Rule Catalogue
nfr-review ships 125 rules across 6 categories (security, reliability, performance, maintainability, observability, structure) and 3 analysis bands:
| Band | Name | How it works |
|---|---|---|
| 1 | Static | Pattern-matching on files, manifests, and ASTs — no external data needed |
| 2 | Composite | Combines multiple collectors or uses LLM analysis for deeper inference |
| 3 | Dynamic | Analyses runtime traces collected via OpenTelemetry |
Use the search box and filters below to find rules relevant to your stack. Click a column header to sort.
Showing 125 of 125 rules
| Rule ID | Sev | Band | Category | Description | Tags | Compliance |
|---|---|---|---|---|---|---|
actuator-exposure-risk | critical | 1 | security | Flags Spring Boot actuator endpoints exposed without access restriction. | javaspringactuator | ISO 25010:SecurityOWASP:A01 |
apim-auth-policy-missing | critical | 1 | security | Flags Azure API Management policies that lack authentication configuration. | apimazureauth | ISO 25010:SecurityOWASP:A01 |
dockerfile-secret-leakage | critical | 1 | security | Flags Dockerfiles that COPY/ADD secret files or expose secrets via ARG/ENV. | dockersecrets | ISO 25010:SecurityOWASP:A02 |
helm-secret-leakage | critical | 1 | security | Flags plaintext secrets in Helm values.yaml and rendered manifest templates. | helmsecrets | ISO 25010:SecurityOWASP:A02 |
istio-mtls-strict | critical | 1 | security | Flags Istio meshes where PeerAuthentication does not enforce STRICT mTLS. | istiomtlsservice-mesh | ISO 25010:SecurityOWASP:A02 |
pii-in-log-statements | critical | 2 | security | Flags log statements that emit PII fields (email, SSN, credit card) using regex and. | javapiiloggingllm | ISO 25010:SecurityOWASP:A01 |
terraform-iam-policy | critical | 1 | security | Flags IAM policies with wildcard (*) actions or resources in Terraform definitions. | terraformiamcloud | ISO 25010:SecurityOWASP:A01 |
apim-rate-limit-missing | high | 1 | security | Flags APIM policies without rate limiting in the inbound section. | apimazurerate-limiting | ISO 25010:SecurityOWASP:A04 |
architectural-drift-from-adr | high | 2 | maintainability | Detects divergence between architecture decision records and actual codebase. | adrarchitecturellm | ISO 25010:Maintainability |
bare-except-catch-all | high | 1 | reliability | Flags bare except blocks and overly broad exception catch-alls across Java, Python,. | error-handlingcross-language | ISO 25010:Reliability |
ci-security-scan-missing | high | 1 | security | Flags CI pipelines that lack a security scanning step (SAST, DAST, or dependency. | cisecurity-scanning | ISO 25010:SecurityOWASP:A06 |
ci-test-stage-missing | high | 1 | reliability | Flags CI pipelines that lack a test execution step. | citesting | ISO 25010:Reliability |
cmake-fetchcontent-pinning | high | 1 | security | Flags FetchContent dependencies that use unpinned branches instead of specific. | cmakecppsupply-chain | ISO 25010:Security |
cpp-exception-safety | high | 1 | reliability | Flags C++ code with exception-safety concerns including missing noexcept and unsafe. | cpperror-handling | ISO 25010:Reliability |
cpp-raw-memory | high | 1 | reliability | Flags raw new/delete and malloc/free usage that should use smart pointers or RAII. | cppmemory-safety | ISO 25010:Reliability |
csharp-async-void | high | 1 | reliability | Flags async void methods that should be async Task to avoid unobserved exceptions. | csharpasync | ISO 25010:Reliability |
csharp-blocking-async | high | 1 | performance | Flags synchronous blocking on async operations (.Result, .Wait()) that risk thread. | csharpasyncthreading | ISO 25010:Performance |
csharp-disposable-no-using | high | 1 | reliability | Flags IDisposable object creation not wrapped in a using statement, risking. | csharpresource-management | ISO 25010:Reliability |
dockerfile-base-pinning | high | 1 | security | Flags Docker base images using floating tags instead of pinned versions or digests. | dockersupply-chain | ISO 25010:SecurityOWASP:A08 |
