[
  {
    "id": "SB-AI-001",
    "name": "Debug print statement in non-JS language",
    "pattern": "(?:^|\\s)(?:pprint\\s*\\(|dbg!\\s*\\(|fprintf\\s*\\(stderr|System\\.err\\.println|NSLog\\s*\\(|print_r\\s*\\(|var_dump\\s*\\(|dd\\s*\\(|dump\\s*\\(|ray\\s*\\()",
    "patternFlags": "gim",
    "severity": "low",
    "fileExtensions": [
      ".py",
      ".go",
      ".rs",
      ".c",
      ".cpp",
      ".h",
      ".hpp",
      ".java",
      ".rb",
      ".php",
      ".sh",
      ".bash",
      ".zsh",
      ".swift",
      ".kt",
      ".dart",
      ".lua",
      ".pl",
      ".r",
      ".jl",
      ".cs",
      ".scala",
      ".groovy",
      ".clj",
      ".ex",
      ".erl",
      ".fs",
      ".hs",
      ".ml",
      ".nim",
      ".pas",
      ".tcl",
      ".v",
      ".zig",
      ".zs",
      ".zscript"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "examples/",
      "demo/",
      "benchmarks/",
      "scripts/",
      "**/setup-zorin*",
      "**/start-dashboard*",
      "**/simplebeacon.sh",
      "**/scan-website*",
      "**/reference-runner*"
    ],
    "description": "Debug print statement found — likely left behind during development. Remove or replace with a proper logger.",
    "recommendation": "Remove the debug print or replace it with a structured logger (e.g. Python logging, Go log/slog, Rust tracing, Java SLF4J).",
    "enabled": true
  },
  {
    "id": "SB-AI-002",
    "name": "TODO/FIXME/HACK marker left in code",
    "pattern": "(?:\\/\\/\\s*(?:TODO|FIXME|HACK|XXX|BUG|REVIEW|OPTIMIZE|REFACTOR)\\b|\\/\\*\\s*(?:TODO|FIXME|HACK|XXX|BUG|REVIEW|OPTIMIZE|REFACTOR)\\b|#\\s*(?:TODO|FIXME|HACK|XXX|BUG|REVIEW|OPTIMIZE|REFACTOR)\\b|<!--\\s*(?:TODO|FIXME|HACK|XXX|BUG|REVIEW|OPTIMIZE|REFACTOR)\\b)",
    "patternFlags": "gi",
    "severity": "low",
    "fileExtensions": [
      ".py",
      ".go",
      ".rs",
      ".c",
      ".cpp",
      ".h",
      ".hpp",
      ".java",
      ".rb",
      ".php",
      ".sh",
      ".bash",
      ".js",
      ".ts",
      ".jsx",
      ".tsx",
      ".mjs",
      ".cjs",
      ".vue",
      ".svelte",
      ".swift",
      ".kt",
      ".dart",
      ".lua",
      ".pl",
      ".r",
      ".jl",
      ".cs",
      ".scala",
      ".groovy",
      ".clj",
      ".ex",
      ".erl",
      ".fs",
      ".hs",
      ".ml",
      ".nim",
      ".pas",
      ".tcl",
      ".v",
      ".zig",
      ".zs",
      ".zscript",
      ".sql",
      ".graphql",
      ".html",
      ".css",
      ".scss"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "demo/",
      "examples/",
      "benchmarks/",
      "CHANGELOG",
      "README",
      "ROADMAP",
      "**/*.test.*",
      "**/*.spec.*",
      "**/SimpleBeaconPoC.mjs",
      "**/demo/",
      "**/reference-runner-rust/",
      "**/ChatbotView.tsx",
      "**/ast-remediator.js",
      "**/scan-wasm-bridge.test.js",
      "**/patch-strategies.test.cjs",
      "**/token-store-adapter.cjs",
      "**/shard-admin-routes.cjs",
      "**/optimization-api.cjs",
      "**/trust-api.cjs",
      "**/ratchet/index.cjs",
      "**/reference-runner-rust/main.rs"
    ],
    "description": "TODO/FIXME/HACK marker found — incomplete work that an AI agent left behind. Resolve or track in an issue tracker.",
    "recommendation": "Complete the task, remove the marker, or create a tracked issue with context.",
    "enabled": true
  },
  {
    "id": "SB-AI-003",
    "name": "Disabled SSL/TLS verification",
    "pattern": "(?:verify\\s*=\\s*False|verify_ssl\\s*=\\s*False|ssl_verify\\s*=\\s*False|InsecureSkipVerify|rejectUnauthorized\\s*:\\s*false|check\\s*=\\s*False|validate\\s*=\\s*False|SSL_VERIFY_PEER\\s*=\\s*0|CURLOPT_SSL_VERIFYPEER\\s*=\\s*0|ssl_verify_peer\\s*=\\s*false|ssl_verify_host\\s*=\\s*false)",
    "patternFlags": "gi",
