|\bpage\.(?:goto|click|fill|press|check|uncheck|select_option|wait_for_url|set_input_files)\s*\()/.test(l)).filter(([l]) => !/\bawait\b/.test(l) && !/^\s*(?:#|from\b|import\b|def\s|async\s+def\s)/.test(l)).map(([, n]) => n) : [];
+  if (missingAwait.length) add({
+    ruleId: "PWPY-REL-007",
+    category: "reliability",
+    severity: "critical",
+    title: "Coroutine not awaited in async test",
+    description: `Line ${missingAwait[0]} calls an async Playwright API without await.`,
+    impact: "The coroutine is never scheduled, so the action or assertion silently does nothing and the test passes vacuously.",
+    fix: `# Before
+expect(page.get_by_role("alert")).to_be_visible()
+# After
+await expect(page.get_by_role("alert")).to_be_visible()`,
+    line: missingAwait[0],
+    reference: "https://playwright.dev/python/docs/library#async-api"
+  });
+  if (mixedApi) add({
+    ruleId: "PWPY-REL-008",
+    category: "reliability",
+    severity: "critical",
+    title: "sync_api and async_api mixed in one module",
+    description: "The module imports from both playwright.sync_api and playwright.async_api.",
+    impact: "Sync calls inside a running event loop raise 'Sync API inside asyncio loop'; the two object graphs are not interchangeable.",
+    fix: `# Pick one API per module \u2014 for pytest-playwright, stay on the sync API
+from playwright.sync_api import Page, expect`,
+    line: lineMatches2(content, /playwright\.async_api/)[0] ?? null,
+    reference: "https://playwright.dev/python/docs/library"
+  });
+  const testStarts = [];
+  lines.forEach((l, i) => {
+    if (/^\s*(?:async\s+)?def\s+test_/.test(l)) testStarts.push(i);
+  });
+  const blockOf = (k) => lines.slice(testStarts[k], k + 1 < testStarts.length ? testStarts[k + 1] : lines.length).join("\n");
+  const noAssertTests = /\bexpect\s*\(/.test(content) ? testStarts.filter((_, k) => !/\bexpect\s*\(|(?:^|\n)\s*assert\b/.test(blockOf(k))).map((i) => i + 1) : [];
+  if (noAssertTests.length) add({
+    ruleId: "PWPY-AST-003",
+    category: "assertions",
+    severity: "warning",
+    title: "Test function with no assertion",
+    description: `The test starting on line ${noAssertTests[0]} performs actions but never asserts.`,
+    impact: "It only fails on an exception, so a silently broken page still reports green.",
+    fix: `def test_checkout(page: Page) -> None:
+    page.get_by_role("button", name="Pay").click()
+    expect(page.get_by_role("heading", name="Order confirmed")).to_be_visible()`,
+    line: noAssertTests[0],
+    reference: "https://playwright.dev/python/docs/best-practices"
+  });
+  const perTestLaunch = testStarts.filter((_, k) => /sync_playwright\s*\(\s*\)|\.launch\s*\(/.test(blockOf(k))).map((i) => i + 1);
+  if (perTestLaunch.length) add({
+    ruleId: "PWPY-PER-002",
+    category: "performance",
+    severity: "warning",
+    title: "Browser launched inside a test",
+    description: `The test starting on line ${perTestLaunch[0]} calls sync_playwright()/launch() itself instead of using the page fixture.`,
+    impact: "Each test pays full browser startup cost and loses pytest-playwright's tracing, video and parallel-worker handling.",
+    fix: `def test_login(page: Page) -> None:  # pytest-playwright injects a managed page
+    page.goto("/login")`,
+    line: perTestLaunch[0],
+    reference: "https://playwright.dev/python/docs/test-runners"
+  });
+  const skipped = lineMatches2(content, /@pytest\.mark\.(?:skip|skipif|xfail)\b|(?:^|\s)pytest\.skip\s*\(/);
+  if (skipped.length) add({
+    ruleId: "PWPY-STR-002",
+    category: "structure",
+    severity: "info",
+    title: "Skipped or xfail test",
+    description: `A test is skipped/xfailed at line ${skipped[0]}.`,
+    impact: "Permanently disabled tests rot silently and give false coverage confidence.",
+    fix: `@pytest.mark.skip(reason="blocked by BUG-1234, re-enable when fixed")  # always give a reason + ticket`,
+    line: skipped[0],
+    reference: "https://docs.pytest.org/en/stable/how-to/skipping.html"
+  });
+  const rawPageCalls = countMatches2(content, /\bpage\.(?:goto|locator|get_by_\w+|click|fill|press|check|select_option)\s*\(/g);
+  if (hasTests && rawPageCalls >= 15 && !/class\s+\w*Page\b|from\s+\S*pages?\b|import\s+\S*pages?\b/.test(content))
+    add({
+      ruleId: "PWPY-STR-003",
+      category: "structure",
+      severity: "info",
+      title: "No page-object abstraction",
+      description: `${rawPageCalls} raw page.* interactions with no page-object class or pages module import.`,
+      impact: "Selectors and flows are duplicated across tests, so one UI change means edits in many files.",
+      fix: `class LoginPage:
+    def __init__(self, page: Page) -> None:
+        self.page = page
+        self.submit = page.get_by_role("button", name="Sign in")
+
+    def login(self, user: str, pwd: str) -> None: ...`,
+      line: null,
+      reference: "https://playwright.dev/python/docs/pom"
+    });
+  const insecureTls = lineMatches2(content, /ignore_https_errors\s*=\s*True/i);
+  if (insecureTls.length) add({
+    ruleId: "PWPY-SEC-002",
+    category: "security",
+    severity: "warning",
+    title: "TLS validation disabled",
+    description: `ignore_https_errors=True on line ${insecureTls[0]} turns off certificate checking.`,
+    impact: "The suite passes against a misconfigured or MITM'd endpoint, so certificate regressions reach production unnoticed.",
+    fix: `context = browser.new_context()  # trust real certificates; install the CA in CI if needed`,
+    line: insecureTls[0],
+    reference: "https://playwright.dev/python/docs/api/class-browser#browser-new-context"
+  });
+  const uiLogin = lineMatches2(content, /(?:get_by_label|get_by_placeholder|get_by_test_id|locator)\s*\(\s*["'][^"']*(?:password|passwd)[^"']*["']\s*\)\s*\.fill\s*\(|\.fill\s*\(\s*os\.environ\[\s*["'][^"']*PASSWORD/i);
+  if (uiLogin.length && !/storage_state/.test(content))
+    add({
+      ruleId: "PWPY-SEC-003",
+      category: "security",
+      severity: "warning",
+      title: "UI login repeated without storage_state reuse",
+      description: `Credentials are typed into the UI on line ${uiLogin[0]} and no storage_state is saved or loaded.`,
+      impact: "Every test replays the login form \u2014 slow, and it spreads real credentials across each worker's traces and videos.",
+      fix: `# conftest.py: authenticate once, then reuse
+context = browser.new_context(storage_state="auth.json")`,
+      line: uiLogin[0],
+      reference: "https://playwright.dev/python/docs/auth"
+    });
+  const swallowed = [];
+  lines.forEach((l, i) => {
+    const bare = /^\s*except\s*:/.test(l);
+    const inlinePass = /^\s*except\b.*:\s*pass\s*$/.test(l);
+    const nextPass = /^\s*except\b.*:\s*$/.test(l) && /^\s*pass\s*$/.test(lines[i + 1] ?? "");
+    if (bare || inlinePass || nextPass) swallowed.push(i + 1);
+  });
+  if (swallowed.length) add({
+    ruleId: "PWPY-STD-004",
+    category: "coding_standards",
+    severity: "warning",
+    title: "Exception swallowed in test",
+    description: `A bare or pass-only except block appears on line ${swallowed[0]}.`,
+    impact: "Real failures are converted into passes, which is how a broken flow stays green for weeks.",
+    fix: `# Assert the expected state instead of guarding with try/except
+expect(page.get_by_role("alert")).to_have_text("Saved")`,
+    line: swallowed[0],
+    reference: "https://playwright.dev/python/docs/best-practices"
+  });
+  const headed = lineMatches2(content, /headless\s*=\s*False/);
+  if (headed.length) add({
+    ruleId: "PWPY-CI-002",
+    category: "ci_config",
+    severity: "warning",
+    title: "Headed mode hardcoded",
+    description: `headless=False is committed on line ${headed[0]}.`,
+    impact: "CI agents have no display, so the run hangs or crashes; locally it just makes the suite slower.",
+    fix: `browser = playwright.chromium.launch()  # use --headed on the CLI when debugging`,
+    line: headed[0],
+    reference: "https://playwright.dev/python/docs/running-tests"
+  });
+  const newContext = lineMatches2(content, /new_context\s*\(/);
+  if (newContext.length && !/tracing\.start|record_video_dir|record_har_path/.test(content))
+    add({
+      ruleId: "PWPY-CI-003",
+      category: "ci_config",
+      severity: "info",
+      title: "Browser context without failure artefacts",
+      description: `new_context() on line ${newContext[0]} configures no tracing, video or HAR capture.`,
+      impact: "A CI-only failure leaves nothing to debug with, so the flake gets retried instead of fixed.",
+      fix: `context = browser.new_context(record_video_dir="videos/")
+context.tracing.start(screenshots=True, snapshots=True)`,
+      line: newContext[0],
+      reference: "https://playwright.dev/python/docs/trace-viewer"
+    });
+  {
+    const hasMarker = /@pytest\.mark\.\w+/.test(content);
+    if (/def\s+test_/.test(content) && !hasMarker) add({
+      ruleId: "PWPY-STD-005",
+      category: "coding_standards",
+      severity: "info",
+      title: "Tests carry no @pytest.mark marker",
+      description: "No @pytest.mark.* marker appears in this file, so its tests cannot be selected with -m.",
+      impact: "CI must run the whole suite every time \u2014 no smoke subset, and a flaky test can only be excluded by deleting or skipping it outright.",
+      fix: `@pytest.mark.smoke
+def test_dashboard_loads(page):
+    ...
+
+# then: pytest -m smoke
+# register it in pytest.ini to avoid PytestUnknownMarkWarning:
+# [pytest]
+# markers = smoke: fast critical-path checks`,
+      line: lineMatches2(content, /def\s+test_/)[0] ?? null,
+      reference: "https://docs.pytest.org/en/stable/example/markers.html"
+    });
+  }
   const crit = findings.filter((f) => f.severity === "critical").length;
   return buildAuditResult({
     filename,
@@ -3011,6 +3694,7 @@ var CATEGORY_IDS6 = AUDIT_STACKS.ts_frontend.categories.map((c) => c.id);
 function analyseTsFrontendLocally(filename, content, options = {}) {
   const disabled = options.disabledRuleIds ?? /* @__PURE__ */ new Set();
   const findings = [];
+  const lines = content.split(/\r?\n/);
   const add = (r) => pushFinding(findings, r, disabled);
   const dxss = lineMatches2(content, /dangerouslySetInnerHTML|\.innerHTML\s*=/);
   if (dxss.length) add({
@@ -3128,6 +3812,235 @@ function analyseTsFrontendLocally(filename, content, options = {}) {
     fix: "Resolve or link to an issue.",
     line: todo[0]
   });
+  const evalUse = lineMatches2(content, /\beval\s*\(|\bnew\s+Function\s*\(/);
+  if (evalUse.length) add({
+    ruleId: "TSF-SEC-003",
+    category: "security",
+    severity: "critical",
+    title: "Dynamic code execution",
+    description: `eval()/new Function() executes strings as code (line ${evalUse[0]}).`,
+    impact: "Any attacker-controlled string becomes executable code in the user's session.",
+    fix: `// Before
+const value = eval(expression);
+// After
+const value = SAFE_OPS[expression]?.() ?? null;`,
+    line: evalUse[0],
+    reference: "OWASP Code Injection"
+  });
+  const hardSecret = lineMatches2(content, /\b(?:api[-_]?key|password|secret|access[-_]?token|auth[-_]?token|client[-_]?secret)\s*[:=]\s*["'`][^"'`\s]{8,}["'`]/i).filter((ln) => !/process\.env|import\.meta\.env|getenv/.test(lines[ln - 1] || ""));
+  if (hardSecret.length) add({
+    ruleId: "TSF-SEC-004",
+    category: "security",
+    severity: "critical",
+    title: "Hardcoded credential in client code",
+    description: `A literal key/password/token is assigned on line ${hardSecret[0]}.`,
+    impact: "Bundled client code is public; the credential is readable by anyone loading the app.",
+    fix: `const apiKey = import.meta.env.VITE_PUBLIC_API_KEY; // non-secret, injected at build time`,
+    line: hardSecret[0],
+    reference: "OWASP Secrets Management"
+  });
+  const asyncEffect = lineMatches2(content, /useEffect\s*\(\s*async\b/);
+  if (asyncEffect.length) add({
+    ruleId: "TSF-HOOK-003",
+    category: "hooks",
+    severity: "warning",
+    title: "async function passed to useEffect",
+    description: `useEffect receives an async callback on line ${asyncEffect[0]}; React treats the returned Promise as a cleanup function.`,
+    impact: "Cleanup never runs and React logs a warning; unmounted components can still set state.",
+    fix: `useEffect(() => {
+  let active = true;
+  (async () => {
+    const data = await load();
+    if (active) setData(data);
+  })();
+  return () => { active = false; };
+}, [load]);`,
+    line: asyncEffect[0],
+    reference: "https://react.dev/reference/react/useEffect"
+  });
+  const effectStarts = lineMatches2(content, /useEffect\s*\(/);
+  const noCleanup = effectStarts.filter((ln) => {
+    const win = lines.slice(ln - 1, ln + 24);
+    const endIdx = win.findIndex((l, i) => i > 0 && /^\s*\}\s*(?:,\s*\[[^\]]*\])?\s*\)\s*;?\s*$/.test(l));
+    const body = (endIdx === -1 ? win : win.slice(0, endIdx + 1)).join("\n");
+    const subscribes = /addEventListener\s*\(|setInterval\s*\(|\.subscribe\s*\(|new\s+WebSocket\s*\(|new\s+(?:Resize|Intersection|Mutation)Observer\s*\(/.test(body);
+    return subscribes && !/\breturn\b/.test(body);
+  });
+  if (noCleanup.length) add({
+    ruleId: "TSF-HOOK-004",
+    category: "hooks",
+    severity: "warning",
+    title: "Effect subscribes without cleanup",
+    description: `The effect at line ${noCleanup[0]} registers a listener/interval/observer but returns no cleanup function.`,
+    impact: "Handlers accumulate on every re-render and keep running after unmount \u2014 memory leaks and duplicate work.",
+    fix: `useEffect(() => {
+  const id = setInterval(tick, 1000);
+  return () => clearInterval(id);
+}, [tick]);`,
+    line: noCleanup[0],
+    reference: "https://react.dev/reference/react/useEffect#connecting-to-an-external-system"
+  });
+  const stateNames = [...content.matchAll(/const\s*\[\s*([A-Za-z_$][\w$]*)\s*,\s*set[\w$]*\s*\]\s*=\s*useState/g)].map((m) => m[1]);
+  const mutatedState = stateNames.length ? lineMatches2(content, new RegExp(`\\b(?:${stateNames.join("|")})\\s*(?:\\.(?:push|pop|shift|unshift|splice|sort|reverse)\\s*\\(|(?:\\.[\\w$]+|\\[[^\\]]+\\])\\s*=(?!=))`)) : [];
+  if (mutatedState.length) add({
+    ruleId: "TSF-HOOK-005",
+    category: "hooks",
+    severity: "critical",
+    title: "State mutated directly instead of via its setter",
+    description: `A useState value is mutated in place on line ${mutatedState[0]} rather than replaced through set*().`,
+    impact: "React compares state by reference, so the mutation does not re-render \u2014 the UI silently shows stale data.",
+    fix: `// Before
+items.push(next);
+// After
+setItems((prev) => [...prev, next]);`,
+    line: mutatedState[0],
+    reference: "https://react.dev/learn/updating-objects-in-state"
+  });
+  const propNames = /* @__PURE__ */ new Set();
+  for (const m of content.matchAll(/(?:function\s+[A-Z][\w$]*\s*\(|=\s*)\(?\s*\{([^}]{0,300})\}\s*(?::[^)]*)?\)?\s*(?:=>|\{)/g)) {
+    for (const p of m[1].split(",")) {
+      const name = p.split(/[:=]/)[0].trim();