dockerfile-k8s-user-conflict | high | 1 | security | Flags Kubernetes deployments that override a Dockerfile non-root USER with. | dockerkubernetessecurity | ISO 25010:SecurityOWASP:A05 |
dockerfile-user-directive | high | 1 | security | Flags Dockerfiles that lack a USER directive, causing containers to run as root. | dockersecurity | ISO 25010:SecurityOWASP:A05 |
dyn-adr-drift | high | 3 | reliability | Cross-references observed runtime service topology from traces against ADR-declared architecture, flagging undocumented coupling and dead architecture. | otelobservabilitydynamic-analysisadrtopologydrift | ISO 25010:Maintainability |
dyn-latency-p95 | high | 3 | performance | Computes p95 latency per HTTP route from server spans and compares against declared targets in nfr_targets.latency_p95_ms. | otelobservabilitydynamic-analysislatencyperformance | ISO 25010:Performance |
dyn-n-plus-1 | high | 3 | performance | Detects N+1 query patterns by counting child database spans per request span, flagging when identical DB calls exceed the threshold. | otelobservabilitydynamic-analysisn-plus-1database | ISO 25010:Performance |
exception-handling-antipattern | high | 1 | reliability | Flags catch blocks that swallow Exception/Throwable without rethrowing or logging. | javaerror-handling | ISO 25010:Reliability |
go-defer-in-loop | high | 1 | reliability | Flags defer statements inside for loops that accumulate deferred calls until. | goresource-management | ISO 25010:Reliability |
go-error-ignored | high | 1 | reliability | Flags Go error return values explicitly discarded via blank identifier assignment. | goerror-handling | ISO 25010:Reliability |
go-goroutine-leak | high | 1 | reliability | Flags goroutine launches without explicit lifecycle management (context, WaitGroup,. | goconcurrency | ISO 25010:Reliability |
go-http-no-timeout | high | 1 | reliability | Flags HTTP calls using http.DefaultClient or custom Client without Timeout. | gohttptimeout | ISO 25010:Reliability |
health-endpoint-missing | high | 1 | reliability | Flags Java services with no @RestController exposing a health-check endpoint. | javahealthobservability | ISO 25010:Reliability |
istio-circuit-breaker | high | 1 | reliability | Flags DestinationRules that lack outlierDetection for circuit breaking. | istioresilienceservice-mesh | ISO 25010:Reliability |
JDEP-CYCLE | high | 1 | maintainability | Flags Java package cycles detected by JDepend analysis. | javajdependarchitecture | ISO 25010:Maintainability |
network-policy-missing | high | 1 | security | Flags Kubernetes namespaces with no NetworkPolicy resources defined. | kubernetesnetwork | ISO 25010:SecurityOWASP:A05 |
nodejs-callback-error-ignored | high | 1 | reliability | Flags Node.js callbacks that receive an error parameter but never check or. | nodejserror-handling | ISO 25010:Reliability |
nodejs-floating-promise | high | 1 | reliability | Flags promise chains without .catch() that risk unhandled promise rejections. | nodejsasyncerror-handling | ISO 25010:Reliability |
nodejs-promise-no-catch | high | 1 | reliability | Flags .then() chains without .catch() error handling. | nodejsasyncerror-handling | ISO 25010:Reliability |
non-root-container-violation | high | 1 | security | Flags Kubernetes containers without securityContext.runAsNonRoot=true. | kubernetessecurity | ISO 25010:SecurityOWASP:A05 |
otel-exporter-config | high | 1 | reliability | Flags OTel Collector configs where no production exporter is configured. | otelobservability | ISO 25010:Reliability |
PATCH-ARCH-001 | high | 1 | reliability | Flags Deployment/StatefulSet resources running with a single replica, making. | kubernetespatchingavailability | ISO 25010:Reliability |
PATCH-ARCH-002 | high | 1 | reliability | Flags workloads missing preStop hooks or with insufficient. | kubernetespatchinggraceful-shutdown | ISO 25010:Reliability |
