Marketplace

Browse and adopt engineering standards, rules, and configurations. Fork to customize for your organization.

Critical
17 rules

Never store sensitive data in plain text

database

Passwords: bcrypt. API keys: encrypt. PII: field-level encryption. Never log sensitive data.

Critical in 55 rulesets

Always use latest dependency versions

dependencies

Use latest stable versions. Fix breaking changes—don't avoid upgrades. Check official registries.

Critical in 55 rulesets

Handle errors explicitly

go

Check every error return. No `_` for errors. Wrap with context: `fmt.Errorf("doing x: %w", err)`.

Critical in 1 ruleset

No rationalizations

llm-behavior

No excuses: 'pre-existing', 'unrelated', 'tedious', 'for now'. Recognize and continue working.

Critical in 55 rulesets

Own all code in the repository

llm-behavior

You wrote every line. No 'pre-existing issues'—only issues you haven't fixed yet.

Critical in 55 rulesets

User defines success

llm-behavior

User and tests define done. Don't redefine scope or declare partial progress as complete.

Critical in 55 rulesets

Use uv for package management

python

Use `uv` (not pip/poetry/pipenv). 100x faster, lockfile support, built-in venv. Commands: `uv add`, `uv run`.

Critical in 15 rulesets

Use Rails built-in authentication, never Devise

rails

Use `has_secure_password`, `authenticate_by`, `generates_token_for`. Never use Devise/Sorcery/Clearance.

Critical in 2 rulesets

Use Rails credentials for secrets

rails

Rails.application.credentials for secrets. `rails credentials:edit`. Environment-specific credentials. Never commit master.key.

Critical in 55 rulesets

Use Strong Parameters correctly

rails

Whitelist attributes explicitly. Never `.permit!`. Use `require(:model).permit(:field)`.

Critical in 2 rulesets

Handle Results and Options properly

rust

No `.unwrap()` in production. Use `?` operator, `map`, `and_then`. `expect()` only with good messages.

Critical in 1 ruleset

Implement proper authentication and authorization

security

Auth: bcrypt/argon2 for passwords, rate limiting, secure sessions/tokens. Authz: check permissions on every request, use policy objects or middleware.

Critical in 55 rulesets

Use HTTPS everywhere

security

Force SSL, redirect HTTP→HTTPS, secure cookies (Secure/HttpOnly/SameSite), HSTS headers.

Critical in 55 rulesets

Validate and sanitize all user input

security

Allowlists, not denylists. Validate type/length/format. Sanitize HTML. Parameterized queries only.

Critical in 55 rulesets

Never ignore failing tests

testing

Fix failures immediately. No skipping, no "pre-existing issues." Own the codebase state—a test suite with ignored tests can't be trusted.

Critical in 55 rulesets

No mocking the class under test

testing

Test real instances. Mocking the class under test hides bugs.

Critical in 55 rulesets

Code must work locally before pushing

workflow

Verify changes locally: run app, run tests, check for errors. CI catches environment issues, not basic bugs.

Critical in 55 rulesets
High
121 rules

Use Angular CLI

angular

`ng generate` for scaffolding. `ng build --configuration production`. Schematics for custom generators.

High in 8 rulesets

Use RxJS properly

angular

Observables for async. Use async pipe in templates. Unsubscribe or use takeUntilDestroyed. Signals for simple state.

High in 8 rulesets

Use standalone components

angular

Standalone components are the default (Angular 17+). NgModules are legacy. Use Signals for reactive state. Deferrable views for lazy loading.

High in 8 rulesets

Use RESTful conventions

api

GET/POST/PUT/DELETE on resources. Nested routes for relationships. Proper HTTP status codes (200/201/400/401/404/500).

High in 1 ruleset

Use GitHub Actions for CI

ci_cd

Jobs for lint, test, build. Matrix for versions. Cache dependencies. Secrets for credentials. Reusable workflows.

High in 1 ruleset

Use environment variables for configuration

config

Config in env vars, not code. Never commit .env. Commit .env.example. Never hardcode secrets.