+      if (/^[A-Za-z_$][\w$]*$/.test(name)) propNames.add(name);
+    }
+  }
+  const propState = lineMatches2(content, /useState(?:<[^>]*>)?\s*\(\s*props\.[\w$]+\s*\)/).concat(propNames.size ? lineMatches2(content, new RegExp(`useState(?:<[^>]*>)?\\s*\\(\\s*(?:${[...propNames].join("|")})\\s*\\)`)) : []);
+  if (propState.length) add({
+    ruleId: "TSF-HOOK-006",
+    category: "hooks",
+    severity: "warning",
+    title: "useState initialised from a prop",
+    description: `State on line ${propState[0]} is seeded from a prop, which is only read on the first render.`,
+    impact: "Later prop updates are ignored, so the component renders a stale copy of its parent's data.",
+    fix: `// Derive instead of copying
+const displayName = props.name;
+// \u2026or key the component so it remounts when the prop identity changes
+<Profile key={userId} name={name} />`,
+    line: propState[0],
+    reference: "https://react.dev/learn/choosing-the-state-structure#avoid-duplication-in-state"
+  });
+  const iconBtnRe = /<button\b(?:(?!aria-label|aria-labelledby)[^>])*>\s*(?:\{\s*)?<(?:svg|Icon|[A-Z][\w$]*Icon)\b/g;
+  const iconBtn = [...content.matchAll(iconBtnRe)].map((m) => content.slice(0, m.index).split(/\r?\n/).length);
+  if (iconBtn.length) add({
+    ruleId: "TSF-A11Y-003",
+    category: "accessibility",
+    severity: "warning",
+    title: "Icon-only button without an accessible name",
+    description: `The button at line ${iconBtn[0]} contains only an icon and carries no aria-label.`,
+    impact: "Screen readers announce it as an unlabelled button, so the action is unusable without sight.",
+    fix: `<button aria-label="Delete item" onClick={onDelete}>
+  <TrashIcon aria-hidden="true" />
+</button>`,
+    line: iconBtn[0],
+    reference: "WCAG 4.1.2 Name, Role, Value"
+  });
+  const unlabelledInput = lineMatches2(content, /<input\b(?![^>]*\b(?:aria-label|aria-labelledby|id)\s*=)(?![^>]*\btype\s*=\s*["'](?:hidden|submit|button|reset)["'])[^>]*>/i);
+  if (unlabelledInput.length) add({
+    ruleId: "TSF-A11Y-004",
+    category: "accessibility",
+    severity: "warning",
+    title: "Form input with no label association",
+    description: `The <input> on line ${unlabelledInput[0]} has no id, aria-label or aria-labelledby to tie it to a label.`,
+    impact: "Assistive tech reads an anonymous field, and clicking the visible label does not focus it.",
+    fix: `<label htmlFor="email">Email</label>
+<input id="email" type="email" value={email} onChange={onChange} />`,
+    line: unlabelledInput[0],
+    reference: "WCAG 3.3.2 Labels or Instructions"
+  });
+  const stableHandlers = new Set(
+    [...content.matchAll(/(?:const|let)\s+([\w$]+)\s*=\s*(?:useCallback|useMemo)\s*\(/g)].map((m) => m[1])
+  );
+  const mapStarts = lineMatches2(content, /\.map\s*\(/);
+  const inlineHandlerInList = mapStarts.filter((ln) => lines.slice(ln - 1, ln + 14).some((l) => {
+    const m = /\bon[A-Z][\w$]*\s*=\s*\{\s*(?:\([^)]*\)|[\w$]+)\s*=>\s*([\w$]+)?/.exec(l);
+    return m !== null && !(m[1] && stableHandlers.has(m[1]));
+  }));
+  if (inlineHandlerInList.length) add({
+    ruleId: "TSF-PER-002",
+    category: "performance",
+    severity: "info",
+    title: "Inline arrow handler inside a list render",
+    description: `The .map() starting at line ${inlineHandlerInList[0]} creates a new function for every row on every render.`,
+    impact: "Every child gets a fresh prop identity, defeating memoisation and re-rendering the whole list.",
+    fix: `const handleSelect = useCallback((id: string) => select(id), [select]);
+items.map((it) => <Row key={it.id} id={it.id} onSelect={handleSelect} />)`,
+    line: inlineHandlerInList[0],
+    reference: "https://react.dev/reference/react/useCallback"
+  });
+  const inlineObjProp = lineMatches2(content, /\s[a-zA-Z][\w-]*\s*=\s*\{\{/);
+  if (inlineObjProp.length) add({
+    ruleId: "TSF-PER-003",
+    category: "performance",
+    severity: "info",
+    title: "Inline object literal passed as a prop",
+    description: `An object literal is constructed inline as a prop on line ${inlineObjProp[0]}.`,
+    impact: "A new reference each render breaks React.memo and shallow prop comparison in the child.",
+    fix: `const rowStyle = useMemo(() => ({ padding: 8 }), []);
+<Row style={rowStyle} />`,
+    line: inlineObjProp[0],
+    reference: "https://react.dev/reference/react/memo"
+  });
+  const oversized = lines.length > 300;
+  if (oversized) add({
+    ruleId: "TSF-PER-004",
+    category: "performance",
+    severity: "info",
+    title: "Oversized component file",
+    description: `${filename} is ${lines.length} lines long.`,
+    impact: "Large files re-render as a unit and are hard to memoise, test, or code-split.",
+    fix: "Extract sub-components and hooks into their own modules, then lazy-load the heavy branches.",
+    line: null,
+    reference: "Team standards"
+  });
+  const dbg = lineMatches2(content, /\bdebugger\b/);
+  if (dbg.length) add({
+    ruleId: "TSF-STD-003",
+    category: "standards",
+    severity: "warning",
+    title: "debugger statement committed",
+    description: `A debugger statement remains on line ${dbg[0]}.`,
+    impact: "Execution halts whenever devtools are open, and the statement ships to production builds.",
+    fix: "Remove the debugger statement before committing.",
+    line: dbg[0]
+  });
+  const blockingDialog = lineMatches2(content, /\b(?:window\.)?(?:alert|confirm)\s*\(/);
+  if (blockingDialog.length) add({
+    ruleId: "TSF-STD-004",
+    category: "standards",
+    severity: "info",
+    title: "Native blocking dialog",
+    description: `alert()/confirm() is called on line ${blockingDialog[0]}.`,
+    impact: "Blocks the main thread, cannot be styled or tested, and is suppressed in some embedded contexts.",
+    fix: `setConfirmOpen(true); // render an accessible <Dialog /> instead`,
+    line: blockingDialog[0]
+  });
+  const tsIgnore = lineMatches2(content, /@ts-(?:ignore|nocheck)\b/);
+  if (tsIgnore.length) add({
+    ruleId: "TSF-TYP-002",
+    category: "type_safety",
+    severity: "warning",
+    title: "@ts-ignore / @ts-nocheck suppression",
+    description: `Type checking is suppressed on line ${tsIgnore[0]}.`,
+    impact: "Silences the error permanently, including new errors introduced later on the same line.",
+    fix: `// @ts-expect-error - remove once upstream types ship (TICKET-123)`,
+    line: tsIgnore[0],
+    reference: "https://www.typescriptlang.org/tsconfig#allowJs"
+  });
+  const nonNull = lineMatches2(content, /[\w$)\]]!\s*\./);
+  if (nonNull.length) add({
+    ruleId: "TSF-TYP-003",
+    category: "type_safety",
+    severity: "info",
+    title: "Non-null assertion operator",
+    description: `A ! assertion overrides the null check on line ${nonNull[0]}.`,
+    impact: "The compiler stops guarding the access, so a real null becomes a runtime TypeError.",
+    fix: `// Before
+const name = user!.name;
+// After
+if (!user) return null;
+const name = user.name;`,
+    line: nonNull[0],
+    reference: "https://www.typescriptlang.org/docs/handbook/2/everyday-types.html#non-null-assertion-operator-postfix-"
+  });
   const crit = findings.filter((f) => f.severity === "critical").length;
   return buildAuditResult({
     filename,
@@ -3282,6 +4195,219 @@ order = CreateOrder(**await request.json())`,
     fix: "Resolve or link to an issue.",
     line: todo[0]
   });
+  const pickleLoad = lineMatches2(content, /\b(?:pickle|cPickle|_pickle|marshal|dill)\.loads?\s*\(/);
+  if (pickleLoad.length) add({
+    ruleId: "PY-SEC-005",
+    category: "security",
+    severity: "critical",
+    title: "Deserialising untrusted data with pickle",
+    description: `pickle/marshal deserialisation at line ${pickleLoad[0]} executes arbitrary objects while unpickling.`,
+    impact: "A crafted payload gives remote code execution.",
+    fix: `data = json.loads(raw)  # use a data-only format for untrusted input`,
+    line: pickleLoad[0],
+    reference: "https://docs.python.org/3/library/pickle.html#restricting-globals"
+  });
+  const unsafeYaml = lineMatches2(content, /yaml\.load\s*\((?![^)]*(?:SafeLoader|CSafeLoader))/);
+  if (unsafeYaml.length) add({
+    ruleId: "PY-SEC-006",
+    category: "security",
+    severity: "critical",
+    title: "yaml.load without a safe loader",
+    description: `yaml.load at line ${unsafeYaml[0]} uses the full loader, which can construct arbitrary Python objects.`,
+    impact: "YAML input becomes code execution.",
+    fix: `config = yaml.safe_load(raw)`,
+    line: unsafeYaml[0],
+    reference: "https://pyyaml.org/wiki/PyYAMLDocumentation"
+  });
+  const noVerify = lineMatches2(content, /verify\s*=\s*False/);
+  if (noVerify.length) add({
+    ruleId: "PY-SEC-007",
+    category: "security",
+    severity: "critical",
+    title: "TLS certificate verification disabled",
+    description: `verify=False at line ${noVerify[0]} turns off certificate validation.`,
+    impact: "Traffic can be intercepted by a man-in-the-middle.",
+    fix: `requests.get(url, timeout=5, verify=True)  # or verify="/path/to/ca-bundle.pem"`,
+    line: noVerify[0],
+    reference: "https://requests.readthedocs.io/en/latest/user/advanced/#ssl-cert-verification"
+  });
+  const debugTrue = lineMatches2(content, /^\s*DEBUG\s*=\s*True\b|\bdebug\s*=\s*True\b/);
+  if (debugTrue.length) add({
+    ruleId: "PY-SEC-008",
+    category: "security",
+    severity: "critical",
+    title: "Debug mode enabled",
+    description: `Debug mode is switched on at line ${debugTrue[0]}.`,
+    impact: "Stack traces, settings and an interactive console leak to users in production.",
+    fix: `DEBUG = os.environ.get("DJANGO_DEBUG", "0") == "1"`,
+    line: debugTrue[0],
+    reference: "https://docs.djangoproject.com/en/stable/ref/settings/#debug"
+  });
+  const wildcardHosts = lineMatches2(content, /ALLOWED_HOSTS\s*=\s*\[\s*["']\*["']/);
+  if (wildcardHosts.length) add({
+    ruleId: "PY-SEC-009",
+    category: "security",
+    severity: "warning",
+    title: "ALLOWED_HOSTS accepts any host",
+    description: `ALLOWED_HOSTS is ['*'] at line ${wildcardHosts[0]}.`,
+    impact: "Host-header poisoning enables cache poisoning and password-reset link hijacking.",
+    fix: `ALLOWED_HOSTS = ["api.example.com", "www.example.com"]`,
+    line: wildcardHosts[0],
+    reference: "https://docs.djangoproject.com/en/stable/ref/settings/#allowed-hosts"
+  });
+  const runtimeAssert = lineMatches2(content, /^\s*assert\s+/);
+  if (runtimeAssert.length) add({
+    ruleId: "PY-SEC-010",
+    category: "security",
+    severity: "warning",
+    title: "assert used for runtime validation",
+    description: `assert statement at line ${runtimeAssert[0]} is used outside of tests.`,
+    impact: "Python run with -O strips asserts, so the check silently disappears in production.",
+    fix: `if not user.is_admin:
+    raise PermissionError("admin required")`,
+    line: runtimeAssert[0],
+    reference: "https://docs.python.org/3/reference/simple_stmts.html#the-assert-statement"
+  });
+  const openCors = lineMatches2(content, /allow_origins\s*=\s*\[\s*["']\*["']|CORS_ALLOW_ALL_ORIGINS\s*=\s*True|CORS_ORIGIN_ALLOW_ALL\s*=\s*True|["']Access-Control-Allow-Origin["']\s*[:,]\s*["']\*["']/);
+  if (openCors.length) add({
+    ruleId: "PY-SEC-011",
+    category: "security",
+    severity: "warning",
+    title: "CORS open to every origin",
+    description: `Wildcard CORS origin configured at line ${openCors[0]}.`,
+    impact: "Any site can call the API with the user's credentials.",
+    fix: `app.add_middleware(CORSMiddleware, allow_origins=["https://app.example.com"], allow_credentials=True)`,
+    line: openCors[0],
+    reference: "https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS"
+  });
+  const rawQuery = lineMatches2(content, /\.objects\.raw\s*\(|\.extra\s*\(\s*(?:select|where|tables|params)\s*=/);
+  if (rawQuery.length) add({
+    ruleId: "PY-DAT-002",
+    category: "data_access",
+    severity: "warning",
+    title: "Django .raw() / .extra() escape hatch",
+    description: `Raw ORM escape hatch used at line ${rawQuery[0]}.`,
+    impact: "Bypasses the ORM's parameterisation and query planning; .extra() is deprecated.",
+    fix: `Order.objects.filter(status="open").values("id", "total")`,
+    line: rawQuery[0],
+    reference: "https://docs.djangoproject.com/en/stable/ref/models/querysets/#extra"
+  });
+  const nPlusOne = lineMatches2(content, /for\s+\w+\s+in\s+\w+\.objects\.(?:all|filter|exclude)\s*\(/).filter(() => !/select_related|prefetch_related|\.only\(|\.values\(/.test(content));
+  if (nPlusOne.length) add({
+    ruleId: "PY-DAT-003",
+    category: "data_access",
+    severity: "warning",
+    title: "Probable N+1 query",
+    description: `Line ${nPlusOne[0]} iterates a queryset with no select_related/prefetch_related anywhere in the file.`,
+    impact: "One extra query per row; latency grows linearly with data size.",
+    fix: `for order in Order.objects.select_related("customer").prefetch_related("items"):
+    ...`,
+    line: nPlusOne[0],
+    reference: "https://docs.djangoproject.com/en/stable/ref/models/querysets/#select-related"
+  });
+  const unbounded = lineMatches2(content, /\.objects\.all\s*\(\s*\)|\.query\.all\s*\(\s*\)|session\.query\([^)]*\)\.all\s*\(\s*\)/).filter(() => !/paginate|Paginator|LimitOffset|PageNumber|\.limit\(|\[\s*offset|\[\s*skip/i.test(content));
+  if (unbounded.length) add({
+    ruleId: "PY-PER-002",
+    category: "performance",
+    severity: "warning",
+    title: "Unbounded list query without pagination",
+    description: `Line ${unbounded[0]} fetches an entire table and the file has no pagination.`,
+    impact: "Memory and response size grow without limit as the table grows.",
+    fix: `orders = Order.objects.all()[offset : offset + limit]  # or use a Paginator`,
+    line: unbounded[0],
+    reference: "https://docs.djangoproject.com/en/stable/topics/pagination/"
+  });
+  const blockingHttp = /async\s+def/.test(content) ? lineMatches2(content, /\brequests\.(?:get|post|put|delete|patch|head)\s*\(|\burllib\.request\.urlopen\s*\(/) : [];
+  if (blockingHttp.length) add({
+    ruleId: "PY-ASY-002",
+    category: "async_io",
+    severity: "warning",
+    title: "Blocking HTTP call in async module",
+    description: `Synchronous requests/urllib call at line ${blockingHttp[0]} in a module that defines async handlers.`,
+    impact: "Blocks the event loop, serialising every concurrent request.",
+    fix: `async with httpx.AsyncClient(timeout=5) as client:
+    resp = await client.get(url)`,
+    line: blockingHttp[0],
+    reference: "https://fastapi.tiangolo.com/async/"
+  });
+  const genericRaise = lineMatches2(content, /raise\s+(?:Exception|BaseException)\s*\(/);
+  if (genericRaise.length) add({
+    ruleId: "PY-ERR-002",
+    category: "error_handling",
+    severity: "warning",
+    title: "Generic Exception raised",
+    description: `raise Exception(...) at line ${genericRaise[0]}.`,
+    impact: "Callers cannot catch the specific failure without catching everything.",
+    fix: `class OrderNotFound(LookupError): ...
