Verifying TypeScript changes

• Security scanning Injection, unsafe APIs and tainted data reaching a sink.
  codeql 27% · 25 of 93 repos

  runs via GitHub Action github/codeql-action/analyze

  exit codes, docs, alternatives, where it runs

  • Runs inci
  • Alternativessemgrep 9%
  • Seen inmicrosoft/vscode, microsoft/typescript, mui/material-ui, mermaid-js/mermaid, nestjs/nest, lobehub/lobe-chat
  • Docshttps://github.com/github/codeql
• Secret scanning Credentials and tokens committed to the repository.
  gitleaks 6% · 6 of 93 repos

  gitleaks git --config=.gitleaks.toml --baseline-path=.gitleaks-baseline.json --log-opts=$SCAN_REF --report-format=sarif --report-path=gitleaks.sarif .copy

  exit codes, docs, alternatives, where it runs

  • Commands seengitleaks git --config=.gitleaks.toml --baseline-path=.gitleaks-baseline.json --log-opts=$SCAN_REF --report-format=sarif --report-path=gitleaks.sarif .
gitleaks git --pre-commit --redact --staged --verbose
gitleaks version
  • Runs inpre-commit, ci
  • Seen incline/cline, diegosouzapw/OmniRoute, elie222/inbox-zero, maximhq/bifrost, snyk/cli, awslabs/aidlc-workflows
  • Docshttps://github.com/gitleaks/gitleaks
• Dependency audit Known-vulnerable or disallowed dependencies and licenses.
  npm-audit 6% · 6 of 93 repos

  npm audit signaturescopy

  exit codes, docs, alternatives, where it runs

  • Commands seennpm audit --audit-level=critical
npm audit --audit-level=high
npm audit --prefix runtime --omit=dev --audit-level=high
  • Runs inci, local
  • Alternativesdependency-review 5%
  • Seen innousresearch/hermes-agent, earendil-works/pi, diegosouzapw/OmniRoute, promptfoo/promptfoo, adonisjs/core, openai/codex-security
  • Docshttps://github.com/npm/cli

• Redact credentials at export boundariesAny path by which data can leave the trust boundary — tracing/OTLP export, debug logs, error messages, DB persistence, cached results, or...

  promptfoo/promptfoo Security TypeScript ai-agents 2026-10-20

  copy raw open
• Secure Boundary EnforcementStandard: at every trust boundary, enforce security invariants in a way that cannot be skipped by flags, parsing edge cases, alternate co...

  QwenLM/qwen-code Security TypeScript ai-agents 2026-07-29

  copy raw open
• Fail-Closed Security HandlingApply a single principle across auth, credentials, routing, sandboxing, and logging: **security must default to deny and must never proce...

  Cline/Cline Security TypeScript ai-agents 2026-10-24

  copy raw open
• Fail-Closed Security BoundariesAdopt a single secure-by-default rule-set: **authentication/authorization gates must fail closed**, **secret-bearing data must never be l...

  ClInE/cLiNe Security TypeScript ai-agents 2026-10-23

  copy raw open
• Fail-Closed Secrets SafetyUse fail-closed security boundaries and secret-safe observability by default. ### 1) Auth/CSRF: never store or act on unverified callback...

  CLINE/cline Security TypeScript ai-agents 2026-10-23

  copy raw open

97 more in Security — the playbook lists the top 12.

• Type checking Wrong types, unhandled null or None, call signatures broken across modules.
  tsc 92% · 86 of 93 repos

  tsc --noEmitcopy

  exit codes, docs, alternatives, where it runs

  • Commands seentsc --noEmit
tsc
tsc -b
  • Runs inpre-commit, ci, local
  • Seen infreeCodeCamp/freeCodeCamp, facebook/react, nousresearch/hermes-agent, microsoft/vscode, vercel/next.js, n8n-io/n8n
  • Docshttps://github.com/microsoft/TypeScript
• Unit and integration tests Behaviour regressions on the paths the tests exercise.
  vitest 73% · 68 of 93 repos

  vitest runcopy

  exit codes, docs, alternatives, where it runs

  • Commands seenvitest run
vitest
vitest run --coverage
  • Runs inci, local
  • Alternativesjest 28%, node-test 27%, mocha 8%
  • Seen infreeCodeCamp/freeCodeCamp, nousresearch/hermes-agent, microsoft/vscode, vercel/next.js, n8n-io/n8n, electron/electron
  • Docshttps://github.com/vitest-dev/vitest
• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.
  fast-check 3% · 3 of 93 repos

  exit codes, docs, alternatives, where it runs

  • Seen innuxt/nuxt, diegosouzapw/OmniRoute, langfuse/langfuse
  • Docshttps://github.com/dubzzz/fast-check

• Fail-safe Error HandlingUse fail-safe error handling everywhere in long-running / retrying flows: cleanup must be guaranteed, state/cursors must follow the inten...

