peer-ai-standards 1.0.0-next.0

package/dist/profiles/github-actions.js

@@ -0,0 +1,151 @@
+// The checks a pipeline runs, on GitHub Actions (RFC 0006, section 4). peer-ai render writes them
+// as one workflow. The automatic ones are proven in Peer AI's own CI: each tool is run on the
+// failing and passing examples. The TLS check and the scan of the running app need a live
+// environment, so a review confirms they ran. Examples are from a made-up bicycle repair booking
+// service.
+/** A token in GitHub's format, built when the example runs, so no token is written in this file. */
+const fakeToken = () => `${["gh", "p_"].join("")}${"R7kQ2mZ9".repeat(4)}ab4d`;
+const checkout = (pinned) => pinned ? "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1" : "actions/checkout@v7";
+/** A workflow that builds the app, pinned or not, starting from no permissions, with the job's own. */
+function workflow(pinned, jobPermissions = ["contents: read"]) {
+    return [
+        "name: Build",
+        "on: pull_request",
+        "permissions: {}",
+        "jobs:",
+        "  build:",
+        "    runs-on: ubuntu-latest",
+        ...(jobPermissions.length === 1 && jobPermissions[0] === "write-all"
+            ? ["    permissions: write-all"]
+            : ["    permissions:", ...jobPermissions.map((line) => `      ${line}`)]),
+        "    steps:",
+        `      - uses: ${checkout(pinned)}`,
+        "        with:",
+        "          persist-credentials: false",
+        "      - run: make test",
+        "",
+    ].join("\n");
+}
+export const githubActions = {
+    id: "github-actions",
+    name: "GitHub Actions",
+    prefix: "GHA",
+    about: "The checks a pipeline on GitHub Actions runs on every change: secrets, dependencies with published vulnerabilities, workflows' own safety, and code scanning; and, where the project has environments with addresses, a TLS check and a scan of the running app in staging. `peer-ai render` writes them as one workflow, each tool pinned to a checked release.",
+    stacks: [],
+    rules: [
+        {
+            id: "GHA-01",
+            title: "Every change is scanned for secrets",
+            rule: "Every pull request's commits are scanned for secrets, such as keys and tokens, and the whole history is scanned every day; the check fails when one is found. A secret found in old history that has already been replaced is recorded in `.gitleaksignore`, with why.",
+            why: "A secret pushed once stays in the history for anyone with a copy, even after the file is fixed.",
+            ask: "Does the pipeline scan every change for secrets, and fail when it finds one?",
+            stage: "mvp",
+            check: "auto",
+            severity: "high",
+            carries: "SEC-27",
+            enforcer: { tool: "github-actions", job: "secrets", finding: "github-pat" },
+            examples: {
+                file: "settings.py",
+                fails: () => `BOOKINGS_TOKEN = "${fakeToken()}"\n`,
+                passes: 'import os\n\nBOOKINGS_TOKEN = os.environ["BOOKINGS_TOKEN"]\n',
+            },
+        },
+        {
+            id: "GHA-02",
+            title: "Dependencies are checked for published vulnerabilities",
+            rule: "Every change, and every day, the dependencies in each lockfile and manifest are checked against the published advisories, and the check fails when one is affected.",
+            why: "New advisories are published for code that hasn't changed, so a check that runs only on changes misses them.",
+            ask: "Does the pipeline check dependencies on every change and every day?",
+            stage: "mvp",
+            check: "auto",
+            severity: "high",
+            carries: "DEL-03",
+            enforcer: { tool: "github-actions", job: "dependencies", finding: "jinja2" },
+            examples: { file: "requirements.txt", fails: "jinja2==2.10\n", passes: "six==1.17.0\n" },
+        },
+        {
+            id: "GHA-03",
+            title: "Every action is pinned to a commit",
+            rule: "Every action a workflow or an action in the repository uses is pinned to a full commit, never to a tag or a branch that can move. A comment with its version helps a reviewer, and isn't checked.",
+            why: "A tag can be moved to other code, so a workflow that uses one runs whatever its owner, or whoever took over the account, puts there next.",
+            ask: "Is every action in the workflows pinned to a commit?",
+            stage: "prototype",
+            check: "auto",