PATCH-ARCH-003 | high | 1 | reliability | Flags workloads with missing or unsafe update/rollout strategy (e.g. Recreate. | kubernetespatchingrollout | ISO 25010:Reliability |
PATCH-DEPS-003 | high | 1 | reliability | Detects cross-ring dependency direction violations in patch deployment ordering. | kubernetespatchingdependencies | ISO 25010:Reliability |
PATCH-HEALTH-001 | high | 1 | reliability | Checks readiness/liveness probes in the context of patching safety and rolling. | kubernetespatchingprobes | ISO 25010:Reliability |
PATCH-HEALTH-003 | high | 1 | reliability | Checks startup probe presence for patching safety with slow-starting containers. | kubernetespatchingprobes | ISO 25010:Reliability |
PATCH-TRAFFIC-001 | high | 1 | reliability | Detects progressive traffic shifting configuration (canary/blue-green) in service. | patchingtrafficservice-mesh | ISO 25010:Reliability |
probes-missing | high | 1 | reliability | Flags Kubernetes containers missing livenessProbe or readinessProbe. | kuberneteshealthprobes | ISO 25010:Reliability |
proto-field-numbering | high | 1 | maintainability | Flags protobuf messages where field number gaps exist without matching reserved. | grpcprotobufapi | ISO 25010:Maintainability |
python-async-fire-and-forget | high | 1 | reliability | Flags asyncio.create_task() calls where the returned Task reference is not stored. | pythonasyncconcurrency | ISO 25010:Reliability |
python-broad-except-silent | high | 1 | reliability | Flags catch blocks that silently swallow Exception/BaseException without logging or. | pythonerror-handling | ISO 25010:Reliability |
python-mutable-default | high | 1 | reliability | Flags function definitions using mutable default arguments (list, dict, set). | pythoncorrectness | ISO 25010:Reliability |
resilience-annotation-missing | high | 1 | reliability | Flags classes that import HTTP clients but lack resilience annotations (@Retry,. | javaresilience | ISO 25010:Reliability |
resource-limits-missing | high | 1 | reliability | Flags Kubernetes containers without resources.limits defined. | kubernetesresource-management | ISO 25010:Reliability |
spring-profile-misconfiguration | high | 1 | security | Flags production Spring profiles with debug logging, in-memory databases, or. | javaspringconfiguration | ISO 25010:Security |
terraform-provider-pinning | high | 1 | security | Flags Terraform providers that lack version constraints, risking uncontrolled. | terraformsupply-chain | ISO 25010:Security |
terraform-state-backend | high | 1 | security | Flags Terraform repos that store state locally instead of using a remote backend. | terraformstate | ISO 25010:Security |
thread-pool-misconfiguration | high | 1 | performance | Flags ThreadPoolExecutor instances without bounded queue or rejection policy. | javathreadingconcurrency | ISO 25010:Performance |
adr-gap | medium | 2 | maintainability | Flags implicit architectural decisions in code that lack a corresponding ADR. | adrarchitecture | ISO 25010:Maintainability |
apim-hardcoded-backend-url | medium | 1 | maintainability | Flags APIM policies using hardcoded backend URLs instead of named values. | apimazureconfig | ISO 25010:Maintainability |
cmake-build-config | medium | 1 | maintainability | Flags CMake projects with missing or misconfigured build type settings. | cmakecppbuild | ISO 25010:Maintainability |
correlation-id-missing | medium | 1 | reliability | Flags Java projects with no distributed tracing or correlation-ID library. | javaobservabilitytracing | ISO 25010:Reliability |
cpp-dormant-classes | medium | 2 | maintainability | Flags C++ classes with high method-to-call ratio suggesting dead or underused code. | cppdead-code | ISO 25010:Maintainability |
cpp-sanitizer-ci | medium | 1 | reliability | Flags C++ CI pipelines that lack address/thread/memory sanitizer builds. | cppcisanitizers | ISO 25010:Reliability |
