// library

Config & Environment rules

16 rules

Severity

Bucket

ActiveBucketConfig & Environment Clear all

High
Add explicit environment variable checks
Validate required runtime env vars at container start via an entrypoint script; exit with a clear message on missing values.
config-environmentcontainer-docker-hygiene+1
High
Encrypt PII at rest using application-layer crypto
Encrypt sensitive columns (e.g., email, phone) with managed keys; ensure DB connection enforces TLS. Store only ciphertext; compare via deterministic token/hashes when needed. (GDPR Art. 32)
compliance-gdprsecurity-hardening+1
High
Enforce retention with explicit TTL per data category
PII tables must include an expires_at (or retention_policy) column and a scheduled deletion/archival job aligned to data category. No indefinite retention. (GDPR Art. 5(1)(e))
compliance-gdprprivacy-pii+2
High
Externalize URLs and API keys to configuration
Read API URLs/keys from ENV/credentials and inject where needed; do not hardcode.
config-environmentsecrets-credentials
High
Move environment configuration to startup
Load and validate environment/config once during startup; inject settings into modules instead of re-reading env.
config-environmentmodule-architecture+1
High
Never expose secrets to the client
Read secrets (process.env.*) only in Server Components, Route Handlers, or server actions. Client Components must use ONLY NEXT_PUBLIC_* variables.
stack-nextjsstack-react+3
High
Read headers/cookies only on the server
Use headers() and cookies() in Server Components, Route Handlers, or server actions; never in Client Components.
stack-nextjsstack-react+2
High
Retention: set TTLs for caches and temp stores with PII
All cache entries containing PII must set an explicit TTL aligned to the retention policy (e.g., 24h). No indefinite storage of personal data in Redis or in-memory caches.
compliance-lgpdcaching-strategy+1
High
Treat suspicious hardcoded tokens/keys as secrets and move them to a secret store
Never hardcode credentials (API keys, tokens, private keys) in source code, configs, or tests. If a string looks like a credential based on context (variable name, header usage, auth flows), treat it as a secret even if it is not high-entropy. Move it to env/secret manager, rotate the credential if it may have leaked, and remove it from git history if necessary.
secrets-credentialssecurity-hardening+1
High
Validate environment/config at startup
At process start, validate required configuration keys and fail fast with a clear message if any are missing or malformed.
config-environmentstack-nodejs
Low
Clean up feature flags when retiring code (avoid zombie flags)
When removing or decommissioning a feature, ensure the associated feature flag is also removed from: - application code paths, - config/registry files (e.g., flags.ts, config.json), and - analytics/feature flag tools (if applicable). If a PostHog (or similar) MCP is available, verify the flag is disabled/removed and not referenced elsewhere. Otherwise, require a repo-wide search evidence in the PR.
maintainabilityconfig-environment+2
Low
Consolidate repetitive configuration patterns
Replace repeated set/get config calls with data-driven loops or loaders from a single schema/source.
config-environmentduplication-complexity+2
Low
Move startup validation out of interceptor factories
Perform one-time configuration/dependency validation at process startup (init/bootstrap). Avoid doing it inside per-request middleware/interceptor factories.
config-environmentmodule-architecture
Low
Remove unused configuration variables
Delete dead configuration fields and env flags; keep only variables that change behavior.
config-environmentmaintainability
Low
Replace hardcoded paths with configuration
Derive paths/URLs from configuration or environment variables, not string literals in code.
config-environmentmaintainability+1
Low
Validate Terraform variables with types and constraints
All variables must declare a type, default (when sensible), and validation blocks; mark sensitive inputs with sensitive=true.
infra-as-codeconfig-environment+1

16 rules

Add explicit environment variable checks

Encrypt PII at rest using application-layer crypto

Enforce retention with explicit TTL per data category

Externalize URLs and API keys to configuration

Move environment configuration to startup

Never expose secrets to the client

Read headers/cookies only on the server

Retention: set TTLs for caches and temp stores with PII

Treat suspicious hardcoded tokens/keys as secrets and move them to a secret store

Validate environment/config at startup

Clean up feature flags when retiring code (avoid zombie flags)

Consolidate repetitive configuration patterns

Move startup validation out of interceptor factories

Remove unused configuration variables

Replace hardcoded paths with configuration

Validate Terraform variables with types and constraints

Add explicit environment variable checks

Encrypt PII at rest using application-layer crypto

Enforce retention with explicit TTL per data category

Externalize URLs and API keys to configuration

Move environment configuration to startup

Never expose secrets to the client

Read headers/cookies only on the server

Retention: set TTLs for caches and temp stores with PII

Treat suspicious hardcoded tokens/keys as secrets and move them to a secret store

Validate environment/config at startup

Clean up feature flags when retiring code (avoid zombie flags)

Consolidate repetitive configuration patterns

Move startup validation out of interceptor factories

Remove unused configuration variables

Replace hardcoded paths with configuration

Validate Terraform variables with types and constraints