+            severity: "high",
+            carries: "DEL-01",
+            enforcer: { tool: "github-actions", job: "workflows", finding: "unpinned-uses" },
+            examples: {
+                file: ".github/workflows/build.yml",
+                fails: workflow(false),
+                passes: workflow(true),
+            },
+        },
+        {
+            id: "GHA-04",
+            title: "No job asks for a token that can write everything",
+            rule: "No job asks for `write-all`, the token that can change the code, the releases and the settings.",
+            why: "With write-all, one compromised step, such as a hijacked action, can change anything the repository holds.",
+            ask: "Does any job in the workflows ask for write-all?",
+            stage: "mvp",
+            check: "auto",
+            severity: "high",
+            carries: "SEC-28",
+            enforcer: { tool: "github-actions", job: "workflows", finding: "excessive-permissions" },
+            examples: {
+                file: ".github/workflows/build.yml",
+                fails: workflow(true, ["write-all"]),
+                passes: workflow(true),
+            },
+        },
+        {
+            id: "GHA-05",
+            title: "Code scanning is a required check",
+            rule: "Every change is scanned for insecure code by a code scanner, such as Semgrep with a pinned set of rules, or CodeQL, and the check must pass before the change merges.",
+            why: "A scanner finds the patterns a reviewer skims past, in every change, including the ones nobody reviews closely.",
+            ask: "Does code scanning run on every change, and must it pass before a merge?",
+            stage: "mvp",
+            check: "auto",
+            severity: "high",
+            carries: "DEL-04",
+            enforcer: { tool: "github-actions", job: "code", finding: "avoid-pickle" },
+            examples: {
+                file: "app.py",
+                fails: 'import pickle\nimport subprocess\n\nimport yaml\n\n\ndef load_booking(raw: bytes) -> object:\n    return pickle.loads(raw)\n\n\ndef load_settings(text: str) -> object:\n    return yaml.load(text)\n\n\ndef print_label(serial: str) -> None:\n    subprocess.call("lpr " + serial, shell=True)\n',
+                passes: 'import json\nimport subprocess\n\n\ndef load_booking(raw: bytes) -> object:\n    return json.loads(raw)\n\n\ndef print_label(serial: str) -> None:\n    subprocess.run(["lpr", serial], check=True)\n',
+            },
+        },
+        {
+            id: "GHA-06",
+            title: "Each environment's TLS is checked",
+            rule: "On a schedule, each environment with an address is checked against modern TLS settings, such as Mozilla's intermediate profile, and a failure is fixed.",
+            why: "TLS settings drift as certificates renew and servers are rebuilt, and nothing else notices until a browser refuses the site.",
+            ask: "Does the pipeline check each environment's TLS on a schedule, and did the last run pass?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "medium",
+            carries: "SEC-23",
+        },
+        {
+            id: "GHA-07",
+            title: "The running app is scanned in staging",
+            rule: "On a schedule, and before a release, the running app is scanned, such as by OWASP ZAP's baseline scan, in each environment the config marks as not production, never in production. Each finding is fixed, or accepted by a person in `.github/zap-rules.tsv`, with the reason.",
+            why: "Some problems only show in a running app: headers, cookies and pages left open.",
+            ask: "Does the pipeline scan the running app in staging, and are its findings fixed or accepted?",
+            stage: "production",
+            check: "ai-review",
+            severity: "medium",
+            carries: "DEL-08",
+        },
+        {
+            id: "GHA-08",
+            title: "A workflow starts from no permissions, and each job asks for what it uses",
+            rule: "A workflow gives its token no permissions by default, with `permissions: {}`, and each job asks for only what it uses, such as `contents: read`.",
+            why: "The default token can often write, so a workflow that doesn't say otherwise gives every step more than it needs.",
+            ask: "Does every workflow start from no permissions, and does each job ask for only what it uses?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "medium",
+            carries: "SEC-28",
+        },
+    ],
+};

