Use curly braces `{}` around all control structures (`if`, `for`, `while`, `do`-`while`) to improve readability and prevent logic errors.
readability-refactorstyle-conventions
High
Always Validate `ModelState.IsValid` in Controllers
Failing to check `ModelState.IsValid` before processing user input can result in invalid or unverified data being accepted.
security-hardening
High
Annotate REST API Actions with HTTP Verb Attributes
Without explicit HTTP method attributes, API behavior can be unclear, leading to route conflicts and unexpected results.
api-conventions
High
API Controllers Should Inherit from `ControllerBase`
Verify that API controllers inherit from `ControllerBase` instead of `Controller` unless views are explicitly required.
api-conventionsstyle-conventions
High
Approvals for bulk export endpoints
Protect /exports/ with role checks, fresh MFA, and rate limits; add requester and approved_by to the audit event.
compliance-soc2-essentialssecurity-hardening+1
High
Audit access to PII with purpose and actor (no raw values)
Whenever PII is read, emit an audit event capturing actor, purpose, fields touched, and legal basis; never include raw PII in the audit payload—store hashes/tokens only.
compliance-lgpdobservability-logging+1
High
Avoid `DateTime.Now` for Timing Operations
`DateTime.Now` is affected by daylight savings and system clock adjustments. Use `Stopwatch` for more accurate timing.
performance-efficiency
High
Avoid `new Guid()` When Not Needed
Using `new Guid()` instead of `Guid.Empty` or `Guid.NewGuid()` can be misleading and lead to unintended behavior.
readability-refactor
High
Avoid `return`, `break`, or `continue` in `finally` Blocks
Do not use `return`, `break`, or `continue` inside `finally` blocks as they can suppress exceptions and lead to unintended behavior.
error-handlingreadability-refactor
High
Avoid `v-if` with `v-for`
Never use `v-if` on the same element as `v-for`.
performance-efficiencystack-vue+1
High
Avoid array indexes as keys in React lists
Ensure that React list items do not use array indexes as keys. This practice can cause reordering issues and unexpected behavior. Recommend using unique identifiers instead.
performance-efficiencystack-react+1
High
Avoid asynchronous operations in constructors
Ensure that constructors do not include asynchronous operations. Constructors should initialize class instances synchronously. If async logic is required, suggest moving it to a separate initialization method.
error-handlingreadability-refactor
High
Avoid building system commands from user input
Check for occurrences where user input is directly used to construct system commands. This introduces a risk of command injection. Suggest using parameterized queries or safe wrappers instead.
security-hardening
High
Avoid ClassCastException Due to Unsafe Casting
Ensure that `instanceof` checks are used before performing explicit type casting to prevent `ClassCastException`.
error-handling
High
Avoid Confusing Implicit String Concatenation
Detect missing commas in lists, tuples, or dictionaries that unintentionally concatenate strings. This can lead to unexpected behavior and hard-to-find bugs.
error-handlingreadability-refactor+1
High
Avoid Constructing System Commands from User Input
Passing user input directly into system commands can lead to command injection vulnerabilities. Always sanitize inputs before execution.
security-hardening
High
Avoid Creating Objects Just to Call `getClass()`
Ensure that objects are not created solely for calling `getClass()`. Use `ClassName.class` instead.
performance-efficiency
High
Avoid Default Mutable Arguments
Detect function definitions that use mutable objects (lists, dictionaries) as default arguments. This can lead to unintended shared state. Recommend using `None` as the default and initializing the object inside the function.
error-handlingstack-python
High
Avoid empty catch blocks
Never swallow exceptions silently; log with context and either rethrow or handle explicitly.
error-handling
High
Avoid empty catch blocks
Ensure that catch blocks do not remain empty. Empty catch blocks hide errors, making debugging difficult. Recommend logging or handling errors properly.
error-handlingobservability-logging
High
Avoid Empty Catch Blocks
Ensure that catch blocks contain meaningful exception handling logic and do not remain empty.
error-handling
High
Avoid Empty Finalizers
Check that finalizers are not left empty. If cleanup is needed, ensure proper resource disposal is implemented instead.
maintainability
High
Avoid Expensive Preconditions and Logging Arguments
Ensure that logging arguments and preconditions do not require costly evaluations before method calls.
observability-loggingperformance-efficiency
High
Avoid Functions That Always Return the Same Value
Identify functions that return the same value regardless of input. This may indicate poor design or a logic error.