High in 55 rulesets

Use ASP.NET Core for C# web apps

csharp

ASP.NET Core for web APIs and apps. Minimal APIs for simple endpoints. MVC for complex. DI built-in.

High in 1 ruleset

Use async/await properly

csharp

Async all the way down. Return `Task<T>`, never block with `.Result` or `.Wait()`. ConfigureAwait unnecessary in ASP.NET Core.

High in 1 ruleset

Use C# 12+ features

csharp

Primary constructors, collection expressions, default lambda params. Required members. Raw string literals. .NET 8+ for best support.

High in 1 ruleset

Use .NET CLI and NuGet

csharp

`dotnet` CLI for builds/runs. NuGet for packages. Lock file with `packages.lock.json`. .NET 8+.

High in 1 ruleset

Use .NET SDK for C# projects

csharp

.NET SDK for builds and tooling. `dotnet new` for scaffolding. `dotnet run` for dev. .NET 8+ LTS.

High in 1 ruleset

Use nullable reference types

csharp

Enable `<Nullable>enable</Nullable>`. Mark nullable with `?`. Compiler catches null issues.

High in 1 ruleset

Use xUnit or NUnit for testing

csharp

xUnit preferred (modern, parallel). NUnit also good. Use `[Fact]`/`[Theory]` or `[Test]`/`[TestCase]`.

High in 7 rulesets

Add indexes for foreign keys and frequently queried columns

database

Index: foreign keys, WHERE columns, ORDER BY columns, JOINs. Use EXPLAIN ANALYZE to verify.

High in 6 rulesets

Use MongoDB with schemas

database

Define schemas even though schemaless. Use Mongoose (Node) or ODMs. Index query fields. Embed vs reference thoughtfully.

High in 1 ruleset

Use Redis for caching and sessions

database

Redis for cache, sessions, queues. Set TTL on keys. Use Redis Cluster for scale. Avoid large keys (>1MB).

High in 1 ruleset

Use transactions for multi-step operations

database

Wrap multi-step DB operations in transactions. All-or-nothing, prevents partial updates.

High in 6 rulesets

Use Django migrations properly

django

One migration per change. Never edit applied migrations. Use RunPython for data migrations. Squash when large.

High in 4 rulesets

Use Django ORM properly

django

select_related/prefetch_related for joins. Use F() and Q() objects. Avoid N+1 with django-debug-toolbar.

High in 4 rulesets

Use Django REST Framework for APIs

django

DRF serializers for validation. ViewSets for CRUD. Token/JWT auth. Pagination on list endpoints.

High in 4 rulesets

Pattern match everything

elixir

Pattern matching in function heads, case, with. Destructure data. Multiple function clauses over conditionals.

High in 1 ruleset

Use Ecto for database access

elixir

Ecto schemas for data modeling. Changesets for validation. Repo for queries. Migrations for schema changes. Use preload for associations.

High in 1 ruleset

Use Mix for project management

elixir

mix.exs for config, mix.lock for deps. `mix deps.get`, `mix test`. Umbrella apps for monorepos.

High in 1 ruleset

Use OTP for fault tolerance

elixir

GenServers for state, Supervisors for fault tolerance. Let it crash philosophy. Use Application for startup.

High in 1 ruleset

Use Phoenix for web applications

elixir

Phoenix for web apps. LiveView for interactive UIs without JavaScript. Channels for real-time. PubSub for broadcasting.

High in 1 ruleset

Use Phoenix LiveView for interactivity

elixir

LiveView for server-rendered reactive UIs. No JavaScript needed for most interactions. Use hooks for JS interop. Streams for large lists.

High in 1 ruleset

Handle async errors

express

Wrap async handlers or use express-async-errors. Central error handler. Return proper status codes.

High in 8 rulesets

Use Express middleware properly

express

Middleware order matters. Error handlers last with 4 params. Use helmet, cors, compression.

High in 8 rulesets

Use async database operations

fastapi

Async drivers: asyncpg (Postgres), SQLAlchemy 2.0 async. Match FastAPI's async nature.

High in 9 rulesets

Use dependency injection

fastapi

Use `Depends()` for db sessions, auth, config, services. Composable and testable.

