Backend TypeScript

SE04 · Logs should not receive secrets, credentials or whole request payloads

SE05 · Secrets have no hardcoded value and no insecure fallback in production code

SE03 · Security-sensitive identity comes from the verified principal, not the request payload

DB01/DB02 · The user confirms SQL built by interpolating values or identifiers into a raw query

IO02 · Parsed JSON and request payloads are validated, not cast to a type

IO09 · Persistence writes select permitted fields instead of storing the raw request payload

SE08 · No eval, Function constructor or shell command built from strings

SE07 · Outbound calls do not take their destination straight from the request

TS01/TS05 · tsconfig files may not turn strict type checking or unknown catch variables off

TS03 · tsconfig files should keep unchecked-index protection (noUncheckedIndexedAccess)

TS04 · tsconfig files should distinguish absent optional properties from explicit undefined

TS12 · No broad diagnostic suppression; a scoped one states its reason, owner and review date

TS05 · Catch variables keep unknown until narrowed

TS06 · No explicit any in authored production code

TS08 · Casts may not bridge incompatible types through any or unknown

TS09 · Non-null assertions should become narrowing or an invariant check

TS10 · Exported functions should declare their return contract

TS13 · Object literals should be checked against their type, not asserted

AS05 · Catch handlers implement a failure policy instead of swallowing errors or faking success

AS06 · An error translated in a catch keeps the original as its cause

IO05 · A truthy fallback should not collapse valid zero or false values

AS01 · A promise created by a statement has a rejection owner (await, return or handler)

AS02 · Async callbacks go only to consumers that handle the promise they return

AS04 · A try block awaits the promise whose rejection it means to catch

AS07 · Request and job handlers avoid synchronous filesystem, process and crypto calls

AS08 · Input-dependent fan-out has an enforced concurrency bound

AS09 · Outbound fetch calls carry a finite deadline (an abort signal)

AS11 · A timeout race does not leave the losing work running unowned

AS12 · Retries are bounded; a loop does not retry a failing operation forever

AS13 · A connection acquired and released in one block is released in finally

DB08 · Collection reads should state a result bound (Prisma findMany without take)

DB09 · Paginated reads should have a deterministic order

AR04 · Modules declared framework-independent import no transport, persistence or framework package

AR06 · Module imports and constructors do not start servers, connections, timers or jobs

AR07 · Pooled clients should be created at the composition root, not on every call

IO11 · Public error responses carry no stack trace or raw internal error

DB04 · Inside an interactive transaction, queries use the transaction-scoped client

DB05 · Database transactions should not wait on remote HTTP calls

DB11 · A job is acknowledged only after its required effects complete

DB12 · A Prisma schema change ends the turn with a matching migration

SE06 · Runtime configuration is read and validated centrally, not through process.env across the code

QA01 · Committed tests are never focused (only, fit, fdescribe)

QA03 · Assertions compare behavior, not a value with itself

QA07 · Production paths do not return a placeholder success marked as a stub

QA10 · A final message claiming passing checks needs a successful check after Claude's last edit

QA10 · Records, per session, Claude's edits and the checks (tests, types, lint, build) that succeeded after them

TS02 · Claude does not end a turn with compiler errors it introduced

TS02 · Records the work tree when a prompt starts, the baseline for new compiler errors