▸ CODESCAN
DocsSupportScanner
RULES ENGINE

Rules Engine

The Rules Engine lets CodeScan detect specific patterns in your code using regular expressions — instantly, at zero AI cost. It runs alongside the AI pipeline on every scan and tags each match separately so you always know where each finding came from.

How it works

When you start a scan, the Rules Engine runs before the AI pipeline:

1
Load rules
All enabled Community rules + your Custom rules are loaded for the current scan session.
2
Match patterns
Each rule's regex pattern is tested against every line of every file. Language filters are applied — a Python-only rule won't run on TypeScript files.
3
Merge with AI results
Rule matches are merged with the AI pipeline output. If the AI already flagged the same line, the rule match is deduplicated — you never see the same issue twice.
4
Tag the source
Each finding is labelled RULE (community rule) or CUSTOM (your own rule) so you know exactly where it came from.

Plan availability

Community rules are free for everyone. Custom rules require a paid plan:

PLANCOMMUNITY RULESCUSTOM RULES
Free✓ All 25 rules— Not available
Starter $14/mo✓ All 25 rules✓ Up to 10 rules
Pro $34/mo✓ All 25 rules✓ Up to 50 rules
Team $89/mo✓ All 25 rules✓ Up to 200 rules
Business $299/mo✓ All 25 rules✓ Unlimited

Opening the Rules panel

In the scanner, click the ⬡ Rules button in the top header. The panel slides in from the right with two tabs:

  • Community — 25 built-in rules, all on by default. Toggle any rule off to skip it on future scans.
  • Custom — your own rules. Create, edit, enable/disable, or delete them here.

The number badge on the ⬡ Rules button shows how many rules are currently active.

Community rules reference

All 25 built-in rules run automatically. You can turn any of them off in the Community tab if they generate noise for your project.

SECRETS & CREDENTIALS
CRITICAL
Hardcoded API Key
Detects api_key, apikey, api_secret assignments with 20+ character values
CRITICAL
Hardcoded Password
Detects password=, passwd=, pwd= with a string value
HIGH
Hardcoded Token / Bearer
Detects token, bearer, access_token, auth_token assignments
CRITICAL
AWS Access Key ID
Detects the AKIA prefix pattern of AWS access key IDs
CRITICAL
Private Key Material
Detects PEM private key headers (RSA, EC, DSA, OPENSSH)
DANGEROUS FUNCTIONS
HIGH
Use of eval()
Flags eval() calls in JavaScript, TypeScript, Python, Ruby, PHP
HIGH
Shell Command Execution
Flags exec(), system(), popen(), subprocess.call/run(), child_process.exec()
HIGH
subprocess with shell=True
Python-only: shell=True enables command injection via shell metacharacters
SQL INJECTION
HIGH
SQL String Concatenation
SQL keywords (SELECT, INSERT, etc.) followed by string concatenation with +
HIGH
SQL via String Format
cursor.execute() or db.query() called with an f-string or % format
CROSS-SITE SCRIPTING (XSS)
HIGH
Unsafe innerHTML Assignment
JavaScript/TypeScript: element.innerHTML = assignment
MEDIUM
document.write() Usage
JavaScript/TypeScript: document.write() calls
WEAK CRYPTOGRAPHY
MEDIUM
MD5 Usage
Flags md5(), hashlib.md5(), createHash('md5')
MEDIUM
SHA-1 Usage
Flags sha1(), hashlib.sha1(), createHash('sha1')
MEDIUM
Math.random() in Security Context
JavaScript/TypeScript: Math.random() is not cryptographically secure
MEDIUM
DES / 3DES Cipher
Flags DES, 3DES, TripleDES references
SECURITY MISCONFIGURATION
MEDIUM
Debug Mode Enabled
Flags DEBUG=True, debug=true, debug=1 in code
HIGH
SSL Certificate Verification Disabled
Flags verify=False, rejectUnauthorized: false, InsecureRequestWarning
MEDIUM
CORS Wildcard Origin
Flags Access-Control-Allow-Origin: * in responses
LOW
HTTP URL (not HTTPS)
String literals starting with http:// (ignores localhost/127.0.0.1)
OTHER PATTERNS
HIGH
User-Controlled File Path
req.params/query/body used with file open/read calls
HIGH
Prototype Pollution Risk
Direct access to __proto__ or constructor.prototype
MEDIUM
Dynamic RegExp from User Input
new RegExp() with req.params/query/body values
INFO
console.log Debug Statement
JavaScript/TypeScript console.log/debug/info calls
INFO
Security-related TODO / FIXME
Comments with TODO/FIXME mentioning security, auth, injection, xss, etc.

Creating a custom rule — field guide

Click + New custom rule in the Custom tab. Fill in the fields below:

Name *REQUIRED

A short, human-readable label shown in the findings panel. Be specific — 'Hardcoded DB password' is better than 'Security issue'. This is what your team will see in reports.

EXAMPLE
Hardcoded DB password
Pattern (regex) *REQUIRED

A JavaScript-compatible regular expression (no leading/trailing slashes). The pattern is tested against each line of the file. Backslashes must be doubled (\s not \s). The pattern is case-insensitive by default.

Tip: Test your regex at regex101.com before saving. Select JavaScript as the flavour.