+raise OrderNotFound(order_id)`,
+    line: genericRaise[0],
+    reference: "https://peps.python.org/pep-0008/#programming-recommendations"
+  });
+  const leakDetail = lineMatches2(content, /(?:return|detail\s*=|content\s*=|jsonify\s*\()[^\n]*\bstr\s*\(\s*(?:e|ex|exc|err|error)\s*\)/);
+  if (leakDetail.length) add({
+    ruleId: "PY-ERR-003",
+    category: "error_handling",
+    severity: "warning",
+    title: "Internal exception text returned to the client",
+    description: `Line ${leakDetail[0]} puts str(exception) into the HTTP response.`,
+    impact: "Leaks table names, file paths and library internals to attackers.",
+    fix: `logger.exception("order create failed")
+raise HTTPException(status_code=500, detail="Internal server error")`,
+    line: leakDetail[0],
+    reference: "https://owasp.org/www-community/Improper_Error_Handling"
+  });
+  const uncheckedCast = lineMatches2(content, /\b(?:int|float)\s*\(\s*request\.(?:args|form|json|data|GET|POST|query_params)/);
+  if (uncheckedCast.length) add({
+    ruleId: "PY-VAL-002",
+    category: "validation",
+    severity: "warning",
+    title: "Unchecked numeric cast of request input",
+    description: `Line ${uncheckedCast[0]} casts request data to a number with no guard.`,
+    impact: "Non-numeric input raises ValueError and returns a 500 instead of a 400.",
+    fix: `page = request.args.get("page", type=int, default=1)
+if page is None or page < 1:
+    abort(400, "page must be a positive integer")`,
+    line: uncheckedCast[0],
+    reference: "https://docs.pydantic.dev/latest/concepts/validators/"
+  });
+  const verbInPath = lineMatches2(content, /@\w+\.(?:route|get|post|put|delete|patch)\s*\(\s*["'][^"']*\/(?:get|create|update|delete|fetch|add|remove)[A-Z_]/);
+  if (verbInPath.length) add({
+    ruleId: "PY-API-001",
+    category: "api_design",
+    severity: "info",
+    title: "Verb in REST route path",
+    description: `Route at line ${verbInPath[0]} encodes an action in the URL instead of using the HTTP method.`,
+    impact: "Non-RESTful surface; caching and client tooling assumptions break.",
+    fix: `@app.post("/orders")       # instead of /createOrder
+@app.delete("/orders/{id}") # instead of /deleteOrder`,
+    line: verbInPath[0],
+    reference: "https://restfulapi.net/resource-naming/"
+  });
+  const looseCompare = lineMatches2(content, /(?:==|!=)\s*(?:None|True|False)\b|\btype\s*\([^)]*\)\s*==/);
+  if (looseCompare.length) add({
+    ruleId: "PY-STD-004",
+    category: "standards",
+    severity: "info",
+    title: "Identity/type comparison written with ==",
+    description: `Line ${looseCompare[0]} compares against None/True/False or uses type(x) ==.`,
+    impact: "Works only by accident with overloaded __eq__ and subclasses.",
+    fix: `if value is None: ...
+if isinstance(value, str): ...`,
+    line: looseCompare[0],
+    reference: "https://peps.python.org/pep-0008/#programming-recommendations"
+  });
+  const starImport = lineMatches2(content, /^\s*from\s+[\w.]+\s+import\s+\*/);
+  if (starImport.length) add({
+    ruleId: "PY-STD-005",
+    category: "standards",
+    severity: "info",
+    title: "Wildcard import",
+    description: `Line ${starImport[0]} imports with *.`,
+    impact: "Namespace pollution; shadowed names and unresolvable symbols for tooling.",
+    fix: `from myapp.models import Order, Customer`,
+    line: starImport[0],
+    reference: "https://peps.python.org/pep-0008/#imports"
+  });
   const crit = findings.filter((f) => f.severity === "critical").length;
   return buildAuditResult({
     filename,
@@ -3357,6 +4483,148 @@ function analysePythonFrontendLocally(filename, content, options = {}) {
     fix: "Resolve or link to an issue.",
     line: todo[0]
   });
+  const lineOf = (index) => content.slice(0, index).split(/\r?\n/).length;
+  const blankTarget = lineMatches2(content, /<a\b(?=[^>]*target\s*=\s*["']_blank["'])(?![^>]*rel\s*=\s*["'][^"']*noopener)[^>]*>/i);
+  if (blankTarget.length) add({
+    ruleId: "PYF-SEC-003",
+    category: "security",
+    severity: "warning",
+    title: 'target="_blank" without rel="noopener"',
+    description: `Link at line ${blankTarget[0]} opens a new tab without rel="noopener".`,
+    impact: "The opened page can rewrite window.opener.location and phish the user (reverse tabnabbing).",
+    fix: `<a href="{{ url }}" target="_blank" rel="noopener noreferrer">Details</a>`,
+    line: blankTarget[0],
+    reference: "https://owasp.org/www-community/attacks/Reverse_Tabnabbing"
+  });
+  const noSri = lineMatches2(content, /<script\b(?=[^>]*\bsrc\s*=\s*["']https?:\/\/)(?![^>]*\bintegrity\s*=)[^>]*>/i);
+  if (noSri.length) add({
+    ruleId: "PYF-SEC-004",
+    category: "security",
+    severity: "warning",
+    title: "Third-party script without subresource integrity",
+    description: `Remote <script> at line ${noSri[0]} has no integrity/crossorigin attributes.`,
+    impact: "A compromised CDN can serve arbitrary JavaScript into every page.",
+    fix: `<script src="https://cdn.example.com/lib.js" integrity="sha384-\u2026" crossorigin="anonymous"></script>`,
+    line: noSri[0],
+    reference: "https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity"
+  });
+  let scriptInterp = 0;
+  for (const m of content.matchAll(/<script\b(?![^>]*\bsrc\s*=)([^>]*)>([\s\S]*?)<\/script>/gi)) {
+    const type = /\btype\s*=\s*["']([^"']+)["']/i.exec(m[1]);
+    if (type && !/javascript|module|ecmascript/i.test(type[1])) continue;
+    if (/\{\{|\{%/.test(m[2])) {
+      scriptInterp = lineOf(m.index + m[0].indexOf(m[2]));
+      break;
+    }
+  }
+  if (scriptInterp) add({
+    ruleId: "PYF-SEC-005",
+    category: "security",
+    severity: "critical",
+    title: "Template variable interpolated into inline JavaScript",
+    description: `Inline <script> near line ${scriptInterp} embeds template output directly in JS.`,
+    impact: "HTML escaping does not protect a JS string context, so user data can break out and execute.",
+    fix: `<script id="cfg" type="application/json">{{ data|json_script_safe }}</script>
+<script>const cfg = JSON.parse(document.getElementById("cfg").textContent);</script>`,
+    line: scriptInterp,
+    reference: "https://owasp.org/www-community/attacks/xss/"
+  });
+  let unlabelled = 0;
+  for (const m of content.matchAll(/<(input|select|textarea)\b[^>]*>/gi)) {
+    const tag = m[0];
+    if (/type\s*=\s*["'](?:hidden|submit|button|reset|image)["']/i.test(tag)) continue;
+    if (/\b(?:aria-label|aria-labelledby|title|placeholder)\s*=/i.test(tag)) continue;
+    const before = content.slice(0, m.index);
+    if (before.lastIndexOf("<label") > before.lastIndexOf("</label")) continue;
+    const id = /\bid\s*=\s*["']([^"']+)["']/i.exec(tag);
+    if (id && new RegExp(`<label\\b[^>]*\\bfor\\s*=\\s*["']${id[1].replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}["']`, "i").test(content)) continue;
+    unlabelled = lineOf(m.index);
+    break;
+  }
+  if (unlabelled) add({
+    ruleId: "PYF-A11Y-002",
+    category: "accessibility",
+    severity: "warning",
+    title: "Form control without an associated label",
+    description: `Control at line ${unlabelled} has no <label for=\u2026>, aria-label or aria-labelledby.`,
+    impact: "Screen-reader users hear an unnamed field and cannot tell what to enter.",
+    fix: `<label for="email">Email</label>
+<input id="email" name="email" type="email">`,
+    line: unlabelled,
+    reference: "https://www.w3.org/WAI/WCAG21/Understanding/labels-or-instructions.html"
+  });
+  const htmlTag = lineMatches2(content, /<html\b(?![^>]*\blang\s*=)[^>]*>/i);
+  if (htmlTag.length) add({
+    ruleId: "PYF-A11Y-003",
+    category: "accessibility",
+    severity: "warning",
+    title: "<html> without a lang attribute",
+    description: `The root <html> element at line ${htmlTag[0]} declares no language.`,
+    impact: "Screen readers pick the wrong pronunciation rules and translation tooling misfires.",
+    fix: `<html lang="en">`,
+    line: htmlTag[0],
+    reference: "https://www.w3.org/WAI/WCAG21/Understanding/language-of-page.html"
+  });
+  const positiveTabindex = lineMatches2(content, /tabindex\s*=\s*["']?[1-9]/i);
+  if (positiveTabindex.length) add({
+    ruleId: "PYF-A11Y-004",
+    category: "accessibility",
+    severity: "warning",
+    title: "Positive tabindex value",
+    description: `tabindex greater than 0 at line ${positiveTabindex[0]}.`,
+    impact: "Forces an element ahead of every natural tab stop, scrambling keyboard order for the whole page.",
+    fix: `<button type="button">Save</button>  <!-- rely on DOM order; use tabindex="0" or "-1" only -->`,
+    line: positiveTabindex[0],
+    reference: "https://www.w3.org/WAI/WCAG21/Understanding/focus-order.html"
+  });
+  const inlineStyle = lineMatches2(content, /<[a-z][^>]*\sstyle\s*=\s*["'][^"']+["']/i);
+  if (inlineStyle.length) add({
+    ruleId: "PYF-STD-003",
+    category: "standards",
+    severity: "info",
+    title: "Inline style attribute",
+    description: `Inline style at line ${inlineStyle[0]}.`,
+    impact: "Cannot be themed or overridden, and requires 'unsafe-inline' in the style CSP directive.",
+    fix: `<div class="card card--highlight">\u2026</div>  <!-- move rules into a stylesheet -->`,
+    line: inlineStyle[0],
+    reference: "https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"
+  });
+  const deprecatedLoad = lineMatches2(content, /\{%\s*load\s+[^%]*\b(?:staticfiles|admin_static|future|adminmedia)\b/i);
+  if (deprecatedLoad.length) add({
+    ruleId: "PYF-STD-004",
+    category: "standards",
+    severity: "warning",
+    title: "Deprecated template tag library loaded",
+    description: `{% load %} of a removed Django tag library at line ${deprecatedLoad[0]}.`,
+    impact: "staticfiles/admin_static/future were removed in Django 3.0; the template raises TemplateSyntaxError after upgrade.",
+    fix: `{% load static %}`,
+    line: deprecatedLoad[0],
+    reference: "https://docs.djangoproject.com/en/stable/releases/3.0/#features-removed-in-3-0"
+  });
+  const hardcodedStatic = lineMatches2(content, /(?:src|href)\s*=\s*["']\/?static\//i);
+  if (hardcodedStatic.length) add({
+    ruleId: "PYF-STD-005",
+    category: "standards",
+    severity: "info",
+    title: "Hardcoded static asset path",
+    description: `Asset URL written literally at line ${hardcodedStatic[0]} instead of via {% static %}.`,
+    impact: "Breaks under a CDN, a STATIC_URL change, or hashed/cache-busted filenames.",
+    fix: `<img src="{% static 'img/logo.png' %}" alt="Logo">`,
+    line: hardcodedStatic[0],
+    reference: "https://docs.djangoproject.com/en/stable/ref/templates/builtins/#static"
+  });
+  const deprecatedTag = lineMatches2(content, /<\/?(?:center|font|marquee|blink|big|strike|frame|frameset|acronym)\b/i);
+  if (deprecatedTag.length) add({
+    ruleId: "PYF-STD-006",
+    category: "standards",
+    severity: "info",
+    title: "Obsolete HTML element",
+    description: `Presentational/obsolete element at line ${deprecatedTag[0]}.`,
+    impact: "Not in the HTML living standard; rendering is browser-dependent and assistive tech may ignore it.",
+    fix: `<p class="text-center">\u2026</p>  <!-- replace <center>/<font> with CSS -->`,
+    line: deprecatedTag[0],
+    reference: "https://developer.mozilla.org/en-US/docs/Web/HTML/Element#obsolete_and_deprecated_elements"
+  });
   const crit = findings.filter((f) => f.severity === "critical").length;
   return buildAuditResult({
     filename,
@@ -3372,6 +4640,7 @@ var CATEGORY_IDS9 = AUDIT_STACKS.java_frontend.categories.map((c) => c.id);
 function analyseJavaCoreLocally(filename, content, options = {}) {
   const disabled = options.disabledRuleIds ?? /* @__PURE__ */ new Set();
   const findings = [];
+  const lines = content.split(/\r?\n/);
   const add = (r) => pushFinding(findings, r, disabled);
   const pst = lineMatches2(content, /printStackTrace\s*\(/);
   if (pst.length) add({
@@ -3450,26 +4719,214 @@ function analyseJavaCoreLocally(filename, content, options = {}) {
     fix: `List<Order> orders = new ArrayList<>();`,
     line: rawList[0]
   });
-  if (/public\s+class\s+\w+\s*\{[\s\S]{2500,}/.test(content)) add({
-    ruleId: "JVF-MNT-001",
-    category: "maintainability",
-    severity: "info",
-    title: "Large class \u2014 consider splitting",
-    description: "Very long class body often mixes responsibilities.",
-    impact: "Harder reviews and testing.",
-    fix: "Extract cohesive responsibilities into separate classes.",
-    line: 1