High in 4 rulesets

Use Pydantic models for request/response

fastapi

Explicit Pydantic models for all inputs/outputs. Auto-validation, docs, type safety.

High in 4 rulesets

Use Flask application factory

flask

`create_app()` factory pattern. Config from env. Blueprints for modularity. Flask extensions for features.

High in 4 rulesets

Use Flask-SQLAlchemy properly

flask

Flask-SQLAlchemy for ORM. Flask-Migrate for migrations. Scoped sessions. Avoid circular imports.

High in 4 rulesets

Use Prettier for code formatting

formatting

Prettier for JS/TS/CSS/HTML/JSON. Minimal config. Run on save. Pre-commit hook. CI check.

High in 8 rulesets

Use context for cancellation and timeouts

go

`context.Context` as first param. Propagate through call chain. Use `context.WithTimeout` for I/O.

High in 1 ruleset

Use gofmt and golangci-lint

go

`gofmt` is non-negotiable. `golangci-lint run` in CI. Enable: errcheck, govet, staticcheck.

High in 1 ruleset

Use Go modules for dependency management

go

go.mod and go.sum at repo root. `go mod tidy` before commit. Pin versions for reproducibility.

High in 1 ruleset

Use Go testing package

go

Built-in testing package. Table-driven tests. `go test -v ./...`. Use testify for assertions if needed.

High in 7 rulesets

Use slog for structured logging

go

Use `log/slog` (Go 1.21+) for structured logging. JSON handler in production. slog.With() for context. Avoid fmt.Printf for logs.

High in 1 ruleset

Use Java 21+ features

java

Virtual threads for scalable concurrency. Pattern matching for switch. Record patterns. Sequenced collections. Java 21 LTS minimum.

High in 1 ruleset

Use JUnit 5 for testing

java

JUnit 5 (Jupiter) for all tests. Use `@Test`, `@BeforeEach`, `@ParameterizedTest`. Mockito for mocking.

High in 7 rulesets

Use Maven or Gradle for builds

java

Gradle for flexibility, Maven for simplicity. Lock dependency versions. Use wrapper scripts (gradlew/mvnw).

High in 1 ruleset

Use Optional instead of null

java

`Optional<T>` for nullable returns. Never return null from methods. Use `@Nullable` annotations if needed.

High in 1 ruleset

Use async/await over callbacks and .then()

javascript

async/await for all async code. Easier to read, proper try/catch, works with loops.

High in 8 rulesets

Use const and let, never var

javascript

`const` by default, `let` for reassignment. Never `var` (hoisting bugs).

High in 8 rulesets

Use TypeScript for all new projects

javascript

TypeScript, not JS. Enable `strict: true`, `noImplicitAny`, `strictNullChecks`.

High in 8 rulesets

Use coroutines for async code

kotlin

`suspend` functions, `Flow` for streams. Structured concurrency with scopes. No blocking in coroutines.

High in 1 ruleset

Use Kotlin idioms over Java patterns

kotlin

Data classes, extension functions, scope functions (let/apply/run). Null safety with `?` and `!!`.

High in 1 ruleset

Use Laravel API Resources

laravel

API Resources for JSON responses. Transform models consistently. Collection resources for lists. Conditional attributes.

High in 1 ruleset

Use Laravel Eloquent properly

laravel

Eager loading with `with()`. Scopes for reusable queries. Mass assignment protection with $fillable.

High in 1 ruleset

Use Laravel migrations and seeders

laravel

Migrations for schema. Seeders for test data. Factories for dynamic data. Never edit applied migrations.

High in 1 ruleset

Use Laravel queues for heavy work

laravel

Queue jobs for email, notifications, processing. Use Horizon for monitoring. Retry with backoff.

High in 1 ruleset

Use Laravel validation

laravel

Form Requests for complex validation. Validate all input. Custom rules when needed. Authorize in Form Request.

High in 1 ruleset

Use Pest for Laravel testing

laravel

Pest is Laravel's default testing framework. Expressive syntax. Use arch tests for architecture rules. describe/it blocks.

High in 7 rulesets

Use mypy for Python type checking

linting

mypy with --strict mode. Check all files. Fix type errors, don't ignore. Part of CI pipeline.