EXAMPLE
db_pass\s*=\s*["'][^"']+["']
CategoryOPTIONAL

Groups the finding with similar issues. Used for filtering and reports. Common values: Hardcoded Secret, SQL Injection, Command Injection, XSS, Path Traversal, Security Misconfiguration, Weak Cryptography, Custom.

EXAMPLE
Hardcoded Secret
SeverityOPTIONAL

How serious is this finding? Choose the level that matches the worst-case impact if exploited:

EXAMPLE
critical
criticalImmediate exploitation possible. Exposed credentials, RCE, authentication bypass.
highExploitable with moderate effort. Injection flaws, insecure deserialization.
mediumReal risk but requires specific conditions. Weak crypto, misconfigured headers.
lowMinor risk or defence-in-depth improvement. HTTP instead of HTTPS, verbose errors.
infoNo direct risk. Debug statements, TODO comments, informational notes.
DescriptionOPTIONAL

Explains what the rule detected and why it is dangerous. Shown in the finding detail panel. Write 1–3 sentences. Focus on the security impact, not just what the pattern matches.

EXAMPLE
A database password is hardcoded in the source code. If this file is committed to version control, the password becomes accessible to anyone with repo access.
RecommendationOPTIONAL

Actionable fix instructions shown to the developer. Be specific — include the function, pattern, or config setting to use instead of the insecure one.

EXAMPLE
Move the database password to an environment variable (process.env.DB_PASS) and load it at runtime. Rotate the password if it has already been committed.
CWEOPTIONAL

Common Weakness Enumeration ID for the vulnerability type. Optional but adds a clickable link to the CWE database in the finding. Format: CWE-NNN.

EXAMPLE
CWE-259
CWE-89SQL Injection
CWE-79Cross-Site Scripting (XSS)
CWE-78OS Command Injection
CWE-22Path Traversal
CWE-259Hardcoded Password
CWE-798Hardcoded Credentials (API key, token)
CWE-327Weak Cryptographic Algorithm (MD5, DES)
CWE-338Insecure Random Number Generator
CWE-295Improper Certificate Validation
CWE-352CSRF
CWE-601Open Redirect
CWE-532Sensitive Data in Logs
CWE-489Debug Code Left in Production
CWE-95Code Injection / eval()
LanguagesOPTIONAL

Restricts the rule to specific languages. Leave blank to match all languages. Enter language names separated by commas. The names must match what CodeScan detects from the file extension:

EXAMPLE
javascript, typescript
javascript.js .jsx .mjs .cjs
typescript.ts .tsx
python.py
ruby.rb
go.go
java.java
kotlin.kt
swift.swift
php.php
rust.rs
csharp.cs
cpp.c .cpp .cc .h .hpp
shell.sh .bash
sql.sql

Example custom rules

Copy these as starting points for your own rules:

Hardcoded DB connection string
Pattern(?:mongodb|postgres|mysql|redis):\/\/[^\s"']+:[^\s"']+@SeveritycriticalCategoryHardcoded SecretCWECWE-798Languages(blank — all)WhyDetects database connection strings with embedded usernames and passwords.
JWT secret hardcoded
Pattern(?:jwt_secret|JWT_SECRET|jwtSecret)\s*[:=]\s*["'][^"']{10,}["']SeveritycriticalCategoryHardcoded SecretCWECWE-798Languages(blank — all)WhyDetects hardcoded JWT signing secrets.
Insecure cookie (no httpOnly/secure)
Patternres\.cookie\s*\([^)]+\)(?!.*httpOnly)SeveritymediumCategorySecurity MisconfigurationCWECWE-614Languagesjavascript, typescriptWhyFlags cookies set without the httpOnly or secure flags.
Python pickle.loads (deserialization)
Patternpickle\.loads?\s*\(SeverityhighCategoryInsecure DeserializationCWECWE-502LanguagespythonWhypickle.loads on untrusted data allows arbitrary code execution.
Sensitive data logged
Pattern(?:console\.log|print|logger\.).*(?:password|token|secret|apikey|ssn|credit_card)SeveritymediumCategoryInformation DisclosureCWECWE-532Languages(blank — all)WhyCatches logging statements that include sensitive field names.

Reading rule findings in the scanner

Rule-matched findings appear in the same list as AI findings. You can tell them apart by the tag next to the status:

RULEMatched a Community rule (built-in)
CUSTOMMatched one of your Custom rules
(no tag)Detected by the AI pipeline

Rule findings include all the same fields as AI findings: severity, category, line number, snippet, description, recommendation, and CWE. The only difference is that Fix and Enrich are not available on rule matches — those require the AI pipeline.

Tips for writing good regex rules

  • Escape backslashes: write \\s not \s — the pattern field is a plain string, not a regex literal.
  • Anchor to context: password\\s*=\\s*["'] is better than just password — it avoids flagging comments and variable names.
  • Use alternation for variants: (?:password|passwd|pwd) catches multiple spellings in one rule.
  • Set a language filter for language-specific patterns (e.g. shell=True only makes sense in Python).
  • Use INFO severity for patterns that are always worth reviewing but not always a bug (e.g. console.log).
  • Test at regex101.com — paste your pattern, select JavaScript, and test against sample code before saving.