{ "schemaVersion": 1, "generatedAt": "2026-08-16", "coreVersion": "0.4.2", "definitions": { "measuredRules": "Distinct rule ids with at least one measured language. This is the number to quote when asked \"how many rules does Iris Code measure\".", "analysers": "Language analysers in the engine. Vue and Svelte script blocks are analysed by the JavaScript and TypeScript analysers, so 8 analysers cover 10 supported languages.", "ruleLanguagePairs": "Rule id and language combinations measured independently. Higher than measuredRules because most rules are measured in several languages.", "configurableRuleIds": "Rule ids accepted by .irisconfig.json for severity overrides and iris-ignore suppressions. NOT the same set as measured rules, and the config schema is not a rule inventory." }, "totals": { "measuredRules": 37, "analysers": 8, "supportedLanguages": 10, "enforcement": 11, "advisory": 26, "ruleLanguagePairs": 168, "fixtureFiles": 347, "unmeasuredRules": 0 }, "perLanguage": { "typescript": 27, "javascript": 25, "go": 23, "python": 25, "ruby": 17, "csharp": 18, "java": 17, "rust": 16 }, "rules": [ { "ruleId": "hardcoded-secret", "tier": "enforcement", "gateRule": "secrets", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 3, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 3, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 4, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 4, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "eval-usage", "tier": "enforcement", "gateRule": "security-smells", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "sql-concatenation", "tier": "enforcement", "gateRule": "security-smells", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 0.6666666666666666, "recall": 1, "truePositives": 2, "falsePositives": 1, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "disabled-tls-verification", "tier": "enforcement", "gateRule": "security-smells", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "weak-hashing", "tier": "enforcement", "gateRule": "security-smells", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "duplicate-code", "tier": "enforcement", "gateRule": "duplicate-blocks", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "function-too-long", "tier": "enforcement", "gateRule": "per-file caps", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "file-too-long", "tier": "enforcement", "gateRule": "gateMaxFileLength", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "complexity", "tier": "enforcement", "gateRule": "gateMaxComplexity", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "todo", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "console-log", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 3, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 3, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 3, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "magic-number", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 3, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "hardcoded-localhost", "tier": "advisory", "gateRule": "security-smells", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "debug-flags-enabled", "tier": "advisory", "gateRule": "security-smells", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "insecure-random", "tier": "advisory", "gateRule": "security-smells", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "unsafe-regex", "tier": "advisory", "gateRule": "security-smells", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "open-redirect", "tier": "advisory", "gateRule": "security-smells", "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "any-usage", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "unused-var", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "unused-function", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "long-param-list", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "csharp": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "missing-return-types", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "bare-suppression", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "too-many-functions", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "too-many-imports", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "rust": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "no-exports", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "parse-error", "tier": "advisory", "gateRule": null, "results": { "typescript": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "javascript": { "precision": 0.5, "recall": 1, "truePositives": 1, "falsePositives": 1, "falseNegatives": 0 }, "go": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 }, "python": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "mass-assignment", "tier": "enforcement", "gateRule": "smells-per-file", "results": { "ruby": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "method-missing", "tier": "advisory", "gateRule": null, "results": { "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "god-class", "tier": "advisory", "gateRule": null, "results": { "ruby": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "large-class", "tier": "advisory", "gateRule": null, "results": { "csharp": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "catch-all-exception", "tier": "advisory", "gateRule": null, "results": { "csharp": { "precision": 1, "recall": 1, "truePositives": 3, "falsePositives": 0, "falseNegatives": 0 }, "java": { "precision": 1, "recall": 1, "truePositives": 3, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "async-void", "tier": "enforcement", "gateRule": null, "results": { "csharp": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "linq-abuse", "tier": "advisory", "gateRule": null, "results": { "csharp": { "precision": 1, "recall": 1, "truePositives": 1, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "process-execution", "tier": "advisory", "gateRule": null, "results": { "java": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "unwrap-abuse", "tier": "advisory", "gateRule": null, "results": { "rust": { "precision": 1, "recall": 1, "truePositives": 2, "falsePositives": 0, "falseNegatives": 0 } } }, { "ruleId": "explicit-panic", "tier": "advisory", "gateRule": null, "results": { "rust": { "precision": 1, "recall": 1, "truePositives": 3, "falsePositives": 0, "falseNegatives": 0 } } } ], "knownFalsePositives": [ { "ruleId": "sql-concatenation", "languages": [ "javascript" ], "summary": "2 correct findings, 1 false alarm, 0 misses in JavaScript: SQL keywords in ordinary prose joined by + can read as a query built by concatenation. The TypeScript implementation measures clean. Tightening the pattern would risk missing a real injection, so it is deliberately not traded against recall." }, { "ruleId": "parse-error", "languages": [ "javascript" ], "summary": "A regex literal such as /{/ can unbalance the delimiter scan that decides whether a file parses. Fixing it properly needs regex-literal-aware lexing rather than a heuristic, because this rule decides whether a file is analysed at all." } ], "corpus": { "published": false, "reason": "The corpus is 347 files of deliberately vulnerable code and credential-shaped strings. We publish the results and the method, not the fixtures." } }