The rule catalogue
249 rules across four groups, each with an id that is stamped onto every finding it raises - 110 of them on the free scan.
| Group | Rules | What it reads |
|---|---|---|
| Live site | 62 | Transport, headers, cookies, CORS, public JavaScript, markup, exposed paths, DNS and email authentication, indexing, AI crawler policy, error pages. |
| Real browser | 52 | Requests, tokens, speed, privacy, reliability, WebSockets, accessibility, third parties. |
| Source code | 52 | Secrets, injection, authorization, tenancy, uploads, crypto, auth settings, dependencies across seven ecosystems. |
| Infrastructure | 38 | Docker, Compose, nginx, Kubernetes, Terraform, GitHub Actions. |
Rule ids are stable and readable: the group, the area, and what it found. `runtime.headers.csp-missing-or-unsafe` and `source.injection.sql-built-from-input` mean what they say. The full list, with a filter, is on the coverage page.
Rule versions
Each rule carries a version. When a rule’s logic changes materially the version moves, and findings record the version that raised them - so a change in results can always be traced to a change in a rule.
Questions
Can I turn a rule off?
Not globally today. Dismiss the findings you do not want with a reason; that is recorded and keeps the decision visible instead of hiding a whole class of problem silently.
Can I write my own rules?
Not yet. The closest thing available today is invariants, which are derived from your own code rather than written by hand.
Which languages do the source rules cover?
TypeScript and JavaScript, including the routing conventions of the frameworks around them. Everything that does not depend on parsing your language - live site, browser, lockfile advisories, Docker, Compose, nginx, Kubernetes, Terraform and Actions - works whatever you wrote the app in.
Something here wrong, missing or out of date? Tell us and we will fix the page.