package/dist/profiles/nestjs.d.ts

@@ -0,0 +1,2 @@
+import type { ProfileInput } from "../profile.ts";
+export declare const nestjs: ProfileInput;

package/dist/profiles/nestjs.js

@@ -0,0 +1,77 @@
+// NestJS. It builds on Node. Examples are from a made-up bicycle repair booking service.
+export const nestjs = {
+    id: "nestjs",
+    name: "NestJS",
+    prefix: "NEST",
+    about: "APIs in NestJS: a validation pipe that refuses unknown fields, guards on every controller, thin controllers, an exception filter that keeps internals in, and settings checked at start-up. It builds on the Node profile.",
+    stacks: ["nest"],
+    extends: ["node"],
+    rules: [
+        {
+            id: "NEST-01",
+            title: "A global validation pipe refuses unknown fields",
+            rule: "A global `ValidationPipe` runs with `whitelist` and `forbidNonWhitelisted`, and every request body is a DTO class with validation decorators.",
+            why: "Without the pipe, a DTO's decorators do nothing, and a body with extra fields, such as a role, reaches the service as it came.",
+            ask: "Does the app run a global ValidationPipe that refuses unknown fields, and does every body have a validated DTO?",
+            stage: "prototype",
+            check: "ai-review",
+            severity: "high",
+            carries: "SEC-05",
+        },
+        {
+            id: "NEST-02",
+            title: "Every route is guarded unless it says it's public",
+            rule: "An authentication guard is global, and a route open to everyone says so with a decorator, such as `@Public()`, which a reviewer can see.",
+            why: "A guard added controller by controller is missed on the one controller that needed it.",
+            ask: "Is every route in this change behind the guard, or marked public on purpose?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "critical",
+            carries: "SEC-03",
+        },
+        {
+            id: "NEST-03",
+            title: "Controllers call services, which hold the rules",
+            rule: "A controller maps the request to a service call and the result to a response. The business rules live in the service, which knows nothing of HTTP.",
+            why: "Rules in a controller can't be reused by a queue consumer or a scheduled job, and are tested only through HTTP.",
+            ask: "Does any controller in this change hold a business rule?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "medium",
+            carries: "ARC-05",
+        },
+        {
+            id: "NEST-04",
+            title: "One exception filter gives every error the same shape",
+            rule: "A global exception filter answers every error in the project's error shape, whichever exception it was, with the detail kept for the log.",
+            why: "Nest's built-in answers differ between its own exceptions and everything else, so a client has to handle several shapes.",
+            ask: "Does every error in this change reach the client in the project's error shape?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "medium",
+            carries: "API-04",
+        },
+        {
+            id: "NEST-05",
+            title: "Settings are checked when the app starts",
+            rule: "`ConfigModule` loads settings with a validation schema, so the app refuses to start with a setting missing or wrong, and an environment name it doesn't know is treated as production.",
+            why: "A setting read unchecked fails on the first request that needs it, long after the deploy looked fine.",
+            ask: "Does the app check its settings with a schema at start-up?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "medium",
+            carries: "REL-04",
+        },
+        {
+            id: "NEST-06",
+            title: "Modules share only the providers they export",
+            rule: "A module uses another only through the providers that module exports, never by importing its internal files.",
+            why: "Reaching past a module's exports ties the two together, so neither can change alone.",
+            ask: "Does this change reach into another module past its exports?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "medium",
+            carries: "ARC-03",
+        },
+    ],
+};

package/dist/profiles/next.d.ts

@@ -0,0 +1,2 @@
+import type { ProfileInput } from "../profile.ts";
+export declare const next: ProfileInput;

