Rules

All 152 rules. 43 are errors and fail the run; the remaining 109 are warnings and only report.

Every rule ships a snippet it must flag and one it must ignore, executed on every commit. Open any rule to see both.

Use the search box above to find a rule by what it catches.

Clean-code

Rule	Catches	Severity	Analysis
VBC-077 deceptive-function-name	Lying function name detected: implies a non-mutating action but contains side-effect…	error	AST
VBC-079 debugger-statements	debugger; statement found	error	Regex
VBC-080 browser-alert	Avoid using alert()	error	Regex
VBC-008 sleep-race-condition	Using setTimeout as a sleep to paper over a race condition	warning	Regex
VBC-009 jquery-modern-project	jQuery dependency detected	warning	Regex
VBC-012 redundant-promise-constructor	Redundant Promise constructor wrapping	warning	Regex
VBC-015 magic-numbers	Magic number detected	warning	Regex
VBC-016 commented-out-code	Potential commented-out code detected	warning	Regex
VBC-018 console-logs-detected	Production code with console usage found	warning	Regex
VBC-026 empty-file	Empty code file detected	warning	AST
VBC-042 too-many-comments	Too many consecutive comment lines	warning	Regex
VBC-048 meaningless-variable-names	Meaningless variable name detected	warning	Regex
VBC-049 magic-boolean	Magic boolean passed as first argument	warning	Regex
VBC-051 mixed-casing	snake_case and camelCase mixed	warning	Regex
VBC-052 single-letter-variables	Single-letter variable name detected	warning	Regex
VBC-053 redundant-interpolation	Redundant string interpolation detected	warning	Regex
VBC-054 unnecessary-else	Unnecessary 'else' after 'return'	warning	Regex
VBC-056 stale-todo	Debt marker that admits it is temporary	warning	Regex
VBC-058 overly-long-variable-name	Overly long variable name (>35 chars) detected	warning	Regex
VBC-063 empty-else	Empty else block detected	warning	Regex
VBC-063-B empty-block	Empty block detected	warning	AST
VBC-065 hadouken-nested-logic	Nested logic is levels deep, over the limit of	warning	AST
VBC-066 redundant-if-true	Redundant 'if(true)' detected	warning	AST
VBC-068 overuse-ternary	Chained or nested ternary	warning	Regex
VBC-084 long-line-limit	Line is too long ( characters)	warning	Regex
VBC-096 complex-regex-no-comment	Long regular expression literal with no explanation	warning	Regex
VBC-098 z-index-war	Extremely high z-index value detected (z-index wars)	warning	Regex
VBC-102 multi-statement-one-liner	Multiple statements on a single line detected	warning	AST
VBC-104 inconsistent-import	Mixing 'require' and 'import' in the same file	warning	Regex
VBC-201 redundant-async	async function with no await	warning	AST
VBC-215 global-pollutant	Assignment to a window property	warning	Regex
VBC-501 boolean-naming-vibes	Boolean variable has no standard prefix	warning	Semantic
VBC-502 redundant-boolean-logic	Redundant boolean return detected	warning	Semantic
VBC-503 collection-naming-vibes	Array named is missing a plural 's' or a collection suffix (List, Array)	warning	Semantic
VBC-504 semantic-shadowing	Variable shadows a common library or system keyword	warning	Semantic
VBC-904 magic-string	Magic string literal passed to function	warning	Regex
VBC-905 debug-console-usage	Debug console method left in code	warning	Regex
VBC-906 fixme-technical-debt	FIXME describing a live defect	warning	Regex
VBC-907 anonymous-todo	Unattributed debt marker	warning	Regex
VBC-908 long-inline-style	Overly long inline style attribute	warning	Regex
VBC-909 empty-interface-ts	Empty interface detected	warning	AST
VBC-910 console-table-leaks	console.table() left in code	warning	Regex
VBC-911 meaningless-helper-names	Generic class name detected	warning	Regex
VBC-943 ignored-catch-variable	Catch clause with ignored error variable	warning	Regex
VBC-945 ai-generated-placeholder-comment	AI-generated placeholder comment	warning	Regex