    "severity": "medium",
    "fileExtensions": [
      ".py",
      ".go",
      ".rs",
      ".c",
      ".cpp",
      ".h",
      ".java",
      ".rb",
      ".php",
      ".js",
      ".ts",
      ".jsx",
      ".tsx",
      ".mjs",
      ".cjs",
      ".yaml",
      ".yml",
      ".json",
      ".toml",
      ".ini",
      ".cfg",
      ".conf",
      ".env",
      ".sh",
      ".bash"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "examples/"
    ],
    "description": "SSL/TLS verification is disabled — this allows man-in-the-middle attacks. Never disable certificate verification in production code.",
    "recommendation": "Enable SSL/TLS verification. For local development, use a self-signed CA certificate instead of disabling verification.",
    "enabled": true
  },
  {
    "id": "SB-AI-004",
    "name": "Empty exception handler swallows errors",
    "pattern": "(?:except\\s*:|except\\s+Exception\\s*:|except\\s+BaseException\\s*:)\\s*(?:pass|continue|#|\\n\\s*pass)|catch\\s*\\((?![_])[^)]*\\)\\s*\\{\\s*\\}|catch\\s*\\((?![_])[^)]*\\)\\s*\\{\\s*/\\*(?!\\s*ignore)[^*]*\\*/\\s*\\}|catch\\s*\\((?![_])[^)]*\\)\\s*\\{\\s*//[^\\n}]*\\n\\s*\\}|catch\\s*_\\s*=>\\s*\\{\\s*\\}",
    "patternFlags": "gi",
    "severity": "medium",
    "fileExtensions": [
      ".py",
      ".js",
      ".ts",
      ".jsx",
      ".tsx",
      ".mjs",
      ".cjs",
      ".java",
      ".kt",
      ".scala",
      ".groovy",
      ".cs",
      ".cpp",
      ".c",
      ".go",
      ".rs",
      ".swift",
      ".dart",
      ".rb",
      ".php"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "**/patch-strategies.cjs",
      "**/referral-capture.js",
      "**/ErrorBoundary.tsx",
      "**/spa_fallback_server.py"
    ],
    "description": "Empty exception handler silently swallows errors — this hides bugs and makes debugging impossible. At minimum, log the error.",
    "recommendation": "Log the error, re-raise it, or handle it explicitly. Never silently swallow exceptions.",
    "enabled": true
  },
  {
    "id": "SB-AI-005",
    "name": "Eval/exec/Function constructor usage",
    "pattern": "(?:^|\\s)(?:eval\\s*\\(|new\\s+Function\\s*\\(|compile\\s*\\(|__import__\\s*\\(|importlib\\.import_module\\s*\\()",
    "patternFlags": "gi",
    "severity": "medium",
    "fileExtensions": [
      ".py",
      ".js",
      ".ts",
      ".jsx",
      ".tsx",
      ".mjs",
      ".cjs",
      ".java",
      ".kt",
      ".scala",
      ".groovy",
      ".rb",
      ".php",
      ".lua",
      ".pl",
      ".r"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "examples/",
      "sandbox/",
      "repl/",
      "**/alert-templates*",
      "**/redis-rate-limit-store*"
    ],
    "description": "eval/exec/Function constructor allows arbitrary code execution — this is a security vulnerability and a sign of AI-generated code taking shortcuts.",
    "recommendation": "Replace with a safe alternative: use ast.literal_eval for Python, JSON.parse for JS, or a proper parser/interpreter.",
    "enabled": true
  },
  {
    "id": "SB-AI-006",
    "name": "Hardcoded credential assignment",
    "pattern": "(?:password|passwd|pwd|api_key|apikey|api-key|secret|secret_key|access_key|accesskey|private_key|client_secret|auth_token|bearer_token|access_token)\\s*[:=]\\s*[\"'][^\"']{4,}[\"']",
    "patternFlags": "gi",
    "severity": "medium",
    "fileExtensions": [
      ".py",
      ".go",
      ".rs",
      ".c",
      ".cpp",
      ".h",
      ".java",
      ".rb",
      ".php",
      ".js",
      ".ts",
      ".jsx",
      ".tsx",
      ".mjs",
      ".cjs",
      ".yaml",
      ".yml",
      ".json",
      ".toml",
      ".ini",
      ".cfg",
      ".conf",
      ".env",
      ".sh",
      ".bash",
      ".swift",
      ".kt",
      ".dart",
      ".lua",
      ".pl",