+  if (/public\s+class\s+\w+\s*\{[\s\S]{2500,}/.test(content)) add({
+    ruleId: "JVF-MNT-001",
+    category: "maintainability",
+    severity: "info",
+    title: "Large class \u2014 consider splitting",
+    description: "Very long class body often mixes responsibilities.",
+    impact: "Harder reviews and testing.",
+    fix: "Extract cohesive responsibilities into separate classes.",
+    line: 1
+  });
+  const todo = lineMatches2(content, /\/\/\s*(TODO|FIXME)|\/\*\s*(TODO|FIXME)/i);
+  if (todo.length) add({
+    ruleId: "JVF-STD-004",
+    category: "coding_standards",
+    severity: "info",
+    title: "Unresolved TODO/FIXME",
+    description: "Leftover markers indicate unfinished work.",
+    impact: "Unfinished logic ships.",
+    fix: "Resolve or link to an issue.",
+    line: todo[0]
+  });
+  const catchThrowable = lineMatches2(content, /catch\s*\(\s*(?:final\s+)?(?:java\.lang\.)?(?:Throwable|Error)\s+\w+\s*\)/);
+  if (catchThrowable.length) add({
+    ruleId: "JVF-ERR-003",
+    category: "error_handling",
+    severity: "warning",
+    title: "catch (Throwable) / catch (Error)",
+    description: `Line ${catchThrowable[0]} catches Throwable or Error.`,
+    impact: "Swallows OutOfMemoryError, StackOverflowError and thread-death, leaving the JVM in an undefined state.",
+    fix: `} catch (IOException e) {
+    log.error("read failed", e);
+    throw new StorageException(e);
+}`,
+    line: catchThrowable[0],
+    reference: "https://wiki.sei.cmu.edu/confluence/display/java/ERR08-J.+Do+not+catch+NullPointerException+or+any+of+its+ancestors"
+  });
+  const messageOnly = lineMatches2(content, /\.(?:error|warn)\s*\([^;]*\.getMessage\s*\(\s*\)\s*\)\s*;/);
+  if (messageOnly.length) add({
+    ruleId: "JVF-ERR-004",
+    category: "error_handling",
+    severity: "warning",
+    title: "Exception logged as getMessage() only",
+    description: `Line ${messageOnly[0]} logs the message text and discards the throwable.`,
+    impact: 'No stack trace and no cause chain, so the failure cannot be located; NPEs log as "null".',
+    fix: `log.error("failed to load order {}", orderId, e);  // pass the throwable itself`,
+    line: messageOnly[0],
+    reference: "https://www.slf4j.org/faq.html#paramException"
+  });
+  const procExec = lineMatches2(content, /Runtime\.getRuntime\s*\(\s*\)\s*\.exec\s*\(|new\s+ProcessBuilder\s*\(/);
+  if (procExec.length) add({
+    ruleId: "JVF-SEC-002",
+    category: "security",
+    severity: "warning",
+    title: "External process execution",
+    description: `Line ${procExec[0]} spawns an OS process.`,
+    impact: "If any argument derives from user input this becomes command injection.",
+    fix: `new ProcessBuilder(List.of("/usr/bin/convert", inputPath, outputPath)).start();  // never build one shell string`,
+    line: procExec[0],
+    reference: "https://owasp.org/www-community/attacks/Command_Injection"
+  });
+  const javaSecret = lineMatches2(content, /\b(?:password|passwd|pwd|secret|apiKey|api_key|accessKey|authToken|token)\s*=\s*"[^"]{4,}"/i);
+  if (javaSecret.length) add({
+    ruleId: "JVF-SEC-003",
+    category: "security",
+    severity: "critical",
+    title: "Hardcoded credential",
+    description: `A password/token literal is assigned at line ${javaSecret[0]}.`,
+    impact: "The secret is in version control and in every decompiled build artifact.",
+    fix: `String apiKey = System.getenv("API_KEY");`,
+    line: javaSecret[0],
+    reference: "https://cwe.mitre.org/data/definitions/798.html"
+  });
+  const weakHash = lineMatches2(content, /MessageDigest\.getInstance\s*\(\s*"(?:MD2|MD5|SHA-?1)"|DigestUtils\.(?:md5|sha1)\w*\s*\(/i);
+  if (weakHash.length) add({
+    ruleId: "JVF-SEC-004",
+    category: "security",
+    severity: "warning",
+    title: "Broken hash algorithm (MD5/SHA-1)",
+    description: `Line ${weakHash[0]} uses MD5 or SHA-1.`,
+    impact: "Both are collision-broken and unsuitable for signatures, integrity checks or password storage.",
+    fix: `MessageDigest.getInstance("SHA-256");  // for passwords use BCrypt/Argon2, not a raw digest`,
+    line: weakHash[0],
+    reference: "https://cwe.mitre.org/data/definitions/327.html"
+  });
+  const sqlConcat = lineMatches2(content, /(?:executeQuery|executeUpdate|prepareStatement|createQuery|createNativeQuery)\s*\([^;]*"\s*\+|String\s+\w*(?:sql|query|Sql|Query)\w*\s*=\s*"[^"]*"\s*\+/);
+  if (sqlConcat.length) add({
+    ruleId: "JVF-SEC-005",
+    category: "security",
+    severity: "critical",
+    title: "SQL built by string concatenation",
+    description: `Line ${sqlConcat[0]} concatenates values into a SQL string.`,
+    impact: "Direct SQL injection: an attacker can read or destroy the database.",
+    fix: `PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE id = ?");
+ps.setLong(1, userId);`,
+    line: sqlConcat[0],
+    reference: "https://owasp.org/www-community/attacks/SQL_Injection"
+  });
+  const legacyCollections = lineMatches2(content, /\bnew\s+(?:Vector|Hashtable|StringBuffer)\s*[<(]|\b(?:Vector|Hashtable)\s*<[^>]*>\s+\w+\s*[=;]/);
+  if (legacyCollections.length) add({
+    ruleId: "JVF-PER-002",
+    category: "performance",
+    severity: "info",
+    title: "Legacy synchronized collection / StringBuffer",
+    description: `Line ${legacyCollections[0]} uses Vector, Hashtable or StringBuffer.`,
+    impact: "Pays for method-level locking that single-threaded code never needs, and the locking is too coarse to make callers thread-safe anyway.",
+    fix: `List<Order> orders = new ArrayList<>();
+Map<String, Order> byId = new HashMap<>();   // ConcurrentHashMap if shared
+StringBuilder sb = new StringBuilder();`,
+    line: legacyCollections[0],
+    reference: "https://docs.oracle.com/javase/8/docs/api/java/util/Vector.html"
+  });
+  const explicitGc = lineMatches2(content, /System\.gc\s*\(\s*\)|Runtime\.getRuntime\s*\(\s*\)\s*\.gc\s*\(/);
+  if (explicitGc.length) add({
+    ruleId: "JVF-PER-003",
+    category: "performance",
+    severity: "warning",
+    title: "Explicit System.gc() call",
+    description: `Line ${explicitGc[0]} requests a garbage collection.`,
+    impact: "Can force a full stop-the-world collection and defeat the collector's own heuristics.",
+    fix: "Delete the call; release references and let the JVM manage collection.",
+    line: explicitGc[0],
+    reference: "https://wiki.sei.cmu.edu/confluence/display/java/MET12-J.+Do+not+use+finalizers"
+  });
+  const unclosed = lineMatches2(content, /=\s*new\s+(?:FileInputStream|FileOutputStream|FileReader|FileWriter|BufferedReader|BufferedWriter|Scanner|Socket|RandomAccessFile)\s*\(/).filter((ln) => !/\btry\s*\(/.test(lines[ln - 1] || "") && !/\btry\s*\($/.test((lines[ln - 2] || "").trim()));
+  if (unclosed.length) add({
+    ruleId: "JVF-PER-004",
+    category: "performance",
+    severity: "warning",
+    title: "Resource opened outside try-with-resources",
+    description: `Line ${unclosed[0]} opens a stream/reader/socket that is not managed by try-with-resources.`,
+    impact: "On an exception the file handle or socket leaks until GC, exhausting descriptors under load.",
+    fix: `try (BufferedReader r = new BufferedReader(new FileReader(path))) {
+    return r.readLine();
+}`,
+    line: unclosed[0],
+    reference: "https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html"
+  });
+  const equalsNoHash = /(?:public|protected)\s+boolean\s+equals\s*\(\s*Object\s/.test(content) && !/\bint\s+hashCode\s*\(\s*\)/.test(content) ? lineMatches2(content, /(?:public|protected)\s+boolean\s+equals\s*\(\s*Object\s/) : [];
+  if (equalsNoHash.length) add({
+    ruleId: "JVF-MNT-002",
+    category: "maintainability",
+    severity: "warning",
+    title: "equals() without hashCode()",
+    description: `equals is overridden at line ${equalsNoHash[0]} but hashCode is not.`,
+    impact: "Equal objects get different hashes, so HashMap/HashSet lookups silently miss.",
+    fix: `@Override public int hashCode() { return Objects.hash(id, name); }`,
+    line: equalsNoHash[0],
+    reference: "https://docs.oracle.com/javase/8/docs/api/java/lang/Object.html#hashCode--"
+  });
+  const mutableStatic = lineMatches2(content, /public\s+static\s+(?!final\b)(?!void\b)[\w.]+(?:\s*<[^>]*>)?(?:\s*\[\s*\])?\s+\w+\s*[=;]/);
+  if (mutableStatic.length) add({
+    ruleId: "JVF-MNT-003",
+    category: "maintainability",
+    severity: "warning",
+    title: "Mutable public static field",
+    description: `Line ${mutableStatic[0]} exposes a non-final public static field.`,
+    impact: "Global mutable state: any class can reassign it, and concurrent writes are unsynchronised.",
+    fix: `private static final Config CONFIG = Config.load();
+public static Config config() { return CONFIG; }`,
+    line: mutableStatic[0],
+    reference: "https://wiki.sei.cmu.edu/confluence/display/java/OBJ10-J.+Do+not+use+public+static+nonfinal+fields"
+  });
+  const finalizer = lineMatches2(content, /(?:protected|public)\s+void\s+finalize\s*\(\s*\)/);
+  if (finalizer.length) add({
+    ruleId: "JVF-MNT-004",
+    category: "maintainability",
+    severity: "warning",
+    title: "finalize() override",
+    description: `finalize is overridden at line ${finalizer[0]}.`,
+    impact: "Deprecated since Java 9 and never guaranteed to run; it delays collection and can resurrect objects.",
+    fix: `class Handle implements AutoCloseable {
+    @Override public void close() { release(); }
+}`,
+    line: finalizer[0],
+    reference: "https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/Object.html#finalize()"
+  });
+  const boxedCtor = lineMatches2(content, /new\s+(?:Integer|Boolean|Double|Long|Float|Short|Byte|Character)\s*\(/);
+  if (boxedCtor.length) add({
+    ruleId: "JVF-STD-005",
+    category: "coding_standards",
+    severity: "warning",
+    title: "Deprecated boxed-primitive constructor",
+    description: `Line ${boxedCtor[0]} calls a wrapper constructor such as new Integer(...).`,
+    impact: "Deprecated for removal since Java 9; allocates a new object every time and breaks == identity assumptions.",
+    fix: `Integer count = Integer.valueOf(text);   // or just: int count = Integer.parseInt(text);`,
+    line: boxedCtor[0],
+    reference: "https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/Integer.html#%3Cinit%3E(int)"
+  });
+  const missingOverride = lineMatches2(content, /(?:public|protected)\s+(?:final\s+)?(?:String|boolean|int)\s+(?:toString|equals|hashCode)\s*\(/).filter((ln) => {
+    if ((lines[ln - 1] || "").includes("@Override")) return false;
+    for (let i = ln - 2; i >= 0; i--) {
+      const prev = (lines[i] || "").trim();
+      if (!prev || prev.startsWith("//") || prev.startsWith("*") || prev.startsWith("/*")) continue;
+      return !prev.includes("@Override");
+    }
+    return true;
   });
-  const todo = lineMatches2(content, /\/\/\s*(TODO|FIXME)|\/\*\s*(TODO|FIXME)/i);
-  if (todo.length) add({
-    ruleId: "JVF-STD-004",
+  if (missingOverride.length) add({
+    ruleId: "JVF-STD-006",
     category: "coding_standards",
     severity: "info",
-    title: "Unresolved TODO/FIXME",
-    description: "Leftover markers indicate unfinished work.",
-    impact: "Unfinished logic ships.",
-    fix: "Resolve or link to an issue.",
-    line: todo[0]
+    title: "Overridden method without @Override",
+    description: `toString/equals/hashCode at line ${missingOverride[0]} is not annotated with @Override.`,
+    impact: "A signature typo silently defines a new method instead of overriding, and the compiler cannot warn.",
+    fix: `@Override
+public String toString() { return "Order[" + id + "]"; }`,
+    line: missingOverride[0],
+    reference: "https://docs.oracle.com/javase/8/docs/api/java/lang/Override.html"
   });
   const crit = findings.filter((f) => f.severity === "critical").length;
   return buildAuditResult({
@@ -3592,6 +5049,178 @@ given().spec(spec)\u2026`,
     fix: "Resolve or link to an issue.",
     line: todo[0]
   });
+  const statusCalls = lineMatches2(content, /statusCode\s*\(/);
+  const hasNegativeStatus = /statusCode\s*\(\s*(?:HttpStatus\.)?(?:SC_)?(?:4\d\d|5\d\d|BAD_REQUEST|UNAUTHORIZED|FORBIDDEN|NOT_FOUND|CONFLICT|UNPROCESSABLE_ENTITY|TOO_MANY_REQUESTS|INTERNAL_SERVER_ERROR)/i.test(content) || /statusCode\s*\(\s*(?:anyOf|is|oneOf)\s*\([^)]*[45]\d\d/.test(content);
+  if (statusCalls.length && !hasNegativeStatus)
+    add({
+      ruleId: "RA-AST-003",
+      category: "assertions",
+      severity: "warning",
+      title: "No negative-path coverage",