dep-freshness | medium | 2 | security | Graduated staleness and dead library detection across Python, Node.js, Java, Go,. | dependenciessupply-chaincross-language | ISO 25010:SecurityOWASP:A06 |
dep-upgrade-path | medium | 2 | maintainability | N-1 ceiling detection with upgrade path recommendations via constraint solving. | dependenciessupply-chaincross-language | ISO 25010:Maintainability |
dockerfile-k8s-image-drift | medium | 1 | reliability | Flags mismatches between Dockerfile base image tags and Kubernetes container image. | dockerkubernetesconsistency | ISO 25010:Reliability |
dyn-correlation-propagation | medium | 3 | reliability | Verifies correlation-ID attribute consistency across all spans in a trace, flagging broken propagation from root to leaf spans. | otelobservabilitydynamic-analysiscorrelationtracing | ISO 25010:Reliability |
gatling-performance-thresholds | medium | 2 | performance | Evaluates Gatling load test results against configurable performance thresholds. | performance-testinggatling | ISO 25010:Performance |
go-dormant-classes | medium | 2 | maintainability | Flags Go types with high method count but low usage, suggesting dead or underused. | godead-code | ISO 25010:Maintainability |
go-package-subdivision | medium | 2 | maintainability | Flags Go projects with oversized or poorly organized packages, detecting god packages and mixed domain concerns within Go's flat package convention. | gopackage-structurearchitecturedomain | ISO 25010:Maintainability |
health-probe-separation | medium | 1 | reliability | Flags Kubernetes containers whose liveness and readiness probes are identically. | kuberneteshealthprobes | ISO 25010:Reliability |
helm-values-validation | medium | 1 | reliability | Flags Helm charts with missing resource limits, replica counts, or. | helmconfiguration | ISO 25010:Reliability |
istio-traffic-policy | medium | 1 | performance | Flags DestinationRules that lack trafficPolicy with connectionPool settings. | istiotrafficservice-mesh | ISO 25010:Performance |
jacoco-coverage-actual | medium | 2 | reliability | Evaluates actual line and branch coverage from JaCoCo XML reports against. | javatestingcoverage | ISO 25010:Reliability |
jacoco-threshold-missing | medium | 1 | reliability | Flags Java projects with no JaCoCo dependency or plugin configured. | javatestingcoverage | ISO 25010:Reliability |
java-dormant-classes | medium | 2 | maintainability | Flags Java classes with high method count but low usage, suggesting dead or. | javadead-code | ISO 25010:Maintainability |
java-package-subdivision | medium | 2 | maintainability | Flags Java projects with flat or insufficiently subdivided package hierarchies, detecting god packages, single-depth structures, and mixed domain concerns. | javapackage-structurearchitecturedomain | ISO 25010:Maintainability |
JDEP-DISTANCE | medium | 1 | maintainability | Flags Java packages with distance from main sequence (D) above 0.5. | javajdependarchitecture | ISO 25010:Maintainability |
JDEP-INSTABILITY | medium | 1 | performance | Flags Java packages with high instability (I > 0.8) and low abstractness. | javajdependarchitecture | ISO 25010:Performance |
logging-config-missing | medium | 1 | reliability | Flags Spring Boot apps without structured logging (JSON/logstash encoder). | javaspringloggingobservability | ISO 25010:Reliability |
logging-to-stdout | medium | 1 | reliability | Flags direct stdout/stderr writes that should use a structured logging framework. | loggingobservabilitycross-language | ISO 25010:Reliability |
nodejs-sync-fs-api | medium | 1 | performance | Flags synchronous fs and child_process calls that block the Node.js event loop. | nodejsperformanceasync | ISO 25010:Performance |
otel-fault-injection-tests | medium | 1 | reliability | Flags repos with resilience patterns but no fault-injection tests. | testingresiliencechaos | ISO 25010:Reliability |
otel-file-exporter | medium | 1 | reliability | Flags repos without an OTel file exporter configured for CI trace capture. | otelobservabilityci | ISO 25010:Reliability |