High in 4 rulesets

Use RuboCop for Ruby linting

linting

RuboCop with .rubocop.yml config. Inherit from rubocop-rails, rubocop-minitest. Auto-correct safe cops.

High in 3 rulesets

Use NestJS dependency injection

nestjs

Constructor injection. @Injectable() on services. Custom providers for factories. Scope: DEFAULT unless needed.

High in 8 rulesets

Use NestJS modules properly

nestjs

Feature modules for domain boundaries. CoreModule for singletons. SharedModule for reusable providers.

High in 8 rulesets

Use App Router

nextjs

App Router over Pages Router (Next.js 13+). Server Components by default. 'use client' only when needed.

High in 8 rulesets

Use Next.js data fetching

nextjs

Fetch in Server Components. Use `cache: 'force-cache'` or `revalidate`. generateStaticParams for static paths.

High in 8 rulesets

Use Server Actions

nextjs

Server Actions for mutations. `'use server'` directive. Form actions. Revalidate with revalidatePath/revalidateTag.

High in 8 rulesets

Use Bundler for Ruby gems

package_manager

Gemfile + Gemfile.lock. `bundle install --deployment` in prod. Groups for dev/test. `bundle exec` for commands.

High in 3 rulesets

Use npm properly

package_manager

package-lock.json (commit it). `npm ci` in CI. Audit for vulnerabilities. Scripts for common tasks.

High in 8 rulesets

Follow PSR standards

php

PSR-12 coding style, PSR-4 autoloading. Use php-cs-fixer in CI. Strict types: `declare(strict_types=1)`.

High in 1 ruleset

Use Composer for dependencies

php

composer.json and composer.lock. `composer install --no-dev` for prod. PSR-4 autoloading.

High in 1 ruleset

Use PHPStan for static analysis

php

PHPStan level 9 (max) for strict analysis. Type declarations on all methods. Use baseline for legacy code migration.

High in 1 ruleset

Use PHPUnit for testing

php

PHPUnit for all tests. Use data providers for parameterized tests. Pest for simpler syntax if preferred.

High in 7 rulesets

Use Alembic for database migrations

python

Alembic for SQLAlchemy migrations. `alembic revision --autogenerate`. Review generated migrations. Stamp for sync.

High in 4 rulesets

Use async/await for I/O operations

python

Async for HTTP (httpx), database (asyncpg), files (aiofiles). Don't mix sync/async in same service.

High in 4 rulesets

Use context managers for resources

python

with statement for files, connections, locks. contextlib for custom managers. Never leave resources open. async with for async resources.

High in 4 rulesets

Use logging module properly

python

logging module, not print. Configure at app entry point. Use __name__ for logger names. Structured logging with extra dict or structlog.

High in 4 rulesets

Use Pydantic for data validation

python

Pydantic BaseModel for validation. Field types with constraints. Serialization built-in. FastAPI integration.

High in 4 rulesets

Use Ruff for linting and formatting

python

Ruff for both linting and formatting (replaces flake8/isort/pylint/Black). Single tool, 100x faster. `ruff check` and `ruff format`.

High in 6 rulesets

Use SQLAlchemy for database access

python

SQLAlchemy 2.0 style. Declarative models. Session management. Async with asyncio extension.

High in 4 rulesets

Use type hints everywhere

python

Type hints on all functions and class attributes. Enables mypy/pyright static analysis.

High in 4 rulesets

uv project structure

python

pyproject.toml for deps, uv.lock (commit it), .python-version, src/ layout. Python 3.12+.

High in 15 rulesets

Avoid N+1 queries

rails

Use `includes`/`preload`/`eager_load` for associations. Use Bullet gem in development.

High in 2 rulesets

Fat models, skinny controllers

rails

Controllers: auth, params, call service, render. Logic in models/services/form objects/query objects.

High in 2 rulesets

Use background jobs for slow operations

rails

Email, file processing, API calls, reports → background jobs (SolidQueue/Sidekiq). Keep requests <200ms.