+      description: `Every statusCode(...) assertion in this file expects a 2xx/3xx result (first at line ${statusCalls[0]}); no 4xx/5xx case is asserted anywhere.`,
+      impact: "Error handling, validation and auth failures are completely untested \u2014 the API can start returning 200 for invalid input and the suite stays green.",
+      fix: `@Test
+void rejectsUnknownUser() {
+    given().spec(spec)
+        .when().get("/users/999999")
+        .then().statusCode(404).body("error", equalTo("NOT_FOUND"));
+}`,
+      line: statusCalls[0],
+      reference: "https://rest-assured.io/#usage"
+    });
+  if (/\.body\s*\(/.test(content) && !/matchesJsonSchema/.test(content))
+    add({
+      ruleId: "RA-AST-004",
+      category: "assertions",
+      severity: "info",
+      title: "No JSON-schema contract validation",
+      description: "Body assertions cherry-pick individual fields but the payload is never validated against a JSON schema.",
+      impact: "Removed, renamed or re-typed fields that nobody asserts on go unnoticed until a consumer breaks.",
+      fix: `.then().statusCode(200)
+    .body(matchesJsonSchemaInClasspath("schemas/user.json"));`,
+      line: lineMatches2(content, /\.body\s*\(/)[0],
+      reference: "https://github.com/rest-assured/rest-assured/wiki/Usage#json-schema-validation"
+    });
+  if (hasTests && !/\btime\s*\(|ResponseTime|timeIn\s*\(|getTimeIn/.test(content))
+    add({
+      ruleId: "RA-AST-005",
+      category: "assertions",
+      severity: "info",
+      title: "Response time / SLA never asserted",
+      description: "No .time(...) assertion anywhere; the suite never checks how long the API takes to respond.",
+      impact: "Performance regressions ship silently because only correctness is gated.",
+      fix: `.then().statusCode(200)
+    .time(lessThan(1500L), TimeUnit.MILLISECONDS);`,
+      line: null,
+      reference: "https://github.com/rest-assured/rest-assured/wiki/Usage#measuring-response-time"
+    });
+  const verboseLog = lineMatches2(content, /\.log\s*\(\s*\)\s*\.(?:all|everything|body|headers)\s*\(|\.prettyPrint\s*\(\s*\)|\.prettyPeek\s*\(\s*\)|\.peek\s*\(\s*\)/);
+  if (verboseLog.length) add({
+    ruleId: "RA-SEC-003",
+    category: "security",
+    severity: "warning",
+    title: "Full request/response logged unconditionally",
+    description: `log().all() / prettyPrint() at line ${verboseLog[0]} dumps every header and body, including Authorization, Set-Cookie and PII.`,
+    impact: "Credentials and personal data end up in CI build logs, which are usually retained and broadly readable.",
+    fix: `given().log().ifValidationFails()
+    .when().get("/users/1")
+    .then().log().ifValidationFails().statusCode(200);`,
+    line: verboseLog[0],
+    reference: "https://github.com/rest-assured/rest-assured/wiki/Usage#logging"
+  });
+  const inlineAuth = lineMatches2(content, /\.(?:basic|digest|form|oauth2|oauth)\s*\(\s*"[^"]{2,}"/);
+  if (inlineAuth.length) add({
+    ruleId: "RA-SEC-004",
+    category: "security",
+    severity: "critical",
+    title: "Credentials inlined in auth() call",
+    description: `An auth helper at line ${inlineAuth[0]} is called with string literals instead of injected values.`,
+    impact: "Real usernames/passwords or OAuth tokens are committed to the repository and cannot be rotated without a code change.",
+    fix: `given().auth().preemptive().basic(System.getenv("API_USER"), System.getenv("API_PASSWORD"))`,
+    line: inlineAuth[0],
+    reference: "https://github.com/rest-assured/rest-assured/wiki/Usage#authentication"
+  });
+  if (hasTests && !/CONNECTION_TIMEOUT|SO_TIMEOUT|socket\.timeout|connectTimeout|readTimeout|HttpClientConfig|http\.connection\.timeout/i.test(content))
+    add({
+      ruleId: "RA-REL-002",
+      category: "reliability",
+      severity: "warning",
+      title: "No HTTP connect/read timeout configured",
+      description: "No HttpClientConfig / CONNECTION_TIMEOUT / SO_TIMEOUT setting is present, so requests fall back to the client default (often unbounded).",
+      impact: "A hung or black-holed endpoint blocks the build until the CI job-level timeout kills it, hiding the real failure.",
+      fix: `RestAssured.config = RestAssured.config().httpClient(
+    HttpClientConfig.httpClientConfig()
+        .setParam("http.connection.timeout", 5000)
+        .setParam("http.socket.timeout", 10000));`,
+      line: null,
+      reference: "https://github.com/rest-assured/rest-assured/wiki/Usage#connection-timeout"
+    });
+  const swallow = lineMatches2(content, /catch\s*\(\s*(?:final\s+)?[\w.]*(?:Exception|Throwable)\b/);
+  if (swallow.length && !/\bfail\s*\(|\bthrow\s+new\s+|assertThrows\s*\(/.test(content))
+    add({
+      ruleId: "RA-REL-003",
+      category: "reliability",
+      severity: "warning",
+      title: "Exception swallowed inside test",
+      description: `A catch block at line ${swallow[0]} has no fail(...), rethrow or assertThrows(...).`,
+      impact: "A genuine request/parse failure is silently absorbed and the test reports success \u2014 a permanently green, permanently useless test.",
+      fix: `// let it propagate, or assert on it explicitly
+assertThrows(SocketTimeoutException.class, () -> given().spec(spec).get("/slow"));`,
+      line: swallow[0]
+    });
+  const ordered = lineMatches2(content, /@TestMethodOrder|@FixMethodOrder|@Order\s*\(|dependsOnMethods|@Stepwise/);
+  if (ordered.length) add({
+    ruleId: "RA-STR-002",
+    category: "structure",
+    severity: "warning",
+    title: "Order-dependent tests",
+    description: `Explicit execution ordering is declared at line ${ordered[0]}, so tests rely on running in sequence.`,
+    impact: "Tests cannot run in isolation or in parallel, and one early failure cascades into misleading downstream failures.",
+    fix: `// Make each test self-sufficient via a fixture instead of ordering:
+@BeforeEach
+void seed() { createdId = createUser(); }`,
+    line: ordered[0]
+  });
+  const mutableStatic = lineMatches2(content, /^\s*(?:public|private|protected)?\s*static\s+(?!final\b)[A-Za-z_][\w.<>,[\]]*(?:<[^>]*>)?\s+\w+\s*(?:=[^=]|;)/);
+  if (hasTests && mutableStatic.length) add({
+    ruleId: "RA-STR-003",
+    category: "structure",
+    severity: "warning",
+    title: "Shared mutable static state between tests",
+    description: `A non-final static field is declared at line ${mutableStatic[0]} and is written by tests.`,
+    impact: "Tests leak state into each other, so results depend on execution order and break under parallel execution.",
+    fix: `// Scope the state to the test, or make it immutable:
+private static final RequestSpecification SPEC = buildSpec();
+private int createdId; // per-instance, reset by JUnit each test`,
+    line: mutableStatic[0]
+  });
+  const loginCalls = lineMatches2(content, /\.(?:post|get)\s*\([^\n]*"[^"\n]*(?:\/login|\/oauth\/token|\/token|\/authenticate)\b/i);
+  if (loginCalls.length > 1 && !/@BeforeAll|@BeforeClass/.test(content))
+    add({
+      ruleId: "RA-STR-004",
+      category: "structure",
+      severity: "info",
+      title: "Auth token re-fetched per test",
+      description: `${loginCalls.length} separate authentication calls (first at line ${loginCalls[0]}) with no @BeforeAll to fetch the token once.`,
+      impact: "Every test pays a login round-trip and can trip the identity provider's rate limits, making the suite slow and flaky.",
+      fix: `private static String token;
+
+@BeforeAll
+static void authenticate() {
+    token = given().spec(spec).body(creds).post("/login").jsonPath().getString("token");
+}`,
+      line: loginCalls[0]
+    });
+  const disabledTests = lineMatches2(content, /@Disabled\b|@Ignore\b/);
+  if (disabledTests.length) add({
+    ruleId: "RA-STD-003",
+    category: "coding_standards",
+    severity: "warning",
+    title: "Disabled / ignored test",
+    description: `@Disabled or @Ignore at line ${disabledTests[0]} keeps the test in the file but out of the run.`,
+    impact: "Coverage looks intact while the scenario is actually unverified, and muted tests tend to stay muted indefinitely.",
+    fix: `@Disabled("PROJ-1234: re-enable once /users/bulk is deployed to staging")
+// \u2026or delete the test if the behaviour is gone.`,
+    line: disabledTests[0]
+  });
+  {
+    const hasTag = /@Tag\s*\(|@Category\s*\(|groups\s*=\s*[{"']/.test(content);
+    if (/@Test\b/.test(content) && !hasTag) add({
+      ruleId: "RA-STD-004",
+      category: "coding_standards",
+      severity: "info",
+      title: "Tests carry no @Tag or TestNG group",
+      description: "No @Tag, @Category or groups= appears in this file, so its tests cannot be selected by the runner.",
+      impact: "Contract and smoke suites cannot be run separately, so every pipeline stage pays for the full API suite.",
+      fix: `@Test
+@Tag("contract")
+void userSchemaIsStable() { }
+
+// then: mvn test -Dgroups=contract`,
+      line: lineMatches2(content, /@Test\b/)[0] ?? null,
+      reference: "https://junit.org/junit5/docs/current/user-guide/#writing-tests-tagging-and-filtering"
+    });
+  }
   const crit = findings.filter((f) => f.severity === "critical").length;
   return buildAuditResult({
     filename,
@@ -3705,6 +5334,140 @@ Given url baseUrl`,
     fix: "Resolve or link to an issue.",
     line: todo[0]
   });
+  const statusLines = lineMatches2(content, /(?:Then|And|\*)\s+status\s+\d{3}/);
+  if (statusLines.length && !/(?:Then|And|\*)\s+status\s+[45]\d\d/.test(content))
+    add({
+      ruleId: "KA-AST-003",
+      category: "assertions",
+      severity: "info",
+      title: "No negative-path coverage",
+      description: `Every 'status' assertion in this feature expects a 2xx/3xx code (first at line ${statusLines[0]}); no 4xx/5xx scenario exists.`,
+      impact: "Validation, auth and not-found handling are untested, so the API can start accepting bad input without any scenario failing.",
+      fix: `Scenario: rejects an unknown user
+  Given path 'users', 999999
+  When method get
+  Then status 404
+  And match response.error == 'NOT_FOUND'`,
+      line: statusLines[0],
+      reference: "https://github.com/karatelabs/karate#status"
+    });
+  if (/match\s+response/.test(content) && !/#(?:string|number|boolean|array|object|notnull|present|uuid|regex|null|ignore|\()/.test(content))
+    add({
+      ruleId: "KA-AST-004",
+      category: "assertions",
+      severity: "info",
+      title: "No fuzzy-match / schema validation",
+      description: "match is only used on concrete values; no fuzzy markers (#string, #number, #array, #notnull) validate the payload's shape.",
+      impact: "Type changes and dropped fields slip through because only the handful of hard-coded values are checked.",
+      fix: `And match response ==
+  """
+  { id: '#number', name: '#string', tags: '#[] #string', createdAt: '#notnull' }
+  """`,
+      line: lineMatches2(content, /match\s+response/)[0],
+      reference: "https://github.com/karatelabs/karate#fuzzy-matching"
+    });
+  const rawAssert = lineMatches2(content, /(?:\*|And|Then)\s+assert\s+.*\bresponse\b/);
+  if (rawAssert.length) add({
+    ruleId: "KA-AST-005",
+    category: "assertions",
+    severity: "info",
+    title: "assert used where match belongs",
+    description: `Line ${rawAssert[0]} compares the response with 'assert' (a raw JS truthiness check) instead of 'match'.`,
+    impact: "You lose Karate's deep comparison, fuzzy markers and its detailed diff output \u2014 a failure just says the expression was false.",
+    fix: `# instead of: * assert response.id == 1
+And match response.id == 1`,
+    line: rawAssert[0],
+    reference: "https://github.com/karatelabs/karate#match"
+  });
+  const sslOff = lineMatches2(content, /configure\s+ssl\s*=\s*true|relaxedHTTPSValidation/i);
+  if (sslOff.length) add({
+    ruleId: "KA-SEC-002",
+    category: "security",
+    severity: "warning",
+    title: "TLS certificate validation disabled",
+    description: `'configure ssl = true' at line ${sslOff[0]} makes Karate trust every certificate.`,
+    impact: "The suite happily passes against a misconfigured, expired or man-in-the-middled endpoint, so TLS breakage is never caught before production.",
+    fix: "Remove the override and install the environment's real CA certificate in the JVM truststore.",
+    line: sslOff[0],
+    reference: "https://github.com/karatelabs/karate#configure"
+  });
+  const defUrl = lineMatches2(content, /\*\s*def\s+\w*(?:[Uu]rl|[Hh]ost|[Ee]ndpoint)\w*\s*=\s*['"]https?:\/\//);
+  if (defUrl.length) add({
+    ruleId: "KA-CFG-002",
+    category: "ci_config",
+    severity: "warning",