otel-integration-test-coverage | medium | 1 | reliability | Flags repos where API endpoints lack corresponding integration tests. | testingcoverageobservability | ISO 25010:Reliability |
otel-pipeline-completeness | medium | 1 | reliability | Flags OTel Collector configs where not all signal types (traces, metrics, logs). | otelobservability | ISO 25010:Reliability |
otel-resource-attrs | medium | 1 | reliability | Flags repos without required OTel resource attributes. | otelobservabilitytracing | ISO 25010:Reliability |
otel-sampling | medium | 1 | performance | Flags OTel Collector configs without sampling or rate-limiting processors. | otelobservabilityperformance | ISO 25010:Performance |
otel-test-agent | medium | 1 | reliability | Flags repos where test profiles don't attach the OTel agent. | otelobservabilitytesting | ISO 25010:Reliability |
otel-test-observability | medium | 1 | reliability | Flags test configs that don't produce OTel traces for dynamic analysis. | oteltestingobservability | ISO 25010:Reliability |
otel-w3c-propagation | medium | 1 | reliability | Flags repos without W3C trace-context propagation configured. | otelobservabilitytracing | ISO 25010:Reliability |
PATCH-ARCH-004 | medium | 1 | reliability | Flags multi-replica Deployments/StatefulSets with no matching PodDisruptionBudget. | kubernetespatchingpdb | ISO 25010:Reliability |
PATCH-DEPS-002 | medium | 1 | reliability | Detects shared-fate indicators across workloads (common volumes, configmaps,. | kubernetespatchingdependencies | ISO 25010:Reliability |
PATCH-HEALTH-002 | medium | 2 | reliability | Flags readiness probes that are likely trivial or overly fragile during patching. | kubernetespatchingprobes | ISO 25010:Reliability |
PATCH-HEALTH-004 | medium | 1 | reliability | Flags workloads with insufficient terminationGracePeriodSeconds for safe patching. | kubernetespatchinggraceful-shutdown | ISO 25010:Reliability |
PATCH-ROLL-001 | medium | 1 | maintainability | Checks for rollback/disaster-recovery documentation in the repository root. | patchingrollbackdocumentation | ISO 25010:Maintainability |
PATCH-ROLL-002 | medium | 1 | reliability | Checks that at least one CI pipeline has a rollback or revert stage. | patchingrollbackci | ISO 25010:Reliability |
PATCH-ROLL-003 | medium | 2 | maintainability | Detects migration tooling without corresponding rollback evidence. | patchingrollbackmigrations | ISO 25010:Maintainability |
PATCH-SCOPE-002 | medium | 2 | security | Detects accelerated cadence configuration for critical-security patches. | patchingsecurity | ISO 25010:Security |
PATCH-TELEM-001 | medium | 2 | reliability | Detects golden signal emission coverage (latency, traffic, errors, saturation) via. | patchingobservabilityotel | ISO 25010:Reliability |
PATCH-TELEM-003 | medium | 2 | reliability | Detects synthetic transaction configuration for proactive failure detection. | patchingobservability | ISO 25010:Reliability |
PATCH-TRAFFIC-002 | medium | 1 | reliability | Detects failover/DR documentation in the repository root. | patchingtrafficdocumentation | ISO 25010:Reliability |
PATCH-TRAFFIC-003 | medium | 1 | reliability | Detects connection draining configuration in service mesh for graceful traffic. | patchingtrafficservice-mesh | ISO 25010:Reliability |
proto-service-versioning | medium | 2 | maintainability | Flags gRPC services that lack version indicators in name or package. | grpcprotobufversioning | ISO 25010:Maintainability |
python-dormant-classes | medium | 2 | maintainability | Flags Python classes with high method count but low usage, suggesting dead or. | pythondead-code | ISO 25010:Maintainability |
python-package-subdivision | medium | 2 | maintainability | Flags Python projects with flat or insufficiently subdivided package structures, detecting god packages with excessive class counts, single-depth hierarchies, and mixed domain concerns within packages. | pythonpackage-structurearchitecturedomain | ISO 25010:Maintainability |
