Security & Quality Baseline
What we check, what we flag, and what we don't.
Web App Security
RequiredSecret ScanningHard Fail
Critical Dependency CVEsHard Fail
Insecure Production DefaultsHard Fail
Dangerous Code PatternsWarning
HTTPS / Cookie / CSRF PostureWarning
Maintainability
RequiredAgent Dossier Files PresentRequired
Linting ConfiguredRequired
Build / Run ScriptWarning
Project StructureWarning
LLM / Agent Risk
ConditionalOnly for listings with AI/agent features.
Prompt Injection Surface ReviewRequired
Least-Privilege Tool PermissionsRequired
Secrets in Prompt TemplatesHard Fail
Rate Limits on AI EndpointsWarning
Not Covered
Business logic or domain-specific bugs
Penetration testing (DAST)
Performance or load testing
Accessibility (WCAG)
License compatibility