+    title: "Environment URL defined inside the feature",
+    description: `Line ${defUrl[0]} defines a host/base URL with '* def' in the feature file rather than in karate-config.js.`,
+    impact: "The feature is pinned to one environment, so the same scenarios cannot be reused across local, staging and CI runs.",
+    fix: `// karate-config.js
+var config = { baseUrl: 'https://api-' + karate.env + '.example.com' };
+# feature
+Given url baseUrl`,
+    line: defUrl[0],
+    reference: "https://github.com/karatelabs/karate#karate-configjs"
+  });
+  const inlineConfigure = lineMatches2(content, /\*\s*configure\s+(?:headers|proxy|connectTimeout|readTimeout|charset|followRedirects|logPrettyRequest|logPrettyResponse|report)\b/);
+  if (inlineConfigure.length) add({
+    ruleId: "KA-STR-002",
+    category: "structure",
+    severity: "warning",
+    title: "Global 'configure' inside a feature",
+    description: `Line ${inlineConfigure[0]} sets global HTTP configuration in the feature instead of karate-config.js.`,
+    impact: "The setting is duplicated per feature and drifts; worse, it can leak into other features in the same run and cause order-dependent behaviour.",
+    fix: `// karate-config.js
+karate.configure('connectTimeout', 5000);
+karate.configure('readTimeout', 10000);`,
+    line: inlineConfigure[0],
+    reference: "https://github.com/karatelabs/karate#configure"
+  });
+  if (/Scenario Outline:/.test(content) && !/Examples:/.test(content))
+    add({
+      ruleId: "KA-STR-003",
+      category: "structure",
+      severity: "warning",
+      title: "Scenario Outline without an Examples table",
+      description: "A 'Scenario Outline:' is declared but no 'Examples:' data table follows it.",
+      impact: "The outline's <placeholders> are never substituted \u2014 the scenario either fails to run or runs once with literal placeholder text, so the intended data-driven coverage does not exist.",
+      fix: `Scenario Outline: reject invalid ids
+  Given path 'users', '<id>'
+  When method get
+  Then status <status>
+
+  Examples:
+    | id     | status |
+    | 0      | 400    |
+    | 999999 | 404    |`,
+      line: lineMatches2(content, /Scenario Outline:/)[0],
+      reference: "https://github.com/karatelabs/karate#scenario-outline"
+    });
+  if (statusLines.length && !/responseTime/.test(content))
+    add({
+      ruleId: "KA-REL-002",
+      category: "reliability",
+      severity: "info",
+      title: "Response time / SLA never asserted",
+      description: "Scenarios assert status and body but never check responseTime.",
+      impact: "A steadily degrading endpoint keeps passing until it breaches a real user-facing timeout.",
+      fix: `And assert responseTime < 1500`,
+      line: statusLines[0],
+      reference: "https://github.com/karatelabs/karate#responsetime"
+    });
+  if (hasScenario && !/^\s*@[\w-]+/m.test(content))
+    add({
+      ruleId: "KA-STD-003",
+      category: "coding_standards",
+      severity: "info",
+      title: "No tags on Feature or Scenarios",
+      description: "The feature carries no @tags, so scenarios can't be selected or excluded by the runner.",
+      impact: "CI has to run everything, all the time \u2014 no smoke subset, no way to quarantine a known-broken scenario.",
+      fix: `@api @smoke
+Feature: users API
+
+  @regression
+  Scenario: get a user`,
+      line: lineMatches2(content, /Feature:/)[0] ?? null,
+      reference: "https://github.com/karatelabs/karate#tags"
+    });
   const crit = findings.filter((f) => f.severity === "critical").length;
   return buildAuditResult({
     filename,
@@ -3837,6 +5600,168 @@ def client():
     fix: "Resolve or link to an issue.",
     line: todo[0]
   });
+  const statusLines = lineMatches2(content, /status_code/);
+  const hasNegativePath = /status_code\s*(?:==|!=|in|>=|<)\s*[^\n]*\b[45]\d\d\b|\b[45]\d\d\b\s*==\s*[^\n]*status_code|pytest\.raises\s*\([^)]*(?:HTTPError|HTTPStatusError|ResponseError)/.test(content);
+  if (statusLines.length && !hasNegativePath)
+    add({
+      ruleId: "PYA-AST-003",
+      category: "assertions",
+      severity: "warning",
+      title: "No negative-path coverage",
+      description: `Every status_code assertion expects a 2xx/3xx result (first at line ${statusLines[0]}); no 4xx/5xx case is asserted anywhere.`,
+      impact: "Validation, auth and not-found handling are untested, so the API can start returning 200 for invalid input with the suite still green.",
+      fix: `def test_unknown_user_returns_404(client):
+    resp = client.get("/users/999999")
+    assert resp.status_code == 404
+    assert resp.json()["error"] == "NOT_FOUND"`,
+      line: statusLines[0]
+    });
+  const truthyAssert = lineMatches2(content, /assert\s+[\w.]*\.ok\b|assert\s+(?:resp|response|r)\s*(?:#.*)?$/);
+  if (truthyAssert.length) add({
+    ruleId: "PYA-AST-004",
+    category: "assertions",
+    severity: "warning",
+    title: "Truthiness assertion instead of an explicit status",
+    description: `Line ${truthyAssert[0]} asserts on the response object or .ok rather than a specific status code.`,
+    impact: "`.ok` is true for any 2xx/3xx, and a bare Response object is always truthy \u2014 a 204, a 302 redirect to a login page, or any response at all passes.",
+    fix: `assert resp.status_code == 201`,
+    line: truthyAssert[0]
+  });
+  const noVerify = lineMatches2(content, /verify\s*=\s*False/);
+  if (noVerify.length) add({
+    ruleId: "PYA-SEC-002",
+    category: "security",
+    severity: "critical",
+    title: "TLS verification disabled",
+    description: `verify=False at line ${noVerify[0]} turns off certificate validation for the request.`,
+    impact: "Tests pass against expired, self-signed or intercepted certificates, so a TLS misconfiguration reaches production unnoticed \u2014 and the pattern gets copied into application code.",
+    fix: `resp = client.get("/users/1", timeout=5)  # trust the real CA
+# if an internal CA is needed: verify="/etc/ssl/certs/internal-ca.pem"`,
+    line: noVerify[0],
+    reference: "https://requests.readthedocs.io/en/latest/user/advanced/#ssl-cert-verification"
+  });
+  const leakyLog = lineMatches2(content, /(?:print|(?:logger|logging|log|LOG)\.\w+)\s*\([^)]*\b\w*(?:resp|response)\w*\.(?:text|content|headers|json\s*\(\s*\))/i);
+  if (leakyLog.length) add({
+    ruleId: "PYA-SEC-003",
+    category: "security",
+    severity: "warning",
+    title: "Full response body/headers logged",
+    description: `Line ${leakyLog[0]} logs the raw response text, content or headers.`,
+    impact: "Access tokens, Set-Cookie values and PII from the response land in CI logs, which are retained and widely readable.",
+    fix: `logger.debug("GET /users/1 -> %s", resp.status_code)  # status only`,
+    line: leakyLog[0]
+  });
+  const ordered = lineMatches2(content, /@pytest\.mark\.(?:dependency|order|run)\b|^\s*global\s+\w+/);
+  if (ordered.length) add({
+    ruleId: "PYA-REL-002",
+    category: "reliability",
+    severity: "warning",
+    title: "Order-dependent / shared mutable state",
+    description: `Line ${ordered[0]} declares an execution-order dependency or mutates a module-level global.`,
+    impact: "Tests can't run in isolation, under -p no:randomly, or with pytest-xdist; one early failure cascades into misleading downstream failures.",
+    fix: `@pytest.fixture
+def created_user(client):
+    resp = client.post("/users", json=payload)
+    yield resp.json()
+    client.delete(f"/users/{resp.json()['id']}")`,
+    line: ordered[0]
+  });
+  const swallowed = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (/^\s*except\b[^\n]*:\s*(?:pass|\.\.\.)\s*(?:#.*)?$/.test(lines[i])) swallowed.push(i + 1);
+    else if (/^\s*except\b[^\n]*:\s*(?:#.*)?$/.test(lines[i]) && /^\s*(?:pass|\.\.\.)\s*(?:#.*)?$/.test(lines[i + 1] || "")) swallowed.push(i + 1);
+  }
+  if (swallowed.length) add({
+    ruleId: "PYA-REL-003",
+    category: "reliability",
+    severity: "warning",
+    title: "Exception silently swallowed",
+    description: `The except block at line ${swallowed[0]} does nothing but pass.`,
+    impact: "A real connection error, timeout or JSON decode failure is absorbed and the test reports success \u2014 a permanently green, permanently useless test.",
+    fix: `with pytest.raises(httpx.ConnectTimeout):
+    client.get("/slow", timeout=0.001)`,
+    line: swallowed[0]
+  });
+  if (hasTests && !/\.elapsed\b|response_time|perf_counter|time\.monotonic/.test(content))
+    add({
+      ruleId: "PYA-PER-002",
+      category: "performance",
+      severity: "info",
+      title: "Response time / SLA never asserted",
+      description: "No test measures how long a request took (resp.elapsed, perf_counter).",
+      impact: "A steadily degrading endpoint stays green until it breaches a real user-facing timeout.",
+      fix: `assert resp.elapsed.total_seconds() < 1.5`,
+      line: null
+    });
+  if (/\.json\s*\(\)/.test(content) && !/headers\s*\[|\.headers\.get|content[-_]type/i.test(content))
+    add({
+      ruleId: "PYA-VAL-002",
+      category: "validation",
+      severity: "info",
+      title: "Response headers never validated",
+      description: "The body is parsed as JSON but no test checks Content-Type or any other response header.",
+      impact: "A service that starts returning HTML error pages, or drops cache/CORS/security headers, passes unnoticed.",
+      fix: `assert resp.headers["content-type"].startswith("application/json")`,
+      line: lineMatches2(content, /\.json\s*\(\)/)[0]
+    });
+  const directCalls = countMatches2(content, /requests\.(?:get|post|put|delete|patch|head)\s*\(/g);
+  if (directCalls >= 3 && !/requests\.Session\s*\(|httpx\.(?:Client|AsyncClient)\s*\(/.test(content))
+    add({
+      ruleId: "PYA-STR-002",
+      category: "structure",
+      severity: "info",
+      title: "New connection per request (no Session)",
+      description: `${directCalls} module-level requests.* calls with no requests.Session() / httpx.Client().`,
+      impact: "Every call re-does DNS, TCP and the TLS handshake and cannot share auth headers or cookies \u2014 slow suites and duplicated setup.",
+      fix: `@pytest.fixture(scope="session")
+def client():
+    with requests.Session() as s:
+        s.headers.update({"Authorization": f"Bearer {token}"})
+        yield s`,
+      line: lineMatches2(content, /requests\.(?:get|post|put|delete|patch|head)\s*\(/)[0]
+    });
+  const loginCalls = lineMatches2(content, /\.(?:get|post|request)\s*\([^\n]*["'][^"'\n]*(?:\/login|\/token|\/oauth|\/authenticate|\/signin)\b/i);
+  if (loginCalls.length > 1 && !/@pytest\.fixture\s*\(\s*scope\s*=\s*["'](?:session|module|package)["']/.test(content))
+    add({
+      ruleId: "PYA-STR-003",
+      category: "structure",
+      severity: "warning",
+      title: "Auth token re-fetched per test",
+      description: `${loginCalls.length} authentication calls (first at line ${loginCalls[0]}) with no session/module-scoped fixture caching the token.`,
+      impact: "Every test pays a login round-trip and can trip the identity provider's rate limits, making the suite slow and intermittently 429-flaky.",
+      fix: `@pytest.fixture(scope="session")
+def token(client):
+    return client.post("/oauth/token", json=creds).json()["access_token"]`,
+      line: loginCalls[0]
+    });
+  const skipped = lineMatches2(content, /@pytest\.mark\.(?:skip|skipif|xfail)\b|pytest\.skip\s*\(/);
+  if (skipped.length) add({
+    ruleId: "PYA-STD-004",
+    category: "coding_standards",
+    severity: "warning",
+    title: "Skipped / xfailed test",
+    description: `Line ${skipped[0]} disables a test with a skip, skipif or xfail marker.`,
+    impact: "The file still looks like it covers the scenario while nothing is actually verified, and muted tests tend to stay muted for good.",
+    fix: `@pytest.mark.skip(reason="PROJ-1234: re-enable once /users/bulk ships")
+# \u2026or delete the test if the behaviour is gone.`,
+    line: skipped[0]
+  });
+  if (hasTests && !/@pytest\.mark\.\w+/.test(content))
+    add({
+      ruleId: "PYA-STD-005",
+      category: "coding_standards",
+      severity: "info",
+      title: "Tests carry no @pytest.mark marker",
+      description: "No @pytest.mark.* marker appears in this file, so its tests cannot be selected with -m.",
+      impact: "CI runs everything on every commit \u2014 no smoke subset, and a flaky endpoint test can only be excluded by deleting it.",
+      fix: `@pytest.mark.contract
+def test_user_schema(client):
+    ...