package/dist/profiles/next.js

@@ -0,0 +1,73 @@
+// Next.js, for apps whose screens and server code live together. It builds on React and Node.
+// Examples are from a made-up bicycle repair booking service.
+export const next = {
+    id: "next",
+    name: "Next.js",
+    prefix: "NEXT",
+    about: "Full-stack apps in Next.js, where screens and server code share one repository: images sized for the screen, secrets that stay on the server, and server actions and route handlers treated as the public endpoints they are. It builds on the React and Node profiles.",
+    stacks: ["next"],
+    extends: ["react", "node"],
+    rules: [
+        {
+            id: "NEXT-01",
+            title: "Images go through Next's image component",
+            rule: "Images are shown with `next/image`, which sizes and compresses each for the screen that asks, not with a plain `img`.",
+            why: "A plain img sends the full-size file to every phone, and the page waits for it.",
+            ask: "Does this change show an image with a plain img?",
+            stage: "mvp",
+            check: "auto",
+            severity: "low",
+            carries: "PERF-07",
+            enforcer: { tool: "eslint", rule: "@next/next/no-img-element" },
+            examples: {
+                file: "example.tsx",
+                fails: 'export function Frame() {\n  return <img src="/frame.jpg" alt="A steel touring frame" />;\n}\n',
+                passes: 'import Image from "next/image";\nexport function Frame() {\n  return <Image src="/frame.jpg" alt="A steel touring frame" width={640} height={480} />;\n}\n',
+            },
+        },
+        {
+            id: "NEXT-02",
+            title: "Secrets stay on the server",
+            rule: "Nothing secret is in a `NEXT_PUBLIC_` variable, which is built into the page. Modules that hold secrets import `server-only`, so importing them from a client component fails the build.",
+            why: "Anything a client component touches is sent to every browser, and one import is enough to send a secret with it.",
+            ask: "Could anything secret in this change reach the browser?",
+            stage: "prototype",
+            check: "ai-review",
+            severity: "critical",
+            carries: "SEC-11",
+        },
+        {
+            id: "NEXT-03",
+            title: "Server actions and route handlers check who's calling",
+            rule: "Every server action and route handler checks the caller may do this, to this record, on the server, as its first step.",
+            why: "A server action is a public endpoint anyone can call directly, whatever the screen that normally calls it shows.",
+            ask: "Does every server action and route handler in this change check the caller's permission first?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "critical",
+            carries: "SEC-03",
+        },
+        {
+            id: "NEXT-04",
+            title: "Server actions and route handlers check their input",
+            rule: "Every server action and route handler checks its input against a schema before using it, whatever types the calling component declares.",
+            why: "Types in the client are a promise the caller doesn't have to keep. The server gets whatever is sent.",
+            ask: "Does every server action and route handler in this change check its input on the server?",
+            stage: "prototype",
+            check: "ai-review",
+            severity: "high",
+            carries: "SEC-05",
+        },
+        {
+            id: "NEXT-05",
+            title: "Every response sets its security headers",
+            rule: "The security headers, such as a content security policy, are set for every route, in `next.config` or the proxy, which was called middleware before Next.js 16.",
+            why: "Without them, a browser lets another site frame the page, and runs any script injected into it.",
+            ask: "Do the app's responses set the security headers?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "medium",
+            carries: "SEC-17",
+        },
+    ],
+};

package/dist/profiles/node.d.ts

@@ -0,0 +1,2 @@
+import type { ProfileInput } from "../profile.ts";
+export declare const node: ProfileInput;