  QwenLM/qwen-code Error Handling TypeScript ai-agents 2026-07-28

  copy raw open
• Explicit failure handlingEvery operation that can fail must have its failure path treated as deliberately as its success path. Three recurring gaps keep surfacing...

  cline/cline Error Handling TypeScript ai-agents 2026-10-24

  copy raw open
• Guard against nullAlways use optional chaining (`?.`) and nullish coalescing (`??`) operators when accessing potentially undefined or null properties. Thes...

  n8n-io/n8n Null Handling TypeScript ai-agents 2025-07-23

  copy raw open
• Handle async operation errorsAlways wrap asynchronous operations in try-catch-finally blocks to prevent unhandled promise rejections and ensure proper cleanup. When e...

  elie222/inbox-zero Error Handling TSX app-frameworks 2025-07-08

  copy raw open
• Explicit Error HandlingAdopt a standard that prevents misleading state, lost root causes, and unhandled async failures—especially in recovery/timeout paths. Rul...

  CLINE/CLINE Error Handling TypeScript ai-agents 2026-10-24

  copy raw open

317 more in API, Error Handling, Null Handling — the playbook lists the top 12.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.
  vitest 73% · 68 of 93 repos

  vitest runcopy

  exit codes, docs, alternatives, where it runs

  • Commands seenvitest run
vitest
vitest run --coverage
  • Runs inci, local
  • Alternativesjest 28%, node-test 27%, mocha 8%
  • Seen infreeCodeCamp/freeCodeCamp, nousresearch/hermes-agent, microsoft/vscode, vercel/next.js, n8n-io/n8n, electron/electron
  • Docshttps://github.com/vitest-dev/vitest
• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 49% · 46 of 93 repos

  analyze (language: 2)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (language: 2)
analyze (include: 2)
analyze (include: 1)
  • Runs inci
  • Seen inmicrosoft/vscode, langgenius/dify, mermaid-js/mermaid, earendil-works/pi, microsoft/playwright, vitejs/vite
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Axum Code Review: Interaction PatternsWhen implementing Axum-based applications, it is crucial to ensure that the interaction patterns between components are well-designed and...

  tokio-rs/axum Axum TypeScript app-frameworks

  copy raw open
• Consistent axum Usage in TypeScriptWhen implementing TypeScript code that uses the axum package, maintain consistent and idiomatic usage: always use lowercase 'axum', lever...

  tokio-rs/axum Axum TypeScript app-frameworks

  copy raw open
• Adhere to Fastify Coding ConventionsWhen implementing code that uses the Fastify package in TypeScript, ensure the following conventions are followed: avoid contractions, us...

  fastify/fastify Fastify TypeScript app-frameworks

  copy raw open
• Explicit Configuration Usage in FastifyWhen using the Fastify framework in TypeScript, ensure that all configuration options are explicitly declared and properly documented. Th...

  fastify/fastify Fastify TypeScript app-frameworks

  copy raw open
• Properly Handle Errors in Fastify ApplicationsWhen implementing error handling in Fastify applications, it is important to always throw instances of the Error class rather than primit...

  fastify/fastify Fastify TypeScript app-frameworks

  copy raw open

12 more in Fastify, NestJS, Spring, Axum, Celery, Temporal — the playbook lists the top 12.