      ".r",
      ".cs",
      ".scala",
      ".groovy",
      ".clj",
      ".ex",
      ".erl",
      ".fs",
      ".hs"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "examples/",
      "mock/",
      "stubs/",
      ".env.example",
      ".env.sample",
      ".env.template",
      "config.example",
      "**/*.test.cjs",
      "**/*.test.js",
      "**/*.test.ts",
      "**/eslint-*",
      "**/send-test-*",
      "**/generate-license-token*",
      "**/flush_email_queue*",
      "**/verify_crosslang*"
    ],
    "description": "Hardcoded credential found in source code — this is a security vulnerability. Use environment variables or a secrets manager.",
    "recommendation": "Move the credential to an environment variable or secrets manager. Rotate the exposed credential immediately.",
    "enabled": true
  },
  {
    "id": "SB-AI-007",
    "name": "Debug mode enabled in config",
    "pattern": "(?:^|\\n|\\s)(?:DEBUG\\s*=\\s*(?:True|true|TRUE|1|yes|on)|debug\\s*=\\s*(?:True|true|TRUE|1|yes|on)|debug_mode\\s*[:=]\\s*(?:True|true|TRUE|1|yes|on)|NODE_ENV\\s*=\\s*development|ENV\\s*=\\s*development|APP_ENV\\s*[:=]\\s*(?:dev|development|local))",
    "patternFlags": "gim",
    "severity": "medium",
    "fileExtensions": [
      ".py",
      ".js",
      ".ts",
      ".jsx",
      ".tsx",
      ".mjs",
      ".cjs",
      ".yaml",
      ".yml",
      ".json",
      ".toml",
      ".ini",
      ".cfg",
      ".conf",
      ".env",
      ".rb",
      ".php",
      ".go",
      ".rs",
      ".java",
      ".kt",
      ".swift",
      ".dart",
      ".cs",
      ".scala",
      ".groovy"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "examples/",
      ".env.example",
      ".env.sample",
      ".env.template",
      ".env.development",
      ".env.local",
      "config.example",
      "**/docker-compose.dev*",
      "**/docker-compose.local*",
      "**/secret-config*"
    ],
    "description": "Debug mode is enabled — this may expose sensitive information, disable caching, or bypass security checks in production.",
    "recommendation": "Disable debug mode for production. Use environment-specific configuration files.",
    "enabled": true
  },
  {
    "id": "SB-AI-008",
    "name": "Broad exception catch may hide bugs",
    "pattern": "(?:except\\s*:|except\\s+Exception\\s*:|except\\s+BaseException\\s*:|except\\s+Throwable\\s*:|catch\\s*\\(\\s*(?:Exception|Throwable|Error|Object)\\s+\\w+\\s*\\)|catch\\s*\\(\\s*(?:Exception|Throwable|Error)\\s*\\)|catch\\s+\\(\\s*\\)|catch\\s+\\{)",
    "patternFlags": "gi",
    "severity": "low",
    "fileExtensions": [
      ".py",
      ".java",
      ".kt",
      ".scala",
      ".groovy",
      ".cs",
      ".cpp",
      ".c",
      ".go",
      ".rs",
      ".swift",
      ".dart",
      ".rb",
      ".php"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "examples/",
      "middleware/",
      "handler/",
      "error/",
      "**/spa_fallback_server*"
    ],
    "description": "Broad exception catch — catching all exceptions can hide specific errors and make debugging difficult. Catch specific exception types instead.",
    "recommendation": "Catch specific exception types (e.g. ValueError, ConnectionError) rather than bare except or Exception.",
    "enabled": true
  },
  {
    "id": "SB-AI-009",
    "name": "Hardcoded filesystem path",
    "pattern": "(?:[A-Za-z]:\\\\(?:Users|Program Files|Windows|ProgramData|Temp|home)|(?:/home|/tmp|/var|/usr|/opt|/etc|/root|/mnt|/srv)/[a-zA-Z])",
    "patternFlags": "gi",
    "severity": "low",
    "fileExtensions": [
      ".py",
      ".go",
      ".rs",
      ".c",
      ".cpp",
      ".h",
      ".java",
      ".rb",
      ".php",
      ".js",
      ".ts",
      ".jsx",
      ".tsx",
      ".mjs",
      ".cjs",
      ".sh",
      ".bash",