+
+# then: pytest -m contract`,
+      line: lineMatches2(content, /def\s+test_/)[0] ?? null,
+      reference: "https://docs.pytest.org/en/stable/example/markers.html"
+    });
   const crit = findings.filter((f) => f.severity === "critical").length;
   return buildAuditResult({
     filename,
@@ -3926,6 +5851,126 @@ function analysePostmanLocally(filename, content, options = {}) {
     fix: "Remove debug logging before committing.",
     line: clog[0]
   });
+  const requestCount = countMatches2(content, /"request"\s*:/g);
+  const testCount = countMatches2(content, /pm\.test\s*\(/g);
+  if (/pm\.response\.to\.have\.status|pm\.response\.code|responseCode\.code/.test(content) && !/pm\.response\.json\s*\(/.test(content))
+    add({
+      ruleId: "PM-AST-003",
+      category: "assertions",
+      severity: "info",
+      title: "Status asserted but body never read",
+      description: "Tests check the HTTP status code but never call pm.response.json() to inspect the payload.",
+      impact: "An endpoint that returns 200 with an empty, malformed or error-shaped body passes every test.",
+      fix: `pm.test("returns the requested user", () => {
+  const body = pm.response.json();
+  pm.expect(body.id).to.eql(1);
+  pm.expect(body).to.have.property("email");
+});`,
+      line: lineMatches2(content, /pm\.response\.to\.have\.status|pm\.response\.code/)[0],
+      reference: "https://learning.postman.com/docs/tests-and-scripts/write-scripts/test-examples/"
+    });
+  const anyStatusAssert = /\.to\.have\.status\s*\(\s*\d{3}|(?:pm\.response\.code|responseCode\.code)\s*[=!]==?\s*\d{3}|\.code\s*\)?\s*\.to\.eql\s*\(\s*\d{3}/.test(content);
+  const negStatusAssert = /\.to\.have\.status\s*\(\s*[45]\d\d|(?:pm\.response\.code|responseCode\.code)\s*[=!]==?\s*[45]\d\d|\.code\s*\)?\s*\.to\.eql\s*\(\s*[45]\d\d|\.to\.be\.oneOf\s*\(\s*\[[^\]]*[45]\d\d/.test(content);
+  if (anyStatusAssert && !negStatusAssert)
+    add({
+      ruleId: "PM-AST-004",
+      category: "assertions",
+      severity: "warning",
+      title: "No negative-path coverage",
+      description: "Every status assertion in the collection expects a 2xx/3xx code; nothing asserts a 4xx or 5xx response.",
+      impact: "Auth rejection, validation errors and not-found handling are untested, so the API can silently start accepting invalid requests.",
+      fix: `pm.test("unknown user returns 404", () => {
+  pm.response.to.have.status(404);
+  pm.expect(pm.response.json().error).to.eql("NOT_FOUND");
+});`,
+      line: lineMatches2(content, /\.to\.have\.status\s*\(/)[0]
+    });
+  if (requestCount > 0 && testCount > 0 && testCount < requestCount)
+    add({
+      ruleId: "PM-AST-005",
+      category: "assertions",
+      severity: "warning",
+      title: "Requests outnumber test scripts",
+      description: `The collection has ${requestCount} request(s) but only ${testCount} pm.test(...) block(s), so some requests are executed with nothing asserted.`,
+      impact: "Newman reports those requests as 'passed' purely because they were sent \u2014 regressions on the untested endpoints are invisible.",
+      fix: `// Add at least one pm.test to every request's Tests tab:
+pm.test("status is 200", () => pm.response.to.have.status(200));`,
+      line: lineMatches2(content, /"request"\s*:/)[0]
+    });
+  const envSecret = lineMatches2(content, /pm\.(?:environment|globals|collectionVariables)\.set\s*\(\s*\\?["'][^"'\\]*(?:token|secret|password|apikey|api_key|credential)/i);
+  if (envSecret.length) add({
+    ruleId: "PM-SEC-002",
+    category: "security",
+    severity: "warning",
+    title: "Secret written into a persisted variable",
+    description: `A script at line ${envSecret[0]} stores a credential with pm.environment.set / pm.globals.set.`,
+    impact: "Postman persists these to the environment/globals file, which is routinely exported, synced and committed \u2014 the live token leaves the process.",
+    fix: `// Keep it in memory for this run only:
+pm.variables.set("authToken", pm.response.json().access_token);`,
+    line: envSecret[0],
+    reference: "https://learning.postman.com/docs/sending-requests/variables/variables/"
+  });
+  const evals = lineMatches2(content, /(?:^|[^\w.$])eval\s*\(/);
+  if (evals.length) add({
+    ruleId: "PM-SEC-003",
+    category: "security",
+    severity: "critical",
+    title: "eval() in a collection script",
+    description: `A pre-request or test script calls eval() at line ${evals[0]}.`,
+    impact: "Any response or variable that reaches that call becomes executable code on the runner \u2014 a compromised or spoofed API can run arbitrary commands in CI.",
+    fix: `// Parse instead of executing:
+const payload = pm.response.json();`,
+    line: evals[0],
+    reference: "https://learning.postman.com/docs/tests-and-scripts/write-scripts/postman-sandbox-api/"
+  });
+  const sslOff = lineMatches2(content, /"strictSSL"\s*:\s*false|"insecureHTTPParser"\s*:\s*true|"disabledSystemHeaders"\s*:\s*\{\s*"host"\s*:\s*true/);
+  if (sslOff.length) add({
+    ruleId: "PM-SEC-004",
+    category: "security",
+    severity: "warning",
+    title: "TLS verification disabled in the collection",
+    description: `protocolProfileBehavior turns off certificate validation at line ${sslOff[0]}.`,
+    impact: "Requests succeed against expired, self-signed or intercepted certificates, so the suite can never catch a TLS misconfiguration.",
+    fix: `Remove "strictSSL": false and trust the environment's real CA instead.`,
+    line: sslOff[0],
+    reference: "https://learning.postman.com/docs/sending-requests/requests/"
+  });
+  if (hasRequests && !/"auth"\s*:/.test(content))
+    add({
+      ruleId: "PM-SEC-005",
+      category: "security",
+      severity: "info",
+      title: "No auth defined anywhere in the collection",
+      description: 'Neither the collection nor any request declares an "auth" block, so authentication is presumably pasted into raw headers or missing entirely.',
+      impact: "Auth cannot be rotated or switched per environment in one place, and requests drift toward hand-written Authorization headers with literal tokens.",
+      fix: `"auth": { "type": "bearer", "bearer": [{ "key": "token", "value": "{{authToken}}", "type": "string" }] }`,
+      line: lineMatches2(content, /"request"\s*:/)[0],
+      reference: "https://learning.postman.com/docs/sending-requests/authorization/authorization/"
+    });
+  const localHost = lineMatches2(content, /"(?:raw|host)"\s*:\s*(?:\[\s*)?"(?:https?:\/\/)?(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\d{1,3}(?:\.\d{1,3}){3})/).concat(lineMatches2(content, /^\s*"(?:localhost|127\.0\.0\.1|0\.0\.0\.0)"\s*,?\s*$/));
+  if (localHost.length) add({
+    ruleId: "PM-CFG-002",
+    category: "ci_config",
+    severity: "warning",
+    title: "Request pinned to localhost / a raw IP",
+    description: `A request URL targets a machine-local or literal-IP host at line ${localHost[0]}.`,
+    impact: "The collection only works on the author's laptop \u2014 in CI or on a teammate's machine the run fails with connection refused.",
+    fix: `Use {{baseUrl}}/users/1 and set baseUrl per environment (http://localhost:3000 locally, the real host in CI).`,
+    line: localHost[0]
+  });
+  const legacyApi = lineMatches2(content, /tests\s*\[\s*\\?["']|responseCode\.code|postman\.setEnvironmentVariable|postman\.setGlobalVariable/);
+  if (legacyApi.length) add({
+    ruleId: "PM-STD-002",
+    category: "coding_standards",
+    severity: "info",
+    title: "Deprecated Postman sandbox API",
+    description: `Line ${legacyApi[0]} uses the pre-v2 sandbox (tests[...], responseCode.code, postman.setEnvironmentVariable).`,
+    impact: "These globals are deprecated, produce no per-assertion reporting in Newman, and will break on a future sandbox upgrade.",
+    fix: `pm.test("status is 200", () => pm.response.to.have.status(200));
+pm.environment.set("userId", pm.response.json().id);`,
+    line: legacyApi[0],
+    reference: "https://learning.postman.com/docs/tests-and-scripts/write-scripts/postman-sandbox-api/"
+  });
   const crit = findings.filter((f) => f.severity === "critical").length;
   return buildAuditResult({
     filename,
@@ -4404,6 +6449,179 @@ WebDriverWait wait = new WebDriverWait(driver, DEFAULT_TIMEOUT);`,
     line: magicTimeout[0],
     reference: "Team standards"
   }, disabledRuleIds);
+  const jsClick = lineMatches2(content, /JavascriptExecutor[\s\S]{0,40}?executeScript\s*\(\s*["']arguments\[0\]\.click|executeScript\s*\(\s*["']arguments\[0\]\.click/);
+  if (jsClick.length) pushFinding(findings, {
+    ruleId: "SEL-J-REL-005",
+    category: "reliability",
+    severity: "warning",
+    title: "JavascriptExecutor click instead of a native click",
+    description: `Line ${jsClick[0]} clicks via executeScript rather than WebElement.click().`,
+    impact: "A JS click fires even when the element is covered, disabled, or off-screen \u2014 so the test passes on a page a real user could not operate.",
+    fix: `// Wait for real actionability instead of forcing the click
+new WebDriverWait(driver, Duration.ofSeconds(10))
+    .until(ExpectedConditions.elementToBeClickable(locator))
+    .click();`,
+    line: jsClick[0],
+    reference: "https://www.selenium.dev/documentation/webdriver/elements/interactions/"
+  }, disabledRuleIds);
+  const actionsNoPerform = [];
+  lines.forEach((line, idx) => {
+    if (!/new\s+Actions\s*\(|\bactions\s*\./.test(line)) return;
+    const window = lines.slice(idx, idx + 4).join(" ");
+    if (!/\.perform\s*\(\s*\)|\.build\s*\(\s*\)\s*\.perform/.test(window)) actionsNoPerform.push(idx + 1);
+  });
+  if (actionsNoPerform.length) pushFinding(findings, {
+    ruleId: "SEL-J-REL-006",
+    category: "reliability",
+    severity: "critical",
+    title: "Actions chain never executed (missing perform())",
+    description: `An Actions sequence at line ${actionsNoPerform[0]} is built but .perform() is never called on it.`,
+    impact: "The interaction silently does nothing, so the assertion after it tests the un-interacted page \u2014 a test that passes while covering nothing.",
+    fix: `new Actions(driver)
+    .moveToElement(menu)
+    .click(item)
+    .perform();   // <- required`,
+    line: actionsNoPerform[0],
+    reference: "https://www.selenium.dev/documentation/webdriver/actions_api/"
+  }, disabledRuleIds);
+  const frameIn = countMatches2(content, /switchTo\s*\(\s*\)\s*\.frame\s*\(/g);
+  const frameOut = countMatches2(content, /switchTo\s*\(\s*\)\s*\.defaultContent\s*\(|switchTo\s*\(\s*\)\s*\.parentFrame\s*\(/g);
+  if (frameIn > frameOut) pushFinding(findings, {
+    ruleId: "SEL-J-REL-007",
+    category: "reliability",
+    severity: "warning",
+    title: "Frame entered but never exited",
+    description: `switchTo().frame() is called ${frameIn} time(s) but defaultContent()/parentFrame() only ${frameOut}.`,
+    impact: "The driver stays scoped to the iframe, so every later findElement looks in the wrong document and fails with NoSuchElement.",
+    fix: `driver.switchTo().frame("payment");
+// ... interact inside the frame ...
+driver.switchTo().defaultContent();`,
+    line: lineMatches2(content, /switchTo\s*\(\s*\)\s*\.frame\s*\(/)[0] ?? null
+  }, disabledRuleIds);
+  const sendKeysNoClear = lineMatches2(content, /\.sendKeys\s*\(/).filter((ln) => {
+    const prev = lines.slice(Math.max(0, ln - 3), ln).join(" ");
+    return !/\.clear\s*\(\s*\)/.test(prev) && !/Keys\.(?:ENTER|TAB|RETURN|ESCAPE)/.test(lines[ln - 1] || "");
+  });
+  if (sendKeysNoClear.length) pushFinding(findings, {
+    ruleId: "SEL-J-REL-008",
+    category: "reliability",
+    severity: "info",
+    title: "sendKeys() without clear()",
+    description: `Line ${sendKeysNoClear[0]} types into a field without clearing it first.`,
+    impact: "Autofilled or retained values are appended rather than replaced, producing values like 'oldnew' on reruns.",
+    fix: `WebElement email = driver.findElement(emailLocator);
+email.clear();
+email.sendKeys("user@example.com");`,
+    line: sendKeysNoClear[0]
+  }, disabledRuleIds);
+  const pageSourceAssert = lineMatches2(content, /getPageSource\s*\(\s*\)\s*\.contains\s*\(/);
+  if (pageSourceAssert.length) pushFinding(findings, {
+    ruleId: "SEL-J-ASS-005",
+    category: "assertions",
+    severity: "warning",
+    title: "Assertion against getPageSource()",
+    description: `Line ${pageSourceAssert[0]} asserts on raw page HTML with a substring check.`,
+    impact: "Matches text in hidden nodes, script blocks and attributes, so it passes when the user can see nothing \u2014 and breaks on unrelated markup changes.",
+    fix: `WebElement banner = wait.until(
+    ExpectedConditions.visibilityOfElementLocated(By.cssSelector("[data-testid='success']")));
+assertEquals("Payment complete", banner.getText());`,
+    line: pageSourceAssert[0]
+  }, disabledRuleIds);
+  const driverProp = lineMatches2(content, /System\.setProperty\s*\(\s*["']webdriver\./);
+  if (driverProp.length) pushFinding(findings, {
+    ruleId: "SEL-J-CFG-001",
+    category: "browser_mgmt",
+    severity: "warning",
+    title: "Manual driver binary path (Selenium Manager makes this obsolete)",
+    description: `Line ${driverProp[0]} sets a webdriver.* system property to a local binary path.`,
+    impact: "The path is machine-specific, so the suite fails on CI and on any teammate's machine, and the binary drifts out of sync with the browser.",
+    fix: `// Selenium 4.6+ resolves the driver automatically \u2014 delete the setProperty line
+WebDriver driver = new ChromeDriver();`,
+    line: driverProp[0],
+    reference: "https://www.selenium.dev/documentation/selenium_manager/"
+  }, disabledRuleIds);
+  const desiredCaps = lineMatches2(content, /DesiredCapabilities|\.merge\s*\(\s*capabilities|new\s+ChromeDriver\s*\(\s*capabilities\s*\)/);
+  if (desiredCaps.length) pushFinding(findings, {
+    ruleId: "SEL-J-CFG-002",
+    category: "browser_mgmt",
+    severity: "critical",
+    title: "DesiredCapabilities \u2014 removed in Selenium 4",
+    description: `Line ${desiredCaps[0]} uses DesiredCapabilities, which Selenium 4 removed in favour of browser-specific Options classes.`,
+    impact: "The code will not compile or run against Selenium 4, blocking the upgrade.",
+    fix: `ChromeOptions options = new ChromeOptions();
+options.addArguments("--headless=new");
+options.setAcceptInsecureCerts(true);
+WebDriver driver = new ChromeDriver(options);`,
+    line: desiredCaps[0],
+    reference: "https://www.selenium.dev/documentation/webdriver/getting_started/upgrade_to_selenium_4/"
+  }, disabledRuleIds);
+  const hasImplicit = /implicitlyWait/.test(content);
+  const hasExplicit = /WebDriverWait|FluentWait/.test(content);
+  if (hasImplicit && hasExplicit) pushFinding(findings, {
+    ruleId: "SEL-J-WAI-005",
+    category: "waits",
+    severity: "critical",
+    title: "Implicit and explicit waits mixed",
+    description: "The file configures an implicit wait and also uses WebDriverWait/FluentWait.",
+    impact: "Selenium documents this combination as producing unpredictable wait times \u2014 a 10s explicit wait can block far longer, and negative conditions like invisibility become unreliable.",
+    fix: `// Drop the implicit wait entirely and rely on explicit waits