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.
  fast-check 3% · 3 of 93 repos

  exit codes, docs, alternatives, where it runs

  • Seen innuxt/nuxt, diegosouzapw/OmniRoute, langfuse/langfuse
  • Docshttps://github.com/dubzzz/fast-check
• Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Mutation testing Tests that keep passing whatever the code does.
  stryker 3% · 3 of 93 repos

  stryker run --config-file stryker.disablebail.json --mutate $BATCH_MUTATEcopy

  exit codes, docs, alternatives, where it runs

  • Commands seenstryker run
stryker run --config-file stryker.disablebail.json --mutate $BATCH_MUTATE
stryker run --mutate $BATCH_MUTATE
  • Runs inci, local
  • Seen inn8n-io/n8n, diegosouzapw/OmniRoute, openai/codex-security
  • Docshttps://github.com/stryker-mutator/stryker-js
• Proofs and specifications Design-level bugs in protocols and algorithms, checked against a specification.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Spec-Aligned Parsing AlgorithmsWhen implementing parsing/transform/estimation algorithms for structured inputs, prioritize **format-correct tokenization**, **stateful c...

  ClInE/cLiNe Algorithms TypeScript ai-agents 2026-10-24

  copy raw open
• Deterministic Boundary ModelingWhen an algorithm’s correctness depends on what “exactly” was bound/parsed/scanned, never rely on lossy representations (timestamps, ambi...

  awslabs/aidlc-workflows Algorithms TypeScript orchestration 2026-08-04

  copy raw open
• Optimize critical loopsWhen implementing algorithms with nested loops or recursive operations, carefully analyze the computational complexity and optimize the c...

  microsoft/typescript Algorithms TypeScript runtimes 2025-02-05

  copy raw open
• Idempotent normalization pipelinesWhen code must normalize or classify structured data (messages, request bodies, model/provider selection, metrics), implement it as deter...

  diegosouzapw/OmniRoute Algorithms TypeScript llm-infra 2026-06-30

  copy raw open
• Prefer Grammar Over RegexUse the language parser/grammar (e.g., Langium/Jison) for diagram syntax instead of hand-rolled regex parsing. Regex is allowed only for ...

  mermaid-js/mermaid Algorithms TypeScript devtools 2026-03-17

  copy raw open

60 more in Algorithms — the playbook lists the top 12.

• Concurrency model checking Races and orderings that fail only under specific interleavings.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Undefined-behaviour detection Memory-safety and aliasing violations in unsafe code.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.
  fast-check 3% · 3 of 93 repos

  exit codes, docs, alternatives, where it runs

  • Seen innuxt/nuxt, diegosouzapw/OmniRoute, langfuse/langfuse
  • Docshttps://github.com/dubzzz/fast-check

• Race-safe concurrent stateCode that spans multiple await points or acts on shared/long-lived state (sessions, locks, lifecycle refs, worktrees, caches) must never ...

  can1357/oh-my-pi Concurrency TypeScript app-frameworks 2026-10-31

  copy raw open
• Revalidate state after awaitsMany races in this codebase come from code that reads shared mutable state (a session slot, a cached config, an in-flight "current" point...

  cline/cline Concurrency TypeScript ai-agents 2026-10-26

  copy raw open
• Async Claims And GenerationsWhen an async flow “resolves” shared state (answers a question, updates UI/model state, applies attach/detach replies, forwards terminal ...

  Cline/Cline Concurrency TypeScript ai-agents 2026-10-24

  copy raw open
• Propagate cancellation signalsMany concurrency bugs stemmed from abort/cancellation signals not being threaded through every async call, or from async operations that ...

  promptfoo/promptfoo Concurrency TypeScript ai-agents 2026-10-18

  copy raw open
• Async race ownership rulesWhen multiple async operations can overlap with replacement/teardown (UI unmount, session rebuild, polling vs actions, stop/dispose, in-f...

  CLINE/CLINE Concurrency TypeScript ai-agents 2026-10-24

  copy raw open

56 more in Concurrency — the playbook lists the top 12.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.
  vitest 73% · 68 of 93 repos

  vitest runcopy

  exit codes, docs, alternatives, where it runs

  • Commands seenvitest run
vitest
vitest run --coverage
  • Runs inci, local
  • Alternativesjest 28%, node-test 27%, mocha 8%
  • Seen infreeCodeCamp/freeCodeCamp, nousresearch/hermes-agent, microsoft/vscode, vercel/next.js, n8n-io/n8n, electron/electron
  • Docshttps://github.com/vitest-dev/vitest
• Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• HTTP header semanticsWhen implementing networking middleware (proxy, compress, CORS, etc.), handle HTTP headers according to their exact RFC semantics rather ...

  honojs/Hono Networking TypeScript cloud-infra 2026-05-21

  copy raw open
• Stateful Network DispatchNetwork code should behave deterministically across retries/reconnects by (a) confirming exactly when data is accepted/“dispatched”, (b) ...