High in 2 rulesets

Use database constraints

rails

Add NOT NULL, UNIQUE indexes, foreign keys, check constraints. Don't rely only on ActiveRecord validations.

High in 7 rulesets

Use Hotwire for interactivity

rails

Use Turbo (Drive/Frames/Streams) + Stimulus before React/Vue. JS frameworks only for complex client state.

High in 2 rulesets

Use Hotwire for Rails interactivity

rails

Turbo Drive for SPA-like nav. Turbo Frames for partials. Turbo Streams for real-time. Stimulus for JS sprinkles.

High in 2 rulesets

Use Minitest for Rails testing

rails

Minitest only—no RSpec. Rails default, fast, simple, fixtures-integrated.

High in 8 rulesets

Use Pundit for authorization

rails

Pundit policies for authorization. `authorize @record` in controllers. Policy classes match models.

High in 3 rulesets

Use service objects for complex operations

rails

Service objects for multi-model operations. Single public method (call). Return Result/Response objects. Keep models focused on persistence.

High in 2 rulesets

Use Sidekiq for background jobs

rails

Sidekiq for heavy background work. Redis required. Use perform_later. Retries with exponential backoff.

High in 3 rulesets

Use SolidQueue for Rails 8 jobs

rails

SolidQueue: Rails 8 default job backend. Database-backed. No Redis needed. Mission Control for monitoring.

High in 2 rulesets

Use functional components with hooks

react

Functional components + hooks only. No class components. Hooks enable reuse without HOCs.

High in 8 rulesets

Use React 19 features

react

Server Components for data fetching. Actions for mutations. use() hook for promises. Optimistic updates. React Compiler for auto-memoization.

High in 8 rulesets

Use React Query for server state

react

TanStack Query for server state. Auto caching/revalidation. useQuery for reads, useMutation for writes.

High in 8 rulesets

Use React Query or SWR for data fetching

react

TanStack Query or SWR for fetching. Auto caching, revalidation, loading/error states. Not useEffect+fetch.

High in 8 rulesets

Prefer composition over inheritance

ruby

Favor modules and dependency injection over deep inheritance. Max 2-3 inheritance levels. Duck typing over type checking.

High in 3 rulesets

Understand ownership and borrowing

rust

Prefer borrowing (&T, &mut T) to avoid moves. Use ownership for transfers. Clone for small Copy types is fine. Lifetimes express relationships, don...

High in 1 ruleset

Use anyhow and thiserror for errors

rust

`anyhow::Result` for applications (easy error propagation). `thiserror` for libraries (custom error types). context() for error messages.

High in 1 ruleset

Use Cargo for package management

rust

Cargo.toml for deps, Cargo.lock (commit it). `cargo add` for new deps. Workspace for monorepos.

High in 1 ruleset

Use cargo test for Rust

rust

`cargo test` for all tests. Doc tests in comments. Integration tests in tests/. `#[cfg(test)]` modules.

High in 7 rulesets

Use clippy and rustfmt

rust

`cargo fmt` before commit. `cargo clippy` with `-D warnings` in CI. Fix all warnings.

High in 1 ruleset

Use Tokio for async runtime

rust

Tokio for async I/O. `#[tokio::main]` for entry point. Use tokio::spawn for concurrent tasks. Async channels for communication.

High in 1 ruleset

Use Spring Boot 3+ features

spring

Spring Boot 3.x with Java 17+. Native compilation with GraalVM. Virtual threads support. Observability with Micrometer. Jakarta EE namespace.

High in 1 ruleset

Use Spring Boot starters

spring

spring-boot-starter-* for dependencies. Auto-configuration. application.yml over .properties.

High in 1 ruleset

Use Spring Data JPA properly

spring

Repository interfaces. Query methods by naming. @Query for custom. Use projections for performance.

High in 1 ruleset

Use Spring dependency injection

spring

Constructor injection (preferred). @Service, @Repository, @Controller. @Autowired optional with single constructor.

High in 1 ruleset

Use Spring Security

spring

SecurityFilterChain bean. JWT or session auth. Method security with @PreAuthorize. CSRF for forms.