package/dist/profiles/node.js

@@ -0,0 +1,79 @@
+// Node on the server, and the base for Express, NestJS, Fastify and Next.js. Examples are from a
+// made-up bicycle repair booking service.
+export const node = {
+    id: "node",
+    name: "Node",
+    prefix: "NODE",
+    about: "Node on the server: no code built from strings, calls to other services that give up, settings checked once at start-up, and failures that stop the process instead of hiding. Express, NestJS, Fastify and Next.js build on it.",
+    stacks: ["node", "hono", "koa"],
+    extends: ["typescript"],
+    rules: [
+        {
+            id: "NODE-01",
+            title: "No text is run with eval",
+            rule: "`eval` isn't used, so no text, least of all text from outside, is ever run as code.",
+            why: "A string that reaches eval runs with everything the server can reach: its secrets, its database and its files.",
+            ask: "Does this change use eval?",
+            stage: "prototype",
+            check: "auto",
+            severity: "critical",
+            carries: "SEC-30",
+            enforcer: { tool: "eslint", rule: "no-eval" },
+            examples: {
+                file: "example.ts",
+                fails: "export function price(formula: string): number {\n  return Number(eval(formula));\n}\n",
+                passes: "export function price(labour: number, parts: number): number {\n  return labour + parts;\n}\n",
+            },
+        },
+        {
+            id: "NODE-02",
+            title: "Every call to another service gives up in time",
+            rule: "A call to another service, such as with `fetch`, has a timeout, such as `AbortSignal.timeout`, and its failure is handled, not left to hang or crash the request.",
+            why: "Node's fetch waits up to five minutes by default, so one slow service holds every request that calls it for that long.",
+            ask: "Does every call to another service in this change have a timeout and handle failure?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "high",
+            carries: "REL-01",
+        },
+        {
+            id: "NODE-03",
+            title: "Settings are read and checked once, at start-up",
+            rule: "`process.env` is read in one module that checks every setting at start-up, such as with a schema, and the process stops when one is missing or wrong. An environment name it doesn't know is treated as production. The rest of the code imports the checked values.",
+            why: "A setting read where it's used fails the first request that needs it, in production, long after the deploy looked fine.",
+            ask: "Does this change read process.env outside the settings module?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "medium",
+            carries: "REL-04",
+        },
+        {
+            id: "NODE-04",
+            title: "A promise that fails where nothing catches it stops the process",
+            rule: "Nothing swallows unhandled rejections: no `process.on('unhandledRejection')` handler that carries on. The process stops, and the platform restarts it.",
+            why: "A process that carries on after an unexpected failure runs in a state nobody designed, and fails in stranger ways later.",
+            ask: "Does this change let the process carry on after an unhandled rejection?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "medium",
+            carries: "CODE-11",
+        },
+        {
+            id: "NODE-05",
+            title: "No function is built from a string",
+            rule: "`new Function` isn't used, so no text is ever turned into a function and run.",
+            why: "A function built from a string is eval by another name, with the same reach into the server.",
+            ask: "Does this change build a function from a string?",
+            stage: "prototype",
+            check: "auto",
+            severity: "critical",
+            carries: "SEC-30",
+            enforcer: { tool: "eslint", rule: "no-new-func" },
+            examples: {
+                file: "example.ts",
+                fails: "export function price(formula: string): number {\n  const run = new Function(`return ${formula}`) as () => number;\n  return run();\n}\n",
+                passes: "export function price(labour: number, parts: number): number {\n  return labour + parts;\n}\n",
+            },
+        },
+    ],
+};

package/dist/profiles/python.d.ts

@@ -0,0 +1,2 @@
+import type { ProfileInput } from "../profile.ts";
+export declare const python: ProfileInput;