  Cline/Cline Networking TypeScript ai-agents 2026-10-23

  copy raw open
• HTTP header spec complianceWhen reading, writing, or forwarding HTTP headers, follow RFC semantics instead of naive string checks. For multi-value headers (Accept-E...

  honojs/hono Networking TypeScript cloud-infra 2026-05-21

  copy raw open
• Reliable Network RetriesWhen implementing networked features (hub dispatch, reconnect/reattach, model/catalog fetches, and local-proxy HTTP), ensure retries are ...

  CLINE/cline Networking TypeScript ai-agents 2026-10-23

  copy raw open
• proxy configuration precedenceEnsure proxy configuration follows proper precedence hierarchy and handles different proxy types correctly. User-specified proxy settings...

  microsoft/playwright Networking TypeScript devtools 2025-07-29

  copy raw open

29 more in Networking, Axios — the playbook lists the top 12.

• End-to-end browser tests User flows broken across components, routing and the network.
  playwright 44% · 41 of 93 repos

  playwright testcopy

  exit codes, docs, alternatives, where it runs

  • Commands seenplaywright test
playwright test --ui
playwright test $(echo $FILES
  • Runs inci, local
  • Seen infreeCodeCamp/freeCodeCamp, facebook/react, nousresearch/hermes-agent, microsoft/vscode, vercel/next.js, n8n-io/n8n
  • Docshttps://github.com/microsoft/playwright
• Linting Bug-prone patterns, unused code and conventions the formatter does not cover.
  eslint 63% · 59 of 93 repos autofix

  eslint .copy

  exit codes, docs, alternatives, where it runs

  • Exit codes0 no errors
    1 linting errors found
    2 configuration problem or internal error
  • Commands seeneslint .
eslint
eslint . --fix
  • Runs inpre-commit, ci, local
  • Alternativesbiome 23%
  • Seen infreeCodeCamp/freeCodeCamp, facebook/react, nousresearch/hermes-agent, microsoft/vscode, vercel/next.js, n8n-io/n8n
  • Docshttps://eslint.org/docs/latest/use/command-line-interface#exit-codes

• Component naming consistencyEnsure component usage in templates matches registered components. Vue components must be referenced in templates by either their kebab-c...

  n8n-io/n8n Vue TypeScript ai-agents 2025-07-01

  copy raw open
• Stable, lifecycle-correct hooksEnsure React hooks and query integrations remain correct across renders, SSR/hydration, and subscriptions. Rules: 1) Keep QueryClient sta...

  tanstack/query React TypeScript app-frameworks 2026-04-10

  copy raw open
• Manage bindings and stateEnsure components explicitly initialize reactive state, manage input/keybinding lifecycle, and decide whether children should subscribe t...

  wavetermdev/waveterm React TSX devtools 2025-10-21

  copy raw open
• Memoize derived stateAvoid using `useState` + `useEffect` to compute values that can be derived directly from existing props, state, or query results. Filteri...

  Helicone/helicone React TSX app-frameworks 2025-07-09

  copy raw open
• Stable React RenderingWrite React components and tests so they don’t depend on React’s internal render/callback sequencing, and so Suspense boundaries capture ...

  tanstack/query React TSX app-frameworks 2025-10-14

  copy raw open

77 more in React, Next, Next.js, Vue, Angular — the playbook lists the top 12.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.
  vitest 73% · 68 of 93 repos

  vitest runcopy

  exit codes, docs, alternatives, where it runs

  • Commands seenvitest run
vitest
vitest run --coverage
  • Runs inci, local
  • Alternativesjest 28%, node-test 27%, mocha 8%
  • Seen infreeCodeCamp/freeCodeCamp, nousresearch/hermes-agent, microsoft/vscode, vercel/next.js, n8n-io/n8n, electron/electron
  • Docshttps://github.com/vitest-dev/vitest
• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 49% · 46 of 93 repos

  analyze (language: 2)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (language: 2)
analyze (include: 2)
analyze (include: 1)
  • Runs inci
  • Seen inmicrosoft/vscode, langgenius/dify, mermaid-js/mermaid, earendil-works/pi, microsoft/playwright, vitejs/vite
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Complete cache invalidation keysA cache is only as correct as its invalidation logic, and the recurring failure mode across these reviews is a cache key or dirtiness che...