High in 1 ruleset

Use SvelteKit for applications

svelte

SvelteKit for routing, SSR, API routes. +page.svelte for pages. +layout.svelte for shared UI. Load functions for data.

High in 8 rulesets

Use Svelte reactivity

svelte

$: for reactive statements. Stores for shared state. Runes ($state, $derived) in Svelte 5. Two-way binding with bind:.

High in 8 rulesets

Use Swift 6 strict concurrency

swift

Enable Swift 6 language mode for full concurrency checking. Sendable for thread-safe types. Actors for shared mutable state.

High in 1 ruleset

Use Swift Concurrency

swift

async/await, actors for shared state. @MainActor for UI. Structured concurrency with task groups.

High in 1 ruleset

Use Swift Package Manager

swift

SPM over CocoaPods/Carthage. Package.swift for dependencies. `swift build`, `swift test`.

High in 1 ruleset

Use Swift Testing for new tests

swift

Swift Testing (@Test, #expect) for new code. Cleaner syntax than XCTest. Parameterized tests with @Test(arguments:). Parallel by default.

High in 7 rulesets

Use SwiftUI for new UI development

swift

SwiftUI for declarative UI. @State/@Binding for local state. @Observable (iOS 17+) for view models. NavigationStack for navigation.

High in 1 ruleset

Mock only at external boundaries

testing

Mock only: external HTTP APIs, time, filesystem side effects, third-party services. Use real implementations for internal services, database, and b...

High in 55 rulesets

TDD: Red -> Green -> Refactor

testing

1) Write failing test 2) Minimum code to pass 3) Refactor. Every line has a reason.

High in 55 rulesets

Test behavior, not implementation

testing

Test public interfaces, inputs/outputs. Tests must survive refactoring. Don't test private methods.

High in 55 rulesets

Use Cypress for E2E testing

testing

Cypress for E2E tests. Commands for reusable actions. cy.intercept() for network. Avoid flaky selectors.

High in 14 rulesets

Use Jest for JavaScript testing

testing

Jest for unit/integration tests. `describe`/`it` blocks. Mock with jest.mock(). Snapshot testing sparingly.

High in 14 rulesets

Use Playwright for cross-browser E2E

testing

Playwright for multi-browser E2E. Auto-wait for elements. Trace viewer for debugging. Parallel execution.

High in 14 rulesets

Use Vitest for Vite projects

testing

Vitest for Vite-based projects. Jest-compatible API. Native ESM. Use @testing-library for components.

High in 14 rulesets

Use Zod for TypeScript validation

typescript

Zod schemas for runtime validation. Infer types from schemas. Composable. Works with React Hook Form.

High in 8 rulesets

Use Pinia for state management

vue

Pinia over Vuex. Define stores with `defineStore`. Composable pattern. DevTools integration.

High in 8 rulesets

Use Vue 3 Composition API

vue

Composition API over Options API. `<script setup>` for SFCs. Composables for reusable logic. ref/reactive for state.

High in 8 rulesets

Run formatter, linter, and tests before commit

workflow

Format → Lint → Test before every commit. Never rely on CI for basic checks.

High in 55 rulesets
Medium
74 rules

Use Angular services for shared logic

angular

Injectable services for business logic. `providedIn: 'root'` for singletons. Inject with constructor or inject().

Medium in 8 rulesets

Return consistent error responses

api

Consistent error format: code, message, field-level details. Same structure across all endpoints.

Medium in 1 ruleset

Version your APIs

api

Version in URL (`/api/v1/`) or headers. Enables breaking changes without affecting clients.

Medium in 1 ruleset

Use actionlint for GitHub Actions

ci_cd

actionlint for workflow validation. Catches syntax errors, expression issues. Run locally before push.

Medium in 1 ruleset

Use CircleCI for CI

ci_cd

config.yml with jobs and workflows. Orbs for common tasks. Cache for speed. Context for secrets.

Medium in 1 ruleset

Use GitLab CI for CI

ci_cd

.gitlab-ci.yml with stages. Include templates. Cache artifacts. Variables for config. Runners for execution.