      ".bat",
      ".cmd",
      ".ps1",
      ".swift",
      ".kt",
      ".dart",
      ".lua",
      ".pl",
      ".r",
      ".cs",
      ".scala",
      ".groovy",
      ".clj",
      ".ex",
      ".erl",
      ".fs",
      ".hs",
      ".zs",
      ".zscript"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "examples/",
      "scripts/",
      "tools/",
      ".env.example",
      "README",
      "CHANGELOG",
      "**/flexible-analyze-utils*",
      "**/path-safety*",
      "**/softHsmAdapter*",
      "**/pageRepoScan*",
      "**/setup-zorin*",
      "**/check-js*",
      "**/*.ps1",
      "**/*.bat",
      "**/*.cmd",
      "**/ai-platform/tools/",
      "**/utils-lib/path*",
      "**/utils-lib/format*",
      "**/ScanStatus*",
      "**/analyzeService*",
      "**/sample-report*",
      "**/utils-lib/dom*",
      "**/build-report*",
      "**/hook-install*",
      "**/gateway*",
      "**/scan-website*",
      "**/simplebeacon.sh",
      "**/AnalyzeView*",
      "**/HelpView*",
      "**/upload.test*",
      "**/__check*",
      "**/__cs_*"
    ],
    "description": "Hardcoded filesystem path found — this makes the code non-portable and may leak system structure. Use configuration or path resolution instead.",
    "recommendation": "Use relative paths, environment variables, or path.join/pathlib for cross-platform compatibility.",
    "enabled": true
  },
  {
    "id": "SB-AI-010",
    "name": "Wildcard import pollutes namespace",
    "pattern": "(?:from\\s+\\S+\\s+import\\s+\\*)",
    "patternFlags": "gi",
    "severity": "low",
    "fileExtensions": [".py"],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "examples/",
      "__init__"
    ],
    "description": "Wildcard import — this pollutes the namespace and makes it hard to trace where symbols come from. Import specific names instead.",
    "recommendation": "Replace with explicit imports: from module import SpecificClass, specific_function.",
    "enabled": true
  },
  {
    "id": "SB-AI-011",
    "name": "Bare string exception thrown",
    "pattern": "(?:raise\\s+[\"']|throw\\s+[\"']|raise\\s+['\"]|throw\\s+new\\s+String\\s*\\()",
    "patternFlags": "gi",
    "severity": "medium",
    "fileExtensions": [
      ".py",
      ".js",
      ".ts",
      ".jsx",
      ".tsx",
      ".mjs",
      ".cjs",
      ".java",
      ".kt",
      ".scala",
      ".groovy",
      ".cs",
      ".cpp",
      ".c",
      ".go",
      ".rs",
      ".swift",
      ".dart",
      ".rb",
      ".php"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/"
    ],
    "description": "Bare string thrown as exception — this bypasses the type system and makes error handling unreliable. Always throw proper exception/error types.",
    "recommendation": "Raise a proper exception class: raise ValueError('message') or throw new Error('message').",
    "enabled": true
  },
  {
    "id": "SB-AI-012",
    "name": "Mutable default argument (Python)",
    "pattern": "def\\s+\\w+\\s*\\([^)]*\\b(?:x|y|z|items|data|result|args|kwargs|opts|options|config|lst|arr|dct|mapping)\\s*=\\s*(?:\\[\\s*\\]|\\{\\s*\\}|set\\s*\\(\\s*\\)|dict\\s*\\(\\s*\\)|list\\s*\\(\\s*\\))",
    "patternFlags": "gi",
    "severity": "medium",
    "fileExtensions": [".py"],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/"
    ],
    "description": "Mutable default argument — Python evaluates default arguments once at function definition time, so mutable defaults are shared across all calls. This is a common AI-generated bug.",
    "recommendation": "Use None as the default and create the mutable object inside the function: def f(x=None): x = x or [].",
    "enabled": true
  },
  {
    "id": "SB-AI-013",
    "name": "Disabled authentication check",