  can1357/oh-my-pi Caching TypeScript app-frameworks 2026-10-31

  copy raw open
• Database type consistencyEnsure database-specific types, imports, and serialization are used consistently throughout the codebase. This prevents runtime errors, i...

  drizzle-team/drizzle-orm Database TypeScript data-systems 2024-12-16

  copy raw open
• type-safe database operationsImplement proper type conversion and validation when working with different database systems to prevent runtime errors and data corruptio...

  rocicorp/mono Database TypeScript data-systems 2025-07-09

  copy raw open
• Cache correctness & retriesAdopt a single standard for all caches (data, discovery, warm-ups, and load-result caches): 1) Key by the real identity (include all depe...

  CLINE/CLINE Caching TypeScript ai-agents 2026-10-19

  copy raw open
• Dependency-Aware CachingCaching is safe only when you (1) key by the full dependency set, (2) gate reads by a revision/stale check, (3) invalidate only the corre...

  ClInE/cLiNe Caching TypeScript ai-agents 2026-10-19

  copy raw open

45 more in Database, Migrations, Caching — the playbook lists the top 12.

No tool-based check applies. The review prompts below are the verification.

• Bound Hot-Path WorkWhen code runs on hot UI paths (keystrokes, popup open, navigation) or retains state for long-lived sessions, enforce **bounded work** an...

  microsoft/VSCode Performance Optimization TypeScript devtools 2026-09-10

  copy raw open
• Bound Hot-Loop WorkDefault to explicit resource budgets and ensure they’re actually enforced. Apply these rules in code review: 1) **Bound inputs and remote...

  QwenLM/qwen-code Performance Optimization TypeScript ai-agents 2026-07-28

  copy raw open
• Benchmark-driven hot-path optimizationFor code that executes on every request or in other hot paths (router matching, context/response creation, param decoding, JSX stringific...

  honojs/Hono Performance Optimization TypeScript app-frameworks 2026-02-19

  copy raw open
• Benchmark hot-path optimizationsFor code on frequently executed paths (request handling, routing, serialization, middleware), base optimization decisions on actual bench...

  HONOJS/HONO Performance Optimization TypeScript app-frameworks 2025-03-18

  copy raw open
• Hot Path EfficiencyDefault to “do the minimum possible work per hot-path update.” Apply these checks: 1) Early-exit before side effects - If a piece of asyn...

  QwenLM/qwen-code Performance Optimization TSX ai-agents 2026-07-28

  copy raw open

65 more in Performance Optimization — the playbook lists the top 12.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.
  vitest 73% · 68 of 93 repos

  vitest runcopy

  exit codes, docs, alternatives, where it runs

  • Commands seenvitest run
vitest
vitest run --coverage
  • Runs inci, local
  • Alternativesjest 28%, node-test 27%, mocha 8%
  • Seen infreeCodeCamp/freeCodeCamp, nousresearch/hermes-agent, microsoft/vscode, vercel/next.js, n8n-io/n8n, electron/electron
  • Docshttps://github.com/vitest-dev/vitest

• Model specification accuracyEnsure AI model configurations accurately reflect official specifications and avoid hardcoded assumptions. Model parameters, token limits...

  lobehub/lobe-chat AI TypeScript ai-agents 2025-09-03

  copy raw open
• AI model integration patternsWhen integrating with AI models and LLMs, structure your code to properly handle model responses, separate concerns between layers, and i...

  google-gemini/gemini-cli AI TypeScript ai-agents 2025-07-18

  copy raw open
• Configurable model selectionAvoid hard-coding model names and provider-specific configurations throughout the codebase. Instead, implement flexible model selection p...

  browserbase/stagehand AI TypeScript ai-agents 2025-04-24

  copy raw open
• Model Limits CorrectnessWhen integrating LLM providers, treat model capabilities and token limits as *schema-variant inputs* and enforce conservative, well-teste...