Medium in 1 ruleset

Use Jenkins for enterprise CI

ci_cd

Jenkinsfile (declarative pipeline). Stages for phases. Shared libraries for reuse. Blue Ocean for UI.

Medium in 1 ruleset

Follow .NET naming conventions

csharp

PascalCase for public members, camelCase for private. Use dotnet-format or StyleCop. Async suffix for async methods.

Medium in 1 ruleset

Use minimal APIs for simple endpoints

csharp

Minimal APIs for simple microservices and endpoints. MapGet/MapPost with lambdas. MVC for complex scenarios with views.

Medium in 1 ruleset

Use Elasticsearch for search

database

Elasticsearch for full-text search, logs, analytics. Define mappings. Use bulk API for indexing. Replicas for availability.

Medium in 1 ruleset

Use SQLite for development and simple apps

database

SQLite for dev/test, single-user apps. WAL mode for concurrency. Switch to Postgres for production scale.

Medium in 1 ruleset

Use Django forms for validation

django

Forms/ModelForms for input validation. Clean methods for business logic. Never trust request.POST directly.

Medium in 4 rulesets

Use ExUnit for testing

elixir

ExUnit with describe/test. Doctests for documentation. Mox for mocking behaviors. async: true for speed.

Medium in 1 ruleset

Use Express Router for modularity

express

Router for route groups. Mount with `app.use('/api', router)`. Keep routes thin, logic in services.

Medium in 8 rulesets

Use isort for Python imports

formatting

isort for import ordering. Profile: black. Run before Black. Or use Ruff which includes isort.

Medium in 4 rulesets

Use StandardRB for Ruby formatting

formatting

StandardRB: no config, no debates. RuboCop with opinionated defaults. Just run `standardrb --fix`.

Medium in 3 rulesets

Atomic commits with Conventional Commits

git

Small, focused commits. Use: feat/fix/refactor/test/docs/chore. Each commit independently deployable.

Medium in 55 rulesets

Prefer interfaces over concrete types

go

Accept interfaces, return structs. Small interfaces (1-2 methods). Define interfaces where used, not implemented.

Medium in 1 ruleset

Use Go 1.22+ features

go

range over integers, range over func. Enhanced HTTP routing patterns. for loop variable fix. Go 1.22+ minimum.

Medium in 1 ruleset

Follow Java naming conventions

java

Classes: PascalCase. Methods/variables: camelCase. Constants: SCREAMING_SNAKE_CASE. Packages: lowercase.

Medium in 1 ruleset

Prefer immutability

java

Final fields, immutable collections. Use records for data classes (Java 16+). Builder pattern for complex objects.

Medium in 1 ruleset

Use Checkstyle for Java style

java

Checkstyle for style enforcement. Google or Sun conventions. Integrate with build (Maven/Gradle).

Medium in 1 ruleset

Use SpotBugs for Java bug detection

java

SpotBugs (FindBugs successor) for bug patterns. High-confidence issues only. Part of CI pipeline.

Medium in 1 ruleset

Use Spotless for Java formatting

java

Spotless for consistent formatting. Google Java Format or custom. `spotlessApply` before commit.

Medium in 1 ruleset

Use ESLint with strict configuration

javascript

ESLint + @typescript-eslint recommended rules. No `any`, no unused vars. Run in CI.

Medium in 9 rulesets

Use Kotest or JUnit 5 for testing

kotlin

Kotest for expressive specs, JUnit 5 for familiarity. MockK for Kotlin-native mocking.

Medium in 1 ruleset

Use ktlint for formatting

kotlin

ktlint for consistent style. Android Kotlin style guide. Run in CI with `--reporter=checkstyle`.

Medium in 1 ruleset

Use Laravel's service container

laravel

Bind interfaces to implementations in providers. Constructor injection. Use app() only in service providers. Contextual binding when needed.

Medium in 1 ruleset

Use Biome for JS/TS linting and formatting

linting

Biome: fast all-in-one linter+formatter. Replaces ESLint+Prettier. Single config. Rust-based.

Medium in 8 rulesets

Use flake8 for Python linting

linting

flake8 for style checks. Use with .flake8 config. max-line-length: 88 (Black compat). Ruff is faster alternative.