    "pattern": "(?:auth\\s*=\\s*(?:False|false|FALSE|0|no|off|disabled)|skip_auth\\s*[:=]\\s*(?:True|true|TRUE|1|yes|on)|require_auth\\s*[:=]\\s*(?:False|false|FALSE|0|no|off)|authentication\\s*=\\s*(?:False|false|FALSE|0|no|off|disabled)|is_authenticated\\s*[:=]\\s*(?:True|true|TRUE|1|yes|on)|bypass_auth\\s*[:=]\\s*(?:True|true|TRUE|1|yes|on))",
    "patternFlags": "gi",
    "severity": "medium",
    "fileExtensions": [
      ".py",
      ".js",
      ".ts",
      ".jsx",
      ".tsx",
      ".mjs",
      ".cjs",
      ".go",
      ".rs",
      ".java",
      ".kt",
      ".swift",
      ".dart",
      ".rb",
      ".php",
      ".cs",
      ".scala",
      ".groovy",
      ".yaml",
      ".yml",
      ".json",
      ".toml",
      ".ini",
      ".cfg",
      ".conf",
      ".env"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "examples/",
      "mock/",
      "stubs/",
      ".env.example",
      "config.example"
    ],
    "description": "Authentication check is disabled or bypassed — this allows unauthenticated access to protected resources.",
    "recommendation": "Enable authentication. For development, use a dev auth bypass flag that requires NODE_ENV=development or equivalent.",
    "enabled": true
  },
  {
    "id": "SB-AI-014",
    "name": "Long sleep in production code",
    "pattern": "(?:time\\.sleep\\s*\\(\\s*(?:[6-9]\\d{2,}|[1-9]\\d{3,})|Thread\\.sleep\\s*\\(\\s*(?:[6-9]\\d{4,}|[1-9]\\d{5,})|setTimeout\\s*\\(\\s*(?:[^,]+,\\s*(?:[6-9]\\d{4,}|[1-9]\\d{5,})))",
    "patternFlags": "gi",
    "severity": "low",
    "fileExtensions": [
      ".py",
      ".java",
      ".kt",
      ".scala",
      ".groovy",
      ".cs",
      ".cpp",
      ".c",
      ".go",
      ".rs",
      ".swift",
      ".dart",
      ".rb",
      ".php"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "examples/",
      "scripts/",
      "benchmarks/"
    ],
    "description": "Long sleep call found — this blocks the thread and is often a sign of a race condition workaround or polling hack. Use proper async patterns instead.",
    "recommendation": "Replace with an event-driven approach, condition variable, or async/await pattern. If polling is necessary, use shorter intervals with a timeout.",
    "enabled": true
  },
  {
    "id": "SB-AI-015",
    "name": "Wildcard CORS or permissions",
    "pattern": "(?:access-control-allow-origin\\s*[:=]\\s*[\"']\\*[\"']|allowed_origins\\s*[:=]\\s*[\"']\\*[\"']|cors_origins\\s*[:=]\\s*[\"']\\*[\"']|origins\\s*[:=]\\s*[\"']\\*[\"']|allow\\s*[:=]\\s*[\"']\\*[\"']|permissions\\s*[:=]\\s*[\"']\\*[\"']|scope\\s*[:=]\\s*[\"']\\*[\"']|Access-Control-Allow-Origin.*\\*|res\\.header\\s*\\(\\s*[\"']Access-Control-Allow-Origin[\"']\\s*,\\s*[\"']\\*[\"']|app\\.use\\s*\\(\\s*cors\\s*\\(\\s*\\{\\s*origin\\s*:\\s*[\"']\\*[\"'])",
    "patternFlags": "gi",
    "severity": "medium",
    "fileExtensions": [
      ".py",
      ".js",
      ".ts",
      ".jsx",
      ".tsx",
      ".mjs",
      ".cjs",
      ".go",
      ".rs",
      ".java",
      ".kt",
      ".swift",
      ".dart",
      ".rb",
      ".php",
      ".cs",
      ".yaml",
      ".yml",
      ".json",
      ".toml",
      ".ini",
      ".cfg",
      ".conf",
      ".env"
    ],
    "excludePaths": [
      "test/",
      "tests/",
      "__tests__/",
      "spec/",
      "fixtures/",
      "docs/",
      "examples/",
      ".env.example",
      "config.example",
      "**/serve.cjs",
      "**/local_dashboard_server*",
      "**/test_server*",
      "**/codebase-analyzer-patterns*",
      "**/url.js",
      "**/simplebeacon-server.cjs"
    ],
    "description": "Wildcard CORS or permissions — this allows any origin to access the resource. Restrict to known origins in production.",
    "recommendation": "Specify explicit allowed origins instead of '*'. For development, use a local origin list.",
    "enabled": true
  }
]