package/dist/profiles/python.js

@@ -0,0 +1,232 @@
+// Python, in any framework, enforced by Ruff. Examples are from a made-up bicycle repair booking
+// service.
+/** A function Ruff counts as `statements` statements long: it doesn't count the last line. */
+function longFunction(statements) {
+    const body = Array.from({ length: statements - 1 }, (_, i) => `    total += ${String(i)}`);
+    return ["def repair_total() -> int:", "    total = 0", ...body, "    return total", ""].join("\n");
+}
+export const python = {
+    id: "python",
+    name: "Python",
+    prefix: "PY",
+    about: "Python in any framework, checked by Ruff: errors that are caught on purpose, types that say something, queries and commands never built from text, and calls to other services that give up. The FastAPI profile builds on it.",
+    stacks: ["python"],
+    rules: [
+        {
+            id: "PY-01",
+            title: "An except names what it catches",
+            rule: "An `except` names the errors it expects. A bare `except:` isn't written.",
+            why: "A bare except also catches the signal to stop, and every bug in the code it wraps.",
+            ask: "Does this change write a bare except?",
+            stage: "mvp",
+            check: "auto",
+            severity: "medium",
+            carries: "CODE-12",
+            enforcer: { tool: "ruff", rule: "E722" },
+            examples: {
+                file: "example.py",
+                fails: 'def parse_bay(text: str) -> int:\n    try:\n        return int(text)\n    except:\n        raise ValueError("not a bay") from None\n',
+                passes: 'def parse_bay(text: str) -> int:\n    try:\n        return int(text)\n    except ValueError:\n        raise ValueError("not a bay") from None\n',
+            },
+        },
+        {
+            id: "PY-02",
+            title: "Catching every error says why",
+            rule: "`except Exception` is written only where handling every error alike is right, with a comment saying why, beside a `noqa` for the check.",
+            why: "Catching everything hides the bugs along with the failures it meant to handle.",
+            ask: "Does every except Exception in this change say why?",
+            stage: "mvp",
+            check: "auto",
+            severity: "medium",
+            carries: "CODE-12",
+            enforcer: { tool: "ruff", rule: "BLE001" },
+            examples: {
+                file: "example.py",
+                fails: "from collections.abc import Callable\n\n\ndef parts_price(fetch: Callable[[], float]) -> float | None:\n    try:\n        return fetch()\n    except Exception:\n        return None\n",
+                passes: "from collections.abc import Callable\n\n\ndef parts_price(fetch: Callable[[], float]) -> float | None:\n    try:\n        return fetch()\n    except ConnectionError:\n        return None\n",
+            },
+        },
+        {
+            id: "PY-03",
+            title: "No error is caught and ignored",
+            rule: "An `except` block never just passes. Where ignoring an error is right, it logs it and says why.",
+            why: "An error that's caught and dropped turns a failure into silence.",
+            ask: "Does this change catch an error and do nothing with it?",
+            stage: "prototype",
+            check: "auto",
+            severity: "high",
+            carries: "CODE-11",
+            enforcer: { tool: "ruff", rule: "S110", settings: { "flake8-bandit": { "check-typed-exception": true } } },
+            examples: {
+                file: "example.py",
+                fails: "from collections.abc import Callable\n\n\ndef cancel(booking_id: int, release: Callable[[int], None]) -> None:\n    try:\n        release(booking_id)\n    except KeyError:\n        pass\n",
+                passes: 'import logging\nfrom collections.abc import Callable\n\nlogger = logging.getLogger(__name__)\n\n\ndef cancel(booking_id: int, release: Callable[[int], None]) -> None:\n    try:\n        release(booking_id)\n    except KeyError:\n        # Already released by the mechanic; nothing left to do.\n        logger.info("booking %s already released", booking_id)\n',
+            },
+        },
+        {
+            id: "PY-04",
+            title: "No argument or return is typed `Any`",
+            rule: "No function takes or returns `Any`. Data of unknown shape is `object`, and checked before use. `Any` elsewhere, such as inside `dict[str, Any]`, is the strict type checker's to catch (PY-11).",