+// driver.manage().timeouts().implicitlyWait(...);  <- remove
+new WebDriverWait(driver, Duration.ofSeconds(10))
+    .until(ExpectedConditions.visibilityOfElementLocated(locator));`,
+    line: lineMatches2(content, /implicitlyWait/)[0] ?? null,
+    reference: "https://www.selenium.dev/documentation/webdriver/waits/#implicit-wait"
+  }, disabledRuleIds);
+  const swallowedDisplayed = [];
+  lines.forEach((line, idx) => {
+    if (!/try\s*\{/.test(line)) return;
+    const window = lines.slice(idx, idx + 6).join(" ");
+    if (/isDisplayed\s*\(\s*\)|isEnabled\s*\(\s*\)/.test(window) && /catch\s*\(/.test(window) && /return\s+false|;\s*\}/.test(window)) {
+      swallowedDisplayed.push(idx + 1);
+    }
+  });
+  if (swallowedDisplayed.length) pushFinding(findings, {
+    ruleId: "SEL-J-REL-009",
+    category: "reliability",
+    severity: "warning",
+    title: "isDisplayed() wrapped in try/catch as an existence check",
+    description: `Line ${swallowedDisplayed[0]} swallows an exception to decide whether an element is present.`,
+    impact: "A genuine failure \u2014 wrong page, timeout, crashed driver \u2014 is indistinguishable from 'not present', so the test skips its real verification and still passes.",
+    fix: `// Ask the driver directly instead of catching
+boolean present = !driver.findElements(locator).isEmpty();`,
+    line: swallowedDisplayed[0]
+  }, disabledRuleIds);
+  const chainedFind = lineMatches2(content, /findElement\s*\((?:[^()]|\([^()]*\))*\)\s*\.\s*findElement\s*\(/);
+  if (chainedFind.length) pushFinding(findings, {
+    ruleId: "SEL-J-LOC-006",
+    category: "locators",
+    severity: "info",
+    title: "Chained findElement() calls",
+    description: `Line ${chainedFind[0]} chains findElement into another findElement.`,
+    impact: "Each hop is a separate round trip that can go stale mid-chain, and the locator now encodes two levels of DOM structure.",
+    fix: `// One locator scoped with a CSS descendant selector
+driver.findElement(By.cssSelector("[data-testid='cart'] .line-item__price"));`,
+    line: chainedFind[0]
+  }, disabledRuleIds);
+  {
+    const hasJUnitTag = /@Tag\s*\(|@Category\s*\(/.test(content);
+    const hasTestNgGroup = /groups\s*=\s*[{"']/.test(content);
+    if (hasTests && !hasJUnitTag && !hasTestNgGroup) pushFinding(findings, {
+      ruleId: "SEL-J-STD-005",
+      category: "coding_standards",
+      severity: "info",
+      title: "Tests carry no @Tag or TestNG group",
+      description: "No @Tag (JUnit 5), @Category (JUnit 4) or groups= (TestNG) appears in this file, so its tests cannot be selected by the runner.",
+      impact: "CI must run the whole suite every time \u2014 no smoke subset, no way to quarantine a flaky test without deleting or commenting it out.",
+      fix: `@Test
+@Tag("smoke")
+@Tag("checkout")
+void completesCheckout() { }
+
+// then: mvn test -Dgroups=smoke`,
+      line: lineMatches2(content, /@Test\b/)[0] ?? null,
+      reference: "https://junit.org/junit5/docs/current/user-guide/#writing-tests-tagging-and-filtering"
+    }, disabledRuleIds);
+  }
   const crit = findings.filter((f) => f.severity === "critical").length;
   const summary = crit > 0 ? `Selenium (Java) scan of ${filename}: ${findings.length} finding(s), ${crit} critical.` : `Selenium (Java) scan of ${filename}: ${findings.length} finding(s) from standard rules.`;
   return buildAuditResult({
@@ -4873,6 +7091,175 @@ var wait = new WebDriverWait(driver, DefaultTimeout);`,
     line: magicTimeout[0],
     reference: "Team standards"
   }, disabledRuleIds);
+  const jsClick = lineMatches2(content, /ExecuteScript\s*\(\s*["']arguments\[0\]\.click/i);
+  if (jsClick.length) pushFinding(findings, {
+    ruleId: "SEL-CS-REL-005",
+    category: "reliability",
+    severity: "warning",
+    title: "ExecuteScript click instead of a native click",
+    description: `Line ${jsClick[0]} clicks via ExecuteScript rather than IWebElement.Click().`,
+    impact: "A JS click fires even when the element is covered, disabled, or off-screen \u2014 so the test passes on a page a real user could not operate.",
+    fix: `var wait = new WebDriverWait(driver, TimeSpan.FromSeconds(10));
+wait.Until(ExpectedConditions.ElementToBeClickable(locator)).Click();`,
+    line: jsClick[0],
+    reference: "https://www.selenium.dev/documentation/webdriver/elements/interactions/"
+  }, disabledRuleIds);
+  const actionsNoPerform = [];
+  lines.forEach((line, idx) => {
+    if (!/new\s+Actions\s*\(|\bactions\s*\./i.test(line)) return;
+    const window = lines.slice(idx, idx + 4).join(" ");
+    if (!/\.Perform\s*\(\s*\)|\.Build\s*\(\s*\)\s*\.Perform/i.test(window)) actionsNoPerform.push(idx + 1);
+  });
+  if (actionsNoPerform.length) pushFinding(findings, {
+    ruleId: "SEL-CS-REL-006",
+    category: "reliability",
+    severity: "critical",
+    title: "Actions chain never executed (missing Perform())",
+    description: `An Actions sequence at line ${actionsNoPerform[0]} is built but .Perform() is never called on it.`,
+    impact: "The interaction silently does nothing, so the assertion after it tests the un-interacted page \u2014 a test that passes while covering nothing.",
+    fix: `new Actions(driver)
+    .MoveToElement(menu)
+    .Click(item)
+    .Perform();   // <- required`,
+    line: actionsNoPerform[0],
+    reference: "https://www.selenium.dev/documentation/webdriver/actions_api/"
+  }, disabledRuleIds);
+  const frameIn = countMatches2(content, /SwitchTo\s*\(\s*\)\s*\.Frame\s*\(/gi);
+  const frameOut = countMatches2(content, /SwitchTo\s*\(\s*\)\s*\.DefaultContent\s*\(|SwitchTo\s*\(\s*\)\s*\.ParentFrame\s*\(/gi);
+  if (frameIn > frameOut) pushFinding(findings, {
+    ruleId: "SEL-CS-REL-007",
+    category: "reliability",
+    severity: "warning",
+    title: "Frame entered but never exited",
+    description: `SwitchTo().Frame() is called ${frameIn} time(s) but DefaultContent()/ParentFrame() only ${frameOut}.`,
+    impact: "The driver stays scoped to the iframe, so every later FindElement looks in the wrong document and fails with NoSuchElement.",
+    fix: `driver.SwitchTo().Frame("payment");
+// ... interact inside the frame ...
+driver.SwitchTo().DefaultContent();`,
+    line: lineMatches2(content, /SwitchTo\s*\(\s*\)\s*\.Frame\s*\(/i)[0] ?? null
+  }, disabledRuleIds);
+  const sendKeysNoClear = lineMatches2(content, /\.SendKeys\s*\(/i).filter((ln) => {
+    const prev = lines.slice(Math.max(0, ln - 3), ln).join(" ");
+    return !/\.Clear\s*\(\s*\)/i.test(prev) && !/Keys\.(?:Enter|Tab|Return|Escape)/i.test(lines[ln - 1] || "");
+  });
+  if (sendKeysNoClear.length) pushFinding(findings, {
+    ruleId: "SEL-CS-REL-008",
+    category: "reliability",
+    severity: "info",
+    title: "SendKeys() without Clear()",
+    description: `Line ${sendKeysNoClear[0]} types into a field without clearing it first.`,
+    impact: "Autofilled or retained values are appended rather than replaced, producing values like 'oldnew' on reruns.",
+    fix: `var email = driver.FindElement(emailLocator);
+email.Clear();
+email.SendKeys("user@example.com");`,
+    line: sendKeysNoClear[0]
+  }, disabledRuleIds);
+  const pageSourceAssert = lineMatches2(content, /PageSource\s*\.\s*Contains\s*\(/i);
+  if (pageSourceAssert.length) pushFinding(findings, {
+    ruleId: "SEL-CS-ASS-005",
+    category: "assertions",
+    severity: "warning",
+    title: "Assertion against PageSource",
+    description: `Line ${pageSourceAssert[0]} asserts on raw page HTML with a substring check.`,
+    impact: "Matches text in hidden nodes, script blocks and attributes, so it passes when the user can see nothing \u2014 and breaks on unrelated markup changes.",
+    fix: `var banner = wait.Until(
+    ExpectedConditions.ElementIsVisible(By.CssSelector("[data-testid='success']")));
+Assert.AreEqual("Payment complete", banner.Text);`,
+    line: pageSourceAssert[0]
+  }, disabledRuleIds);
+  const driverPath = lineMatches2(content, /new\s+(?:Chrome|Firefox|Edge)Driver\s*\(\s*["'][A-Za-z]:[\\/]|new\s+(?:Chrome|Firefox|Edge)DriverService|DriverService\.Create/i);
+  if (driverPath.length) pushFinding(findings, {
+    ruleId: "SEL-CS-CFG-001",
+    category: "browser_mgmt",
+    severity: "warning",
+    title: "Manual driver binary path (Selenium Manager makes this obsolete)",
+    description: `Line ${driverPath[0]} points the driver at an explicit binary path or DriverService.`,
+    impact: "The path is machine-specific, so the suite fails on CI and on any teammate's machine, and the binary drifts out of sync with the browser.",
+    fix: `// Selenium 4.6+ resolves the driver automatically
+IWebDriver driver = new ChromeDriver();`,
+    line: driverPath[0],
+    reference: "https://www.selenium.dev/documentation/selenium_manager/"
+  }, disabledRuleIds);
+  const desiredCaps = lineMatches2(content, /DesiredCapabilities/i);
+  if (desiredCaps.length) pushFinding(findings, {
+    ruleId: "SEL-CS-CFG-002",
+    category: "browser_mgmt",
+    severity: "critical",
+    title: "DesiredCapabilities \u2014 removed in Selenium 4",
+    description: `Line ${desiredCaps[0]} uses DesiredCapabilities, which Selenium 4 removed in favour of browser-specific Options classes.`,
+    impact: "The code will not compile or run against Selenium 4, blocking the upgrade.",
+    fix: `var options = new ChromeOptions();
+options.AddArgument("--headless=new");
+options.AcceptInsecureCertificates = true;
+IWebDriver driver = new ChromeDriver(options);`,
+    line: desiredCaps[0],
+    reference: "https://www.selenium.dev/documentation/webdriver/getting_started/upgrade_to_selenium_4/"
+  }, disabledRuleIds);
+  const hasImplicit = /ImplicitWait/i.test(content);
+  const hasExplicit = /WebDriverWait|DefaultWait/i.test(content);
+  if (hasImplicit && hasExplicit) pushFinding(findings, {
+    ruleId: "SEL-CS-WAI-005",
+    category: "waits",
+    severity: "critical",
+    title: "Implicit and explicit waits mixed",
+    description: "The file configures an implicit wait and also uses WebDriverWait/DefaultWait.",
+    impact: "Selenium documents this combination as producing unpredictable wait times \u2014 a 10s explicit wait can block far longer, and negative conditions like invisibility become unreliable.",
+    fix: `// Drop the implicit wait entirely and rely on explicit waits
+// driver.Manage().Timeouts().ImplicitWait = ...;  <- remove
+new WebDriverWait(driver, TimeSpan.FromSeconds(10))
+    .Until(ExpectedConditions.ElementIsVisible(locator));`,
+    line: lineMatches2(content, /ImplicitWait/i)[0] ?? null,
+    reference: "https://www.selenium.dev/documentation/webdriver/waits/#implicit-wait"
+  }, disabledRuleIds);
+  const swallowedDisplayed = [];
+  lines.forEach((line, idx) => {
+    if (!/try\s*\{/.test(line)) return;
+    const window = lines.slice(idx, idx + 6).join(" ");
+    if (/Displayed|Enabled/i.test(window) && /catch\s*\(/.test(window) && /return\s+false/i.test(window)) {
+      swallowedDisplayed.push(idx + 1);
+    }
+  });
+  if (swallowedDisplayed.length) pushFinding(findings, {
+    ruleId: "SEL-CS-REL-009",
+    category: "reliability",
+    severity: "warning",
+    title: "Displayed check wrapped in try/catch as an existence test",
+    description: `Line ${swallowedDisplayed[0]} swallows an exception to decide whether an element is present.`,
+    impact: "A genuine failure \u2014 wrong page, timeout, crashed driver \u2014 is indistinguishable from 'not present', so the test skips its real verification and still passes.",
+    fix: `// Ask the driver directly instead of catching
+bool present = driver.FindElements(locator).Count > 0;`,
+    line: swallowedDisplayed[0]
+  }, disabledRuleIds);
+  const chainedFind = lineMatches2(content, /FindElement\s*\((?:[^()]|\([^()]*\))*\)\s*\.\s*FindElement\s*\(/i);
+  if (chainedFind.length) pushFinding(findings, {
+    ruleId: "SEL-CS-LOC-005",
+    category: "locators",
+    severity: "info",
+    title: "Chained FindElement() calls",
+    description: `Line ${chainedFind[0]} chains FindElement into another FindElement.`,
+    impact: "Each hop is a separate round trip that can go stale mid-chain, and the locator now encodes two levels of DOM structure.",
+    fix: `// One locator scoped with a CSS descendant selector
+driver.FindElement(By.CssSelector("[data-testid='cart'] .line-item__price"));`,
+    line: chainedFind[0]
+  }, disabledRuleIds);
+  {
+    const hasCategory = /\[\s*(?:Category|TestCategory|Trait)\s*\(/i.test(content);
+    if (hasTests && !hasCategory) pushFinding(findings, {
+      ruleId: "SEL-CS-STD-005",
+      category: "coding_standards",
+      severity: "info",
+      title: "Tests carry no [Category] or [Trait]",
+      description: "No [Category] (NUnit), [TestCategory] (MSTest) or [Trait] (xUnit) attribute appears in this file, so its tests cannot be filtered by the runner.",
+      impact: "CI must run the whole suite every time \u2014 no smoke subset, no way to quarantine a flaky test without commenting it out.",
+      fix: `[Test]
+[Category("Smoke")]
+public void CompletesCheckout() { }
+
+// then: dotnet test --filter TestCategory=Smoke`,
+      line: lineMatches2(content, /\[\s*(?:Test|Fact|TestMethod)\s*\]/i)[0] ?? null,
+      reference: "https://docs.nunit.org/articles/nunit/writing-tests/attributes/category.html"
+    }, disabledRuleIds);
+  }
   const crit = findings.filter((f) => f.severity === "critical").length;
   const summary = crit > 0 ? `Selenium (C#) scan of ${filename}: ${findings.length} finding(s), ${crit} critical.` : `Selenium (C#) scan of ${filename}: ${findings.length} finding(s) from standard rules.`;
   return buildAuditResult({
@@ -5981,6 +8368,23 @@ log.info("Tapping login button");`,
       reference: "https://appium.io/docs/en/writing-running-appium/page-object-model/"
     }, disabledRuleIds);
   }
+  {
+    const hasTag = /@Tag\s*\(|@Category\s*\(|groups\s*=\s*[{"']/.test(content);
+    if (/@Test\b/.test(content) && !hasTag) pushFinding(findings, {
+      ruleId: "APM-J-STD-005",
+      category: "coding_standards",
+      severity: "info",
+      title: "Tests carry no @Tag or TestNG group",
+      description: "No @Tag, @Category or groups= appears in this file, so its tests cannot be selected by the runner.",
+      impact: "Device-lab time is expensive \u2014 without tags every run executes the full suite instead of a smoke subset.",
+      fix: `@Test
+@Tag("smoke")
+@Tag("android")
+void launchesApp() { }`,
+      line: lineMatches2(content, /@Test\b/)[0] ?? null,
+      reference: "https://junit.org/junit5/docs/current/user-guide/#writing-tests-tagging-and-filtering"
+    }, disabledRuleIds);
+  }
   const crit = findings.filter((f) => f.severity === "critical").length;
   const summary = crit > 0 ? `Appium (Java) scan of ${filename}: ${findings.length} finding(s), ${crit} critical.` : `Appium (Java) scan of ${filename}: ${findings.length} finding(s) from standard rules.`;
   return buildAuditResult({
@@ -6640,7 +9044,7 @@ function analyseToscaXmlLocally(filename, content, options = {}) {
 }
 
 // bin/cqs-mcp.entry.js
-var VERSION = true ? "2.0.0" : "1.2.0";
+var VERSION = true ? "2.1.0" : "1.2.0";
 var RUNNERS = {
   playwright: analysePlaywright,
   java_api: analyseJavaApiLocally,