Rules
Explore the documented source-scan conditions first, then switch to the full catalog to study the wider design. A rule's selection, historical evidence and observed coverage are separate facts.
Availability in source-scan#
9 conditions are selected by default; 2 stdio conditions require --include-stdio-rules. The other 130 conditions are unavailable in source-scan. Each rule page also identifies any separate experimental source preview.
The catalog contains 138 stable Rule IDs grouping 141 conditions. The 33 historically accepted bounded conditions at 4558458d have not been requalified for product 524fa07e. Read the condition's method and evidence boundary before applying a result.
Without JavaScript, the links below remain available and the complete catalog is included in the readable page. Interactive filters narrow the same list when JavaScript is available.
Browse rules
9 conditions in 9 rules
Isolation and executors
Call crosses incompatible isolation
concurrency.incompatible-isolation@1.0.0- V-EXEC-01Default
Isolation and executors
MainActor entry without a proven context
concurrency.unproven-mainactor-entry@1.0.0- V-EXEC-02Default
Isolation and executors
Required context lost through detachment
concurrency.detached-task-context-loss@1.0.0- V-EXEC-03Default
Isolation and executors
Callback runs in an incompatible scheduler context
concurrency.dispatch-isolation-mismatch@1.0.0- V-EXEC-04Default
Isolation and executors
Invalid isolation assumption
portfolio.exec.05@1.0.0- V-EXEC-05Default
Isolation and executors
Resource used outside its execution domain
portfolio.exec.06@1.0.0- V-EXEC-06Default
Isolation and executors
Thread-affine value survives a suspension
portfolio.exec.07@1.0.0- V-EXEC-07Default
Isolation and executors
Required task-local value or executor preference is lost
portfolio.exec.08@1.0.0- V-EXEC-08Default
Tasks, reentrancy, and cancellation
Guard is held across a disallowed await
concurrency.guard-held-across-suspension@1.0.0- V-ASYNC-14Default
Complete catalog — all 138 rule links
- repository-unused@1.0.0 — Unused declaration or declaration group
- architecture.production-used-only-by-tests@1.0.0 — Production code used only by tests
- architecture.forbidden-dependency@1.0.0 — Forbidden dependency or layer bypass
- api.access-narrowing@1.0.0 — Excessive API visibility
- architecture.unused-product-dependency@1.0.0 — Unused product dependency
- architecture.undeclared-direct-provider@1.0.0 — Undeclared direct provider
- architecture.dependency-cycle@1.0.0 — Disallowed component cycle
- api.implementation-type-leakage@1.0.0 — Implementation type exposed through an API
- architecture.registration-contract-mismatch@1.0.0 — Incompatible registration or entry point
- portfolio.arch.10@1.0.0 — Required resource missing from a shipping variant
- portfolio.arch.11@1.0.0 — Parameter unused across its dispatch family
- portfolio.arch.12@1.0.0 — Property is written but never observed
- portfolio.arch.13@1.0.0 — Redundant protocol or conformance
- portfolio.arch.14@1.0.0 — Semantically redundant import
- concurrency.incompatible-isolation@1.0.0 — Call crosses incompatible isolation
- concurrency.unproven-mainactor-entry@1.0.0 — MainActor entry without a proven context
- concurrency.detached-task-context-loss@1.0.0 — Required context lost through detachment
- concurrency.dispatch-isolation-mismatch@1.0.0 — Callback runs in an incompatible scheduler context
- portfolio.exec.05@1.0.0 — Invalid isolation assumption
- portfolio.exec.06@1.0.0 — Resource used outside its execution domain
- portfolio.exec.07@1.0.0 — Thread-affine value survives a suspension
- portfolio.exec.08@1.0.0 — Required task-local value or executor preference is lost
- concurrency.main-actor-blocking@1.0.0 — Blocking call on a critical executor
- portfolio.exec.10@1.0.0 — Expensive computation on a critical executor
- portfolio.exec.11@1.0.0 — Removable scheduling boundary
- portfolio.exec.12@1.0.0 — Cost amplified by actor crossings
- portfolio.exec.13@1.0.0 — Independent work is unintentionally serialized
- portfolio.exec.14@1.0.0 — Custom SerialExecutor violates serialization
- concurrency.state-freshness-across-suspension@1.0.0 — State check becomes stale across await