+            why: "`Any` turns the type checker off for everything it touches.",
+            ask: "Does any function in this change take or return Any?",
+            stage: "prototype",
+            check: "auto",
+            severity: "medium",
+            carries: "CODE-14",
+            enforcer: { tool: "ruff", rule: "ANN401" },
+            examples: {
+                file: "example.py",
+                fails: "from typing import Any\n\n\ndef bike_name(data: Any) -> str:\n    return str(data)\n",
+                passes: 'def bike_name(data: object) -> str:\n    return data if isinstance(data, str) else ""\n',
+            },
+        },
+        {
+            id: "PY-05",
+            title: "Every function says its argument types",
+            rule: "Every function's arguments have type annotations, so the type checker can check the calls.",
+            why: "An unannotated argument is `Any` to the type checker, and every call to it goes unchecked.",
+            ask: "Does this change add a function argument without a type?",
+            stage: "mvp",
+            check: "auto",
+            severity: "low",
+            carries: "CODE-14",
+            enforcer: { tool: "ruff", rule: "ANN001" },
+            examples: {
+                file: "example.py",
+                fails: "def total(labour, parts) -> int:\n    return labour + parts\n",
+                passes: "def total(labour: int, parts: int) -> int:\n    return labour + parts\n",
+            },
+        },
+        {
+            id: "PY-06",
+            title: "Queries are never built from text",
+            rule: "SQL is never built by joining or formatting strings. Values go to the driver as parameters.",
+            why: "Text put into a query can change what the query does, and read or delete any record.",
+            ask: "Does this change build a query from strings?",
+            stage: "prototype",
+            check: "auto",
+            severity: "critical",
+            carries: "SEC-07",
+            enforcer: { tool: "ruff", rule: "S608" },
+            examples: {
+                file: "example.py",
+                fails: "from sqlite3 import Cursor\n\n\ndef bikes_named(cursor: Cursor, name: str) -> list[tuple[str]]:\n    cursor.execute(f\"SELECT serial FROM bikes WHERE name = '{name}'\")\n    return cursor.fetchall()\n",
+                passes: 'from sqlite3 import Cursor\n\n\ndef bikes_named(cursor: Cursor, name: str) -> list[tuple[str]]:\n    cursor.execute("SELECT serial FROM bikes WHERE name = ?", (name,))\n    return cursor.fetchall()\n',
+            },
+        },
+        {
+            id: "PY-07",
+            title: "No text is run with eval",
+            rule: "`eval` isn't used, so no text, least of all text from outside, is ever run as code.",
+            why: "A string that reaches eval runs with everything the server can reach.",
+            ask: "Does this change use eval?",
+            stage: "prototype",
+            check: "auto",
+            severity: "critical",
+            carries: "SEC-30",
+            enforcer: { tool: "ruff", rule: "S307" },
+            examples: {
+                file: "example.py",
+                fails: "def price(formula: str) -> float:\n    return float(eval(formula))\n",
+                passes: "def price(labour: float, parts: float) -> float:\n    return labour + parts\n",
+            },
+        },
+        {
+            id: "PY-08",
+            title: "Commands don't go through a shell",
+            rule: "`subprocess` runs a command as a list of arguments, never with `shell=True`, so no argument can become another command.",
+            why: "With a shell, one argument holding a semicolon runs whatever follows it.",
+            ask: "Does this change run a command through a shell?",
+            stage: "prototype",
+            check: "auto",
+            severity: "critical",
+            carries: "SEC-30",
+            enforcer: { tool: "ruff", rule: "S602" },
+            examples: {
+                file: "example.py",
+                fails: 'import subprocess\n\n\ndef print_label(serial: str) -> None:\n    subprocess.run(f"lpr label-{serial}.pdf", shell=True, check=True)\n',
+                passes: 'import subprocess\n\n\ndef print_label(serial: str) -> None:\n    subprocess.run(["lpr", f"label-{serial}.pdf"], check=True)\n',
+            },
+        },
+        {
+            id: "PY-09",
+            title: "Every request to another service has a timeout",