Core

Rule	Catches	Severity	Analysis
VBC-001 hardcoded-secret	Hardcoded credential	error	Regex
VBC-002 committed-env	Environment file (.env) detected in staged files	error	Git
VBC-003 chmod-777	Insecure chmod 777 detected	error	Regex
VBC-005 use-var	Use of 'var' detected	error	Regex
VBC-013 empty-catch	Empty catch block detected	error	AST
VBC-017 fake-test-assertion	Trivially true test assertion	error	Regex
VBC-019 absolute-paths	Hardcoded absolute path detected	error	Regex
VBC-039 use-eval	Use of 'eval()' detected	error	Regex
VBC-070 use-innerhtml	Use of 'innerHTML' detected	error	Regex
VBC-086 target-blank-rel	target='_blank' without rel='noopener' detected	error	Regex
VBC-800 floating-promise	Unawaited Promise detected	error	Type checker
VBC-028 function-params-limit	Function takes parameters, over the limit of	warning	AST
VBC-032 css-important	Global '!important' detected in CSS	warning	Regex
VBC-057 use-any	Avoid using 'any' type	warning	Regex
VBC-059 file-length-limit	File is too long ( lines)	warning	AST
VBC-090 passive-aggressive-comments	Passive-aggressive or helpless comment detected	warning	Regex
VBC-150 production-todo	Tracked debt marker still in the code	warning	Regex

Correctness

Rule	Catches	Severity	Analysis
VBC-006-B merge-conflict-markers	Merge conflict marker	error	Regex
VBC-017-B focused-test-committed	Focused test	error	Regex
VBC-946 no-verification-after-operation	Destructive async operation with no verification of success	warning	Regex

Docs

Rule	Catches	Severity	Analysis
VBC-928 lorem-ipsum-docs	Placeholder text 'Lorem ipsum' detected	error	Regex
VBC-103 ascii-art-block	Block of decoration: three or more comment lines that are shape and nothing else	warning	Regex
VBC-324 condescending-language	Condescending or vague language detected	warning	Regex
VBC-334 ai-generated-fluff	Potential AI-generated fluff or overused cliché detected	warning	Regex
VBC-338 non-inclusive-terminology	Non-inclusive terminology	warning	Regex
VBC-340 gendered-address	Gendered language detected	warning	Regex
VBC-344 non-iso-date	Non-ISO 8601 date found	warning	Regex
VBC-347 passive-voice	Potential passive voice	warning	Regex
VBC-348 click-here-links	Vague link text found	warning	Regex
VBC-385 success-message-grammar	Improper success message grammar	warning	Regex
VBC-398 panic-punctuation	Excessive punctuation	warning	Regex
VBC-401 broken-links	Broken link detected	warning	Heuristic
VBC-414 please-in-cli	Avoid using 'Please' in technical instructions	warning	Regex
VBC-421 filler-words	Filler word detected	warning	Regex
VBC-917 shouting-documentation	Sustained all-caps text	warning	Regex
VBC-918 we-detected-tone	Avoid first-person collective ('We') in system messages	warning	Regex
VBC-920 relative-link-format	Relative local link missing './' prefix	warning	Regex
VBC-921 hardcoded-outdated-year	Copyright notice ends at a year that has passed:	warning	Heuristic
VBC-927 vague-button-label	Vague button label detected	warning	Regex
VBC-929 technical-jargon-slop	Avoid buzzword-heavy jargon	warning	Regex
VBC-933 coming-soon-docs	Placeholder documentation content	warning	Regex
VBC-934 personal-opinion-docs	Personal opinion language in documentation	warning	Regex
VBC-935 colloquial-language	Corporate colloquialism or buzzword in documentation	warning	Regex
VBC-936 outdated-experimental-tag	Experimental or alpha status tag	warning	Regex
VBC-948 em-dash-prose	Em dash	warning	Regex

Git

Rule	Catches	Severity	Analysis
VBC-006 committed-node-modules	node_modules directory detected in staged files	error	Git
VBC-025 missing-gitignore	Missing.gitignore file	error	Git
VBC-106 spaces-in-filenames	Filename contains spaces	error	Git
VBC-924 missing-readme-root	No README file found in project root	error	Git
VBC-014 committed-ide-settings	IDE settings file detected in staged files	warning	Git
VBC-045 missing-license	Missing LICENSE file	warning	Git
VBC-046 binary-files-in-git	Binary file committed to Git	warning	Git
VBC-922 too-many-staged-files	Staging files (limit:)	warning	Git
VBC-923 filename-too-long-hazard	Filename length exceeds characters	warning	Git
VBC-925 large-file-staged	File is over 1MB ( bytes)	warning	Git
VBC-926 short-commit-message-check	Commit message is likely too short	warning	Git
VBC-930 missing-contributing	Missing CONTRIBUTING.md file	warning	Git
VBC-931 missing-security-policy	Missing SECURITY.md file	warning	Git
VBC-932 missing-changelog	Missing CHANGELOG.md (or HISTORY.md) file	warning	Git

