// library

Every Mesrai rule, in one place

808 rules

Severity

Bucket

High
RSpec: stub external HTTP and assert on effects
Use WebMock or equivalent to stub external requests in specs and prefer effect-based matchers (e.g., change(Model, :count)) over brittle value guesses.
testing-quality
High
Separate UI logic from business logic
Keep UI/controllers thin; move domain logic to services or domain objects.
module-architecturereadability-refactor
High
Serve responsive images with modern formats and lazy-load
Provide AVIF/WebP fallbacks via <img srcset> with width/height attributes, meaningful sizes, and "loading=lazy" plus "decoding=async". Avoid shipping oversized PNG/JPEG when AVIF/WebP is supported.
web-static-assetsperformance-efficiency
High
Set CPU/memory requests and limits for all containers
Every container must specify resources.requests and resources.limits for cpu and memory.
infra-as-codeperformance-efficiency
High
Specify StandardError explicitly in rescue blocks
Avoid bare `rescue`; rescue StandardError (or a narrower class) and log with context.
error-handlingobservability-logging
High
Specify Timeout for Regular Expressions
Without a timeout, regex processing on untrusted input can be exploited for Denial-of-Service (DoS) attacks. Always define a timeout when using regex.
security-hardening
High
Structured audit log middleware with trace IDs
Attach a trace_id (e.g., from request header or generated UUID) and emit structured JSON logs for login, role change, and data export routes.
compliance-soc2-essentialsobservability-logging
High
Supersede instead of editing history
Do not rewrite accepted ADRs. When reversing or replacing a decision, create a new ADR with Status: accepted and add 'Supersedes: NNNN' while marking the old ADR as 'Status: superseded by NNNN'.
docs-adrsmaintainability
High
Tag/label every resource with owner, env, and cost-center
All Terraform/Kubernetes resources must include standard tags/labels: owner, env, cost-center (and application if available).
infra-as-codemaintainability
High
Template must include Context, Decision, Consequences, and Status
Every ADR must contain the sections: Context, Decision, Consequences, Status. Allowed Status values: proposed, accepted, deprecated, superseded.
docs-adrsmaintainability
High
Terraform state must use a remote backend with locking
Configure a remote backend with state locking (e.g., S3 + DynamoDB table or AzureRM blob with leases). Do not use local backend for shared environments.
infra-as-codeci-cd-build-hygiene+1
High
Throw exceptions on job failures
Background jobs must throw on irrecoverable failures (after logging) so the runner/queue can retry or dead-letter appropriately.
error-handlingobservability-logging+1
High
Tie ADRs to versioning and deprecation notices
For changes affecting public APIs or modules, include 'Versioning & Deprecation' with semantic version impact and deprecation timeline; link to CHANGELOG and deprecation notices.
docs-adrsapi-contracts-versioning+1
High
Transactional erasure with tombstone event
Wrap PII scrubbing and session invalidation in a single DB transaction; publish a gdpr.erased event with subject ID and timestamp after commit.
compliance-gdprprivacy-pii+1
High
Treat suspicious hardcoded tokens/keys as secrets and move them to a secret store
Never hardcode credentials (API keys, tokens, private keys) in source code, configs, or tests. If a string looks like a credential based on context (variable name, header usage, auth flows), treat it as a secret even if it is not high-entropy. Move it to env/secret manager, rotate the credential if it may have leaked, and remove it from git history if necessary.
secrets-credentialssecurity-hardening+1
High
Use `Arrays.stream()` for Primitive Arrays
Ensure that `Arrays.stream(array)` is used instead of `Arrays.asList(T... a).stream()` for primitive arrays.
performance-efficiency
High
Use `const` for Literal Constructor Parameters in `@immutable` Classes
Ensure that all literal values passed to constructors of `@immutable` classes are marked as `const` to prevent unnecessary object creation.
performance-efficiencystack-flutter+1
High
Use `entrySet()` When Iterating Over Maps
Ensure that `entrySet()` is used instead of iterating over `keySet()` and calling `get(key)`, to optimize performance.
performance-efficiency
High
Use `final` for Constants
Ensure that constants are declared with the `final` keyword to prevent modification.
maintainabilitystyle-conventions
High
Use `finally` for Resource Cleanup
Detect code where resources (files, sockets, etc.) are not closed in a `finally` block. Using `finally` ensures that resources are released, even if an exception is raised.
error-handlingperformance-efficiency+1
High
Use `First`/`Single` Instead of `FirstOrDefault`/`SingleOrDefault` for Non-Empty Collections
Ensure `First()` or `Single()` is used instead of `FirstOrDefault()` or `SingleOrDefault()` when collections are guaranteed to have elements.
error-handling
High
Use `readonly` or `const` for Immutable Data
Ensure that immutable instance fields are marked as `readonly`, and compile-time constants are marked as `const`.
maintainabilitystyle-conventions
High
Use appropriate HTTP status codes
Return 2xx on success, 4xx for client errors, and 5xx for server errors with minimal, non-sensitive bodies.
api-conventions
High
Use Appropriate HTTP Status Codes
Ensure that HTTP handlers return the appropriate status codes based on request success or failure.
api-conventions

RSpec: stub external HTTP and assert on effects

Separate UI logic from business logic

Serve responsive images with modern formats and lazy-load

Set CPU/memory requests and limits for all containers

Specify StandardError explicitly in rescue blocks

Specify Timeout for Regular Expressions

Structured audit log middleware with trace IDs

Supersede instead of editing history

Tag/label every resource with owner, env, and cost-center

Template must include Context, Decision, Consequences, and Status

Terraform state must use a remote backend with locking

Throw exceptions on job failures

Tie ADRs to versioning and deprecation notices

Transactional erasure with tombstone event

Treat suspicious hardcoded tokens/keys as secrets and move them to a secret store

Use `Arrays.stream()` for Primitive Arrays

Use `const` for Literal Constructor Parameters in `@immutable` Classes

Use `entrySet()` When Iterating Over Maps

Use `final` for Constants

Use `finally` for Resource Cleanup

Use `First`/`Single` Instead of `FirstOrDefault`/`SingleOrDefault` for Non-Empty Collections

Use `readonly` or `const` for Immutable Data

Use appropriate HTTP status codes

Use Appropriate HTTP Status Codes

RSpec: stub external HTTP and assert on effects

Separate UI logic from business logic

Serve responsive images with modern formats and lazy-load

Set CPU/memory requests and limits for all containers

Specify StandardError explicitly in rescue blocks

Specify Timeout for Regular Expressions

Structured audit log middleware with trace IDs

Supersede instead of editing history

Tag/label every resource with owner, env, and cost-center

Template must include Context, Decision, Consequences, and Status

Terraform state must use a remote backend with locking

Throw exceptions on job failures

Tie ADRs to versioning and deprecation notices

Transactional erasure with tombstone event

Treat suspicious hardcoded tokens/keys as secrets and move them to a secret store

Use `Arrays.stream()` for Primitive Arrays

Use `const` for Literal Constructor Parameters in `@immutable` Classes

Use `entrySet()` When Iterating Over Maps

Use `final` for Constants

Use `finally` for Resource Cleanup

Use `First`/`Single` Instead of `FirstOrDefault`/`SingleOrDefault` for Non-Empty Collections

Use `readonly` or `const` for Immutable Data

Use appropriate HTTP status codes

Use Appropriate HTTP Status Codes