- concurrency.actor-invariant-exposure@1.0.0 — Broken invariant is observable during suspension
- concurrency.obsolete-generation-commit@1.0.0 — Stale result overwrites a newer generation
- portfolio.async.04@1.0.0 — Operation requiring single-flight starts more than once
- portfolio.async.05@1.0.0 — Code depends on an unspecified actor-task order
- concurrency.lost-continuation-resume@1.0.0 — Continuation can finish without resume
- concurrency.double-continuation-resume@1.0.0 — Continuation can resume more than once
- concurrency.cancel-register-start-race@1.0.0 — Cancellation is lost between registration and start
- concurrency.cancelled-forbidden-effect@1.0.0 — Forbidden commit after cancellation or rejection
- concurrency.unresponsive-cancellation-work@1.0.0 — Work does not honor its cancellation contract
- concurrency.timeout-sibling-outlives-race@1.0.0 — Timeout or first result does not finish its scope
- concurrency.task-outlives-scope@1.0.0 — Task outlives its required lifecycle scope
- portfolio.async.13@1.0.0 — Required task result or error is lost
- concurrency.guard-held-across-suspension@1.0.0 — Guard is held across a disallowed await
- concurrency.sole-producer-self-block@1.0.0 — Wait cycle blocks required producers
- portfolio.async.16@1.0.0 — Synchronous waits exhaust the cooperative pool
- portfolio.async.17@1.0.0 — Priority inversion through opaque waiting
- portfolio.async.18@1.0.0 — Shared-memory race across an unsafe or legacy boundary
- portfolio.async.19@1.0.0 — Synchronous callback re-enters an unfinished protocol
- portfolio.async.20@1.0.0 — Custom executor loses or repeats a job
- lifetime.escaping-value@1.0.0 — Borrowed pointer or view escapes its lifetime
- portfolio.life.02@1.0.0 — Use after free
- portfolio.life.03@1.0.0 — Repeated or incompatible deallocation
- portfolio.life.04@1.0.0 — Unowned access after owner deallocation
- lifetime.unmanaged-ownership-balance@1.0.0 — Unmanaged ownership imbalance
- lifetime.ownership-cycle@1.0.0 — Strong ownership cycle without a valid termination
- portfolio.life.07@1.0.0 — Required weak consumer is released too early
- lifetime.registration-outlives-scope@1.0.0 — Registration outlives its allowed scope
- lifetime.undischarged-resource-obligation@1.0.0 — Cleanup obligation is not discharged
- portfolio.life.10@1.0.0 — Closed or transferred resource is still used
- portfolio.life.11@1.0.0 — Read from an uninitialized buffer region
- correctness.pointer-count-initialization@1.0.0 — Pointer or count exceeds its valid extent
- performance.repeated-linear-traversal@1.0.0 — Repeated linear traversal / Lazy pipeline is recomputed
- performance.repeated-sorting@1.0.0 — Repeated invariant sorting
- performance.repeated-consumed-materialization@1.0.0 — Repeated consumed materialization / Growing prefix is repeatedly materialized
- performance.array-fifo-shifts@1.0.0 — Array used as a growing shifting FIFO
- portfolio.perf.06@1.0.0 — Full sort used for an extremum or top-k result
- performance.comparator-projection-amplification@1.0.0 — Expensive projection repeated by a comparator
- portfolio.perf.08@1.0.0 — Eager materialization before a short consumer
- portfolio.perf.09@1.0.0 — Repeated physical copy-on-write detach
- portfolio.perf.10@1.0.0 — Get-copy-modify-set amplifies cost
- portfolio.perf.12@1.0.0 — Capacity policy violates the amortized bound
- portfolio.perf.13@1.0.0 — Repeated element-by-element bridging
- portfolio.perf.14@1.0.0 — Repeated expensive hashing or equality work
- portfolio.perf.15@1.0.0 — Small slice retains large storage
- portfolio.perf.16@1.0.0 — Fine-grained tasks amplify scheduling work
- portfolio.perf.17@1.0.0 — Fanout retains excessive live data
- security.sensitive-data-flow@1.0.0 — Sensitive data reaches logs / Sensitive data reaches a forbidden destination
- security.sql-structure-injection@1.0.0 — SQL injection
- security.shell-command-injection@1.0.0 — Shell injection
- security.format-position-injection@1.0.0 — Format-string injection
- security.path-traversal@1.0.0 — Path traversal outside the extraction root
- security.javascript-code-injection@1.0.0 — JavaScript or HTML context injection
- security.privileged-url-input@1.0.0 — Unprivileged input controls a privileged URL sink