Security

Rule	Catches	Severity	Analysis
VBC-004 sql-injection-concatenation	SQL built by string concatenation	error	Regex
VBC-007 float-for-currency	Monetary value declared as a floating point literal	error	Regex
VBC-034 http-not-https	Insecure http:// link detected	error	Regex
VBC-902 document-write-slop	document.write() is prohibited	error	Regex
VBC-903 eval-like-timers	Passing strings to timers is eval-like and insecure	error	Regex
VBC-937 client-side-auth-check	Authentication token or role stored/read from browser storage	error	Regex
VBC-938 command-injection-risk	Potential command injection	error	Regex
VBC-939 unrestricted-file-upload	File upload handler may lack type/size restrictions	error	Regex
VBC-940 float-currency-arithmetic	Floating-point arithmetic on monetary value	error	Regex
VBC-944 xss-href-injection	Dynamic href constructed with string interpolation	error	Regex
VBC-947 prototype-pollution-risk	Merging untrusted request body directly	error	Regex
VBC-949 committed-private-key	A private key is committed here	error	Git
VBC-950 window-open-without-noopener	window.open() without 'noopener'	error	Regex
VBC-011 document-cookie-direct	Direct document.cookie write	warning	Regex
VBC-901 hardcoded-ip-v4	Hardcoded IP address	warning	Regex
VBC-941 missing-input-sanitization	Unsanitized HTML sink	warning	Regex
VBC-942 missing-access-control	Route handler may be missing authentication middleware	warning	Regex

Ux-dx

Rule	Catches	Severity	Analysis
VBC-010 div-onclick-non-semantic	Clickable <div> with onclick handler	error	Regex
VBC-023 notification-permission-eager	Notification.requestPermission() detected	error	Regex
VBC-024 autoplay-video-unmuted	Autoplay video without the muted attribute	error	Regex
VBC-033 placeholder-image-src	Placeholder image service URL detected	error	Regex
VBC-035 aria-label-icon-button	Icon-only button without aria-label	error	Regex
VBC-101 img-missing-alt	Image missing 'alt' attribute	error	Regex
VBC-113 disable-zoom	Disabling pinch-to-zoom is an accessibility violation	error	Regex
VBC-117 block-paste	Blocking paste in input fields harms both UX and security (password managers)	error	Regex
VBC-913 outline-none-hazard	Focus outline removed with nothing replacing it	error	Regex
VBC-020 justify-text-web	text-align:justify detected	warning	Regex
VBC-021 thin-font-weight	Thin font weight (100-199) detected	warning	Regex
VBC-022 custom-cursor-css	Custom cursor via CSS url()	warning	Regex
VBC-027 parallax-overuse	Parallax scrolling effect detected	warning	Regex
VBC-029 glassmorphism-overuse	backdrop-filter:blur() (glassmorphism)	warning	Regex
VBC-030 confetti-overuse	Confetti or particle animation library detected	warning	Regex
VBC-097 br-tags-for-layout	Multiple <br> tags used for layout	warning	Regex
VBC-112 scroll-hijacking	Potential scroll hijacking or forced smooth scrolling detected	warning	Regex
VBC-123 placeholder-as-label	Using placeholder as the only label is bad for accessibility	warning	Regex
VBC-131 video-background	Autoplay video backgrounds can be distracting and impact performance	warning	Regex
VBC-153 sudo-setup	Setup instructions requiring sudo detected	warning	Regex
VBC-158 fouc-prevention	Use of @import in CSS can cause Flash of Unstyled Content (FOUC)	warning	Regex
VBC-161 oversized-sticky-header	Oversized sticky header (>30vh) detected	warning	Regex
VBC-172 hamburger-on-desktop	Hamburger menu detected on desktop resolutions	warning	Regex
VBC-197 hardcoded-node-version	Hardcoded system version check detected	warning	Regex
VBC-206 pure-black-background	Pure black backgrounds (#000000) can cause eye strain	warning	Regex
VBC-208 hardcoded-colors	Hardcoded color value detected	warning	Regex
VBC-212 keyboard-focus-awareness	Suppressing focus outline without providing an alternative	warning	Regex
VBC-305 hardcoded-font-size	Hardcoded font size detected	warning	Regex
VBC-914 cursor-pointer-on-text	cursor: pointer applied to potentially non-interactive element	warning	Regex
VBC-915 user-select-none-slop	user-select: none detected	warning	Regex
VBC-916 vague-link-text-ux	Vague link text detected	warning	Regex