+            rule: "Every HTTP request, such as with `requests`, passes a `timeout`, and its failure is handled.",
+            why: "requests waits forever by default, so one slow service holds every request that calls it.",
+            ask: "Does every HTTP request in this change pass a timeout?",
+            stage: "mvp",
+            check: "auto",
+            severity: "high",
+            carries: "REL-01",
+            enforcer: { tool: "ruff", rule: "S113" },
+            examples: {
+                file: "example.py",
+                fails: 'import requests\n\n\ndef parts_price(sku: str) -> float:\n    return float(requests.get(f"https://parts.example.com/{sku}").json()["price"])\n',
+                passes: 'import requests\n\n\ndef parts_price(sku: str) -> float:\n    response = requests.get(f"https://parts.example.com/{sku}", timeout=5)\n    return float(response.json()["price"])\n',
+            },
+        },
+        {
+            id: "PY-10",
+            title: "A function with more than {value} statements prompts a question",
+            rule: "A function over {value} statements fails the lint, so someone asks whether it does two things. Where it doesn't, a `noqa` beside it says why.",
+            why: "Long functions usually hide a second job, and the second job is what the next change breaks.",
+            ask: "Has any function grown past {value} statements, and does each that stays say why?",
+            stage: "mvp",
+            check: "auto",
+            severity: "low",
+            carries: "CODE-10",
+            default: { value: 50, unit: "statements" },
+            enforcer: { tool: "ruff", rule: "PLR0915", settings: { pylint: { "max-statements": "$value" } } },
+            examples: {
+                file: "example.py",
+                fails: (value) => longFunction(Number(value) + 1),
+                passes: (value) => longFunction(Number(value)),
+            },
+        },
+        {
+            id: "PY-11",
+            title: "The type checker runs in strict mode",
+            rule: "A type checker, such as mypy with `strict = true` or pyright in strict mode, runs on every change and fails the build.",
+            why: "Annotations nobody checks drift from the code, and read as a promise nothing keeps.",
+            ask: "Does a strict type checker run on every change?",
+            stage: "mvp",
+            check: "ai-review",
+            severity: "medium",
+            carries: "CODE-14",
+        },
+        {
+            id: "PY-12",
+            title: "No text is run with exec",
+            rule: "`exec` isn't used, so no text, least of all text from outside, is ever run as code.",
+            why: "exec runs any statement it's given, with everything the server can reach.",
+            ask: "Does this change use exec?",
+            stage: "prototype",
+            check: "auto",
+            severity: "critical",
+            carries: "SEC-30",
+            enforcer: { tool: "ruff", rule: "S102" },
+            examples: {
+                file: "example.py",
+                fails: 'def apply_discount(code: str) -> None:\n    exec(f"discount = {code}")\n',
+                passes: "def apply_discount(percent: int) -> float:\n    return percent / 100\n",
+            },
+        },
+        {
+            id: "PY-13",
+            title: "No command is run by os.system or another shell helper",
+            rule: "`os.system`, `os.popen` and the like, which always go through a shell, aren't used. A command runs with `subprocess` and a list of arguments.",
+            why: "Every one of these hands the whole string to a shell, so an argument holding a semicolon runs whatever follows it.",
+            ask: "Does this change run a command through os.system or another shell helper?",
+            stage: "prototype",
+            check: "auto",
+            severity: "critical",
+            carries: "SEC-30",
+            enforcer: { tool: "ruff", rule: "S605" },
+            examples: {
+                file: "example.py",
+                fails: 'import os\n\n\ndef print_label(serial: str) -> None:\n    os.system(f"lpr label-{serial}.pdf")\n',
+                passes: 'import subprocess\n\n\ndef print_label(serial: str) -> None:\n    subprocess.run(["lpr", f"label-{serial}.pdf"], check=True)\n',
+            },
+        },
+    ],
+};

package/dist/profiles/react-native.d.ts

@@ -0,0 +1,2 @@
+import type { ProfileInput } from "../profile.ts";
+export declare const reactNative: ProfileInput;