python-star-import | medium | 1 | maintainability | Flags wildcard imports (from x import *) that obscure dependencies and pollute. | pythonimports | ISO 25010:Maintainability |
skaffold-build-config | medium | 1 | maintainability | Flags Skaffold configs missing build sections or with weak tag policies. | skaffoldbuildkubernetes | ISO 25010:Maintainability |
structure-god-node | medium | 1 | structure | Flags entities whose total degree (in + out edges) exceeds 2x the median, indicating coupling hotspots that are difficult to change safely. | graphifycouplingarchitecture | ISO 25010:Maintainability |
structure-weak-boundary | medium | 1 | structure | Flags Leiden communities where cross-boundary edges exceed 40% of total edges, indicating leaky module boundaries. | graphifyboundariesarchitecture | ISO 25010:Maintainability |
adr-lifecycle-gap | low | 1 | maintainability | Flags ADRs that exist but lack lifecycle status tracking. | adrarchitecturedocumentation | ISO 25010:Maintainability |
cmake-minimum-version | low | 1 | maintainability | Flags CMake projects with outdated or missing cmake_minimum_required version. | cmakecpp | ISO 25010:Maintainability |
cpp-clang-format | low | 1 | maintainability | Flags C++ repos missing a .clang-format configuration file. | cppformattingtoolchain | ISO 25010:Maintainability |
cpp-clang-tidy | low | 1 | maintainability | Flags C++ repos missing a .clang-tidy configuration file. | cpplintingtoolchain | ISO 25010:Maintainability |
cpp-include-guards | low | 1 | maintainability | Flags C++ headers missing include guards or #pragma once. | cppheaders | ISO 25010:Maintainability |
csharp-configure-await | low | 1 | performance | Flags await expressions missing ConfigureAwait(false) in library code. | csharpasync | ISO 25010:Performance |
dockerfile-multistage | low | 1 | performance | Suggests multi-stage builds when a single-stage Dockerfile has build-time RUN. | dockerimage-size | ISO 25010:Performance |
helm-chart-metadata | low | 1 | maintainability | Flags Helm charts with incomplete Chart.yaml metadata (missing version,. | helmmetadata | ISO 25010:Maintainability |
PATCH-DEPS-001 | low | 2 | maintainability | Detects dependency declaration annotations on Kubernetes workloads for patch. | kubernetespatchingdependencies | ISO 25010:Maintainability |
PATCH-SCOPE-001 | low | 2 | reliability | Detects patch class soak configuration for graduated rollouts. | patchingrollout | ISO 25010:Reliability |
PATCH-TELEM-002 | low | 2 | reliability | Detects mandatory label presence (service.name, service.version) in OTel resource. | patchingobservabilityotel | ISO 25010:Reliability |
proto-method-comments | low | 2 | maintainability | Flags gRPC service methods that lack preceding comment documentation. | grpcprotobufdocumentation | ISO 25010:Maintainability |
sample-readme-exists | low | 1 | maintainability | Verifies a README file exists at the repository root. | documentationrepo-structure | ISO 25010:Maintainability |
structure-coupling-cluster | low | 1 | structure | Flags pairs of communities with disproportionate inter-community coupling edges (calls, imports), suggesting hidden dependencies between modules. | graphifycouplingarchitecture | ISO 25010:Maintainability |
dyn-call-sequence | info | 3 | reliability | Generates Mermaid sequence diagrams from OTel trace span trees to visualise runtime call flows. | otelobservabilitydynamic-analysistracing | ISO 25010:Reliability |
dyn-method-coverage | info | 3 | reliability | Reports which instrumented methods were exercised during a test run by aggregating code.namespace and code.function span attributes. | otelobservabilitydynamic-analysiscoverage | ISO 25010:Reliability |
Updating the catalogue
Section titled “Updating the catalogue”The data backing this page lives in site/src/data/rules.json. To regenerate it
after adding or modifying rules:
nfr-review list-rules --format json > site/src/data/rules.json