- portfolio.sec.09@1.0.0 — Predicate injection
- portfolio.sec.10@1.0.0 — Regular-expression injection
- portfolio.sec.11@1.0.0 — Algorithmic denial of service through a regular expression
- portfolio.sec.12@1.0.0 — External-entity expansion from untrusted XML
- portfolio.sec.13@1.0.0 — TLS trust evaluation is effectively disabled
- portfolio.sec.14@1.0.0 — Cryptography does not provide the claimed property
- portfolio.sec.15@1.0.0 — Keyed nonce or IV is reused in an unsafe mode
- portfolio.sec.16@1.0.0 — Unsafe password-derivation contract
- portfolio.sec.17@1.0.0 — Predictable randomness in a security-sensitive value
- portfolio.sec.18@1.0.0 — Untrusted deserialization crosses the allowed-type boundary
- portfolio.sec.19@1.0.0 — Privileged effect bypasses required authorization
- portfolio.sec.20@1.0.0 — Security validator or sanitizer is bypassed
- portfolio.sec.21@1.0.0 — Embedded secret reaches a security-sensitive use
- portfolio.sec.22@1.0.0 — WebView receives forbidden capabilities
- portfolio.sec.23@1.0.0 — Cryptographic key has insufficient strength
- portfolio.sec.24@1.0.0 — Dependency is fetched over an untrusted channel
- portfolio.sec.25@1.0.0 — Non-reproducible dependency resolution violates policy
- portfolio.sec.26@1.0.0 — Debug capability is exposed in a shipping product
- correctness.equality-hash-contract@1.0.0 — Equality and hashing disagree
- correctness.persisted-process-hash@1.0.0 — Process-local hash is used as a stable identity
- correctness.regex-range-units@1.0.0 — Incompatible length or index units
- correctness.invalidated-collection-index@1.0.0 — Invalidated collection index is used
- correctness.mutable-collection-key@1.0.0 — Key changes equality or hash while in a collection
- correctness.bounded-ordering-law@1.0.0 — Ordering laws are violated
- correctness.canonical-output-nondeterminism@1.0.0 — Unstable ordering reaches canonical output
- portfolio.cor.08@1.0.0 — Size or count exceeds its numeric range
- portfolio.cor.09@1.0.0 — Non-finite value reaches a finite-only consumer
- portfolio.cor.10@1.0.0 — Interprocedural path reaches an invalid force operation
- portfolio.cor.11@1.0.0 — Single-pass sequence is consumed more than once
- portfolio.cor.12@1.0.0 — Copy violates the state-independence contract
- portfolio.cor.13@1.0.0 — Producer and consumer canonicalize identity differently
- portfolio.cor.14@1.0.0 — Written value is lost before observation
- portfolio.cor.15@1.0.0 — Predicate does not distinguish valid states
- portfolio.cor.16@1.0.0 — Conditional-result branches are semantically identical
- portfolio.cor.17@1.0.0 — Control-flow region is unreachable
- portfolio.cor.18@1.0.0 — Computed result is discarded without a useful effect
- portfolio.cor.19@1.0.0 — Comparison violates its numeric precision contract
- portfolio.stream.01@1.0.0 — Buffer or accumulator lacks a required bound
- portfolio.stream.02@1.0.0 — Drop policy violates required event delivery
- portfolio.stream.03@1.0.0 — Concurrent next calls on a single-consumer iterator
- portfolio.stream.04@1.0.0 — Stream is not finished on a required terminal path
- portfolio.stream.05@1.0.0 — Retry or refresh forms a loop without progress or budget
- portfolio.stream.06@1.0.0 — Retry duplicates a non-idempotent effect
- portfolio.stream.07@1.0.0 — Related changes escape a required transaction
- portfolio.ui.01@1.0.0 — Element identity is unstable across updates
- portfolio.ui.02@1.0.0 — Distinct elements share one identity
- portfolio.ui.03@1.0.0 — View computation causes a state-update cycle
- portfolio.ui.04@1.0.0 — One-time state does not update with required input
- portfolio.change.01@1.0.0 — Source API change breaks an admitted consumer
- portfolio.change.02@1.0.0 — ABI change breaks binary compatibility
- portfolio.change.03@1.0.0 — Existing signature gains incompatible behavior
- portfolio.change.04@1.0.0 — Consumer silently binds to a different symbol
- portfolio.change.05@1.0.0 — Version range admits an incompatible provider
- portfolio.change.06@1.0.0 — Change bypasses required consumer review
- portfolio.change.07@1.0.0 — Comparable resource bound regresses
- portfolio.change.08@1.0.0 — Cache key or invalidation omits a result dependency