  CLINE/cline AI TypeScript ai-agents 2026-10-18

  copy raw open
• Evidence-complete LLM gradingAutomated grading and evaluation logic for LLM outputs (redteam graders, eval scoring, result interchange) must base pass/fail decisions ...

  promptfoo/promptfoo AI TypeScript ai-agents 2026-10-11

  copy raw open

23 more in AI, Pytorch — the playbook lists the top 12.

No tool-based check applies. The review prompts below are the verification.

• Telemetry correctness rulesAdopt a single standard for all observability code: 1) Be policy-compliant and opt-out safe - Prefer typed helper functions for telemetry...

  ClInE/cLiNe Observability TypeScript ai-agents 2026-10-21

  copy raw open
• Telemetry correctness contractMake observability code behave like a correctness-critical contract—not “best effort.” Apply these rules: - **Use typed, policy-compliant...

  Cline/Cline Observability TypeScript ai-agents 2026-10-21

  copy raw open
• Telemetry Semantics ContractAll observability/telemetry code must follow a consistent “semantics contract”: events must be emitted exactly once, with correct timing/...

  CLINE/CLINE Observability TypeScript ai-agents 2026-10-21

  copy raw open
• Telemetry event integrityTreat telemetry as data that other code and dashboards depend on, not as scattered debug prints. Register every new event in the central ...

  cline/cline Observability TypeScript ai-agents 2026-10-16

  copy raw open
• Telemetry correctness and timingTelemetry must be (a) policy-compliant, (b) causally correct in time, and (c) semantically accurate in meaning—so monitoring never turns ...

  cline/CLINE Observability TypeScript ai-agents 2026-10-16

  copy raw open

26 more in Logging, Observability — the playbook lists the top 12.

• CI workflow linting Broken GitHub Actions syntax, script injection, over-broad token permissions.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• File hygiene Invalid JSON, YAML or TOML, merge markers, trailing whitespace, oversized files.
  pre-commit-hooks 4% · 4 of 93 repos autofix

  runs via pre-commit hook end-of-file-fixer

  exit codes, docs, alternatives, where it runs

  • Commands seenpre-commit hook end-of-file-fixer
pre-commit hook check-merge-conflict
pre-commit hook trailing-whitespace
  • Runs inpre-commit
  • Seen ingetsentry/sentry, apache/airflow, maximhq/bifrost, Helicone/helicone
  • Docshttps://github.com/pre-commit/pre-commit-hooks

• Configuration validation messagesEnsure configuration validation provides clear, actionable error messages that guide users toward correct configuration. Validation shoul...

  cloudflare/workers-sdk Configurations TypeScript cloud-infra 2025-08-27

  copy raw open
• configuration resolution patternsWhen defining configuration schemas, use consistent patterns for safe property access, async resolution, and default value handling. Alwa...

  nuxt/nuxt Configurations TypeScript app-frameworks 2025-07-02

  copy raw open
• Validate and scope configuration changesConfiguration values from settings, CLI flags, YAML, or environment variables are untrusted input and must be validated/normalized at the...

  can1357/oh-my-pi Configurations TypeScript cloud-infra 2026-10-31

  copy raw open
• Explicit default configurationsAlways provide explicit default values for configuration options to improve code readability and maintainability. Use helper methods cons...

  nestjs/nest Configurations TypeScript app-frameworks 2023-12-04

  copy raw open
• Unify config resolutionWhen the same setting (a base URL, a git remote, a host name, an API-key check, a bind-fallback flag) is resolved in more than one place,...

  cline/cline Configurations TypeScript ai-agents 2026-10-24

  copy raw open

114 more in CI/CD, Configurations — the playbook lists the top 12.

• Dependency audit Known-vulnerable or disallowed dependencies and licenses.
  npm-audit 6% · 6 of 93 repos

  npm audit signaturescopy

  exit codes, docs, alternatives, where it runs

  • Commands seennpm audit --audit-level=critical
npm audit --audit-level=high
npm audit --prefix runtime --omit=dev --audit-level=high
  • Runs inci, local
  • Alternativesdependency-review 5%
  • Seen innousresearch/hermes-agent, earendil-works/pi, diegosouzapw/OmniRoute, promptfoo/promptfoo, adonisjs/core, openai/codex-security
  • Docshttps://github.com/npm/cli
• Lockfile consistency A lockfile that no longer matches its manifest.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 49% · 46 of 93 repos

  analyze (language: 2)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (language: 2)
analyze (include: 2)
analyze (include: 1)
  • Runs inci
  • Seen inmicrosoft/vscode, langgenius/dify, mermaid-js/mermaid, earendil-works/pi, microsoft/playwright, vitejs/vite
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Mutation testing Tests that keep passing whatever the code does.
  stryker 3% · 3 of 93 repos

  stryker run --config-file stryker.disablebail.json --mutate $BATCH_MUTATEcopy

  exit codes, docs, alternatives, where it runs

  • Commands seenstryker run
stryker run --config-file stryker.disablebail.json --mutate $BATCH_MUTATE
stryker run --mutate $BATCH_MUTATE
  • Runs inci, local
  • Seen inn8n-io/n8n, diegosouzapw/OmniRoute, openai/codex-security
  • Docshttps://github.com/stryker-mutator/stryker-js
• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 49% · 46 of 93 repos

  analyze (language: 2)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (language: 2)
analyze (include: 2)
analyze (include: 1)
  • Runs inci
  • Seen inmicrosoft/vscode, langgenius/dify, mermaid-js/mermaid, earendil-works/pi, microsoft/playwright, vitejs/vite
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Test critical branchesWhen code adds/changes behavior (UI logic, URL rewriting, state-merge rules, keyboard/pointer guards, or error-recovery flows), ensure te...

  QwenLM/qwen-code Testing TSX ai-agents 2026-07-29

  copy raw open
• Assert behavior, not wiringA test must fail when the behavior it claims to cover regresses, and pass only because that behavior holds — not because it restates conf...

  can1357/oh-my-pi Testing TypeScript app-frameworks 2026-10-31

  copy raw open
• Meaningful, deterministic testsTests should verify real, intended behavior and must fail when that behavior is broken. Before adding a test, confirm it actually exercis...

  honojs/hono Testing TypeScript app-frameworks 2026-05-26

  copy raw open
• Write focused, deterministic testsKeep the test suite lean and trustworthy by following these rules: 1. **Avoid redundancy.** Before adding a test, check whether the behav...

  HONOJS/HONO Testing TypeScript app-frameworks 2026-05-26

  copy raw open
• Deterministic Test AssertionsFor tests, prefer deterministic, intention-revealing assertions and keep runtime tests and type-only tests strictly separated. Apply: 1) ...

  tanstack/query Testing TSX app-frameworks 2025-04-13

  copy raw open

73 more in Testing — the playbook lists the top 12.

• Docs build Broken cross-references, links and markup in documentation.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Spelling Typos in identifiers, comments and docs.
  codespell 3% · 3 of 93 repos

  runs via GitHub Action codespell-project/actions-codespell

  exit codes, docs, alternatives, where it runs

  • Commands seenuses codespell-project/actions-codespell
pre-commit hook codespell
  • Runs inpre-commit, ci
  • Seen inapache/airflow, openai/codex, langfuse/langfuse
  • Docshttps://github.com/codespell-project/codespell

• Internationalize all textAll user-facing text must be wrapped with translation functions instead of using hardcoded English strings. This includes regular UI text...

  RooCodeInc/Roo-Code Documentation TSX ai-agents 2025-07-22

  copy raw open
• Keep Docs AccurateAdopt a rule that comments/JSDoc/API docs must be both *correct* and *useful at the point of use*—never misleading, stale, or attached to...

  QwenLM/qwen-code Documentation TypeScript ai-agents 2026-07-29

  copy raw open
• Sync documentation with codeAlways ensure documentation and comments accurately reflect the actual code implementation. When modifying code, update all related docum...

  langfuse/langfuse Documentation TypeScript observability 2025-07-09

  copy raw open
• Document function behavior completelyFunctions should be documented with comprehensive JSDoc comments that cover: 1. Purpose and behavior description 2. All parameters with t...

  microsoft/typescript Documentation TypeScript runtimes 2025-07-23

  copy raw open
• Document i18n string usageAll user-facing strings must be documented with translation function usage to ensure proper internationalization support. This includes e...

  RooCodeInc/Roo-Code Documentation TypeScript ai-agents 2025-07-21

  copy raw open

37 more in Documentation — the playbook lists the top 12.