Medium in 4 rulesets

Use pyright for Python type checking

linting

pyright: fast type checker. VS Code Pylance backend. strict or basic mode. Better inference than mypy.

Medium in 4 rulesets

Use NestJS pipes and guards

nestjs

ValidationPipe with class-validator DTOs. Guards for auth. Interceptors for transforms. Exception filters.

Medium in 8 rulesets

Use Next.js Image and Link

nextjs

next/image for optimized images. next/link for client navigation. Automatic prefetching.

Medium in 8 rulesets

Use pip with requirements.txt

package_manager

requirements.txt with pinned versions. `pip freeze > requirements.txt`. Virtual environments. Prefer uv.

Medium in 4 rulesets

Use pnpm for efficiency

package_manager

pnpm: fast, disk-efficient. pnpm-lock.yaml. Workspaces for monorepos. Strict node_modules by default.

Medium in 8 rulesets

Use Poetry for Python dependency management

package_manager

pyproject.toml + poetry.lock. `poetry install --no-dev` for prod. Groups for dev deps. Prefer uv for speed.

Medium in 4 rulesets

Use Yarn properly

package_manager

yarn.lock (commit it). Workspaces for monorepos. `yarn install --frozen-lockfile` in CI. Yarn Berry for PnP.

Medium in 8 rulesets

Use PHP 8.3+ features

php

Constructor promotion, named arguments, match, attributes, typed properties, enums, readonly classes. PHP 8.3+ for typed class constants.

Medium in 1 ruleset

Use Symfony for enterprise PHP

php

Symfony for enterprise PHP. Bundles for modularity. Flex for recipes. Doctrine for ORM. Use makers for scaffolding.

Medium in 1 ruleset

Migrate from pipenv to uv

python

pipenv is slow and unmaintained. Migrate to uv for speed and modern features. `uv init` from existing.

Medium in 4 rulesets

Use boto3 for AWS

python

boto3 for AWS services. Use resource API for simple ops, client for advanced. Handle pagination.

Medium in 4 rulesets

Use Celery for distributed tasks

python

Celery for distributed task queue. Redis or RabbitMQ broker. Beat for scheduling. Flower for monitoring.

Medium in 4 rulesets

Use dataclasses or Pydantic for data structures

python

Dataclasses for simple containers, Pydantic for validation. No plain dicts for structured data.

Medium in 4 rulesets

Use httpx for async HTTP

python

httpx for async HTTP client. Requests-compatible API. Async context manager. HTTP/2 support.

Medium in 4 rulesets

Use pylint for comprehensive Python linting

python

pylint for comprehensive checks. Disable noisy rules in pylintrc. Ruff is faster alternative.

Medium in 4 rulesets

Use pytest for testing

python

pytest with fixtures and parametrize. Simple asserts, rich plugin ecosystem.

Medium in 10 rulesets

Use requests for sync HTTP

python

requests for simple sync HTTP. Session for connection pooling. Timeout always. Use httpx for async.

Medium in 4 rulesets

Use unittest for Python basics

python

unittest for simple cases or legacy code. TestCase classes. setUp/tearDown. Prefer pytest for new projects.

Medium in 10 rulesets

uv scripts and commands

python

Define entry points in `[project.scripts]`. Run any command with `uv run <cmd>`. CI: `uv sync --frozen`.

Medium in 9 rulesets

uv workspaces for monorepos

python

Use `[tool.uv.workspace]` for multi-package repos. Single lockfile, editable local packages.

Medium in 5 rulesets

Use Action Cable for WebSockets

rails

Action Cable for WebSockets. Channels for subscriptions. Redis adapter for multi-server. Use Turbo Streams when possible.

Medium in 2 rulesets

Use Active Storage for file uploads

rails

Active Storage for uploads. Direct uploads for large files. Variants for images. S3/GCS for production.

Medium in 2 rulesets

Use has_many :through over HABTM

rails

Always `has_many :through` with explicit join model. Never `has_and_belongs_to_many`.

Medium in 2 rulesets

Use Importmap for Rails JavaScript

rails

Importmap for JS without bundling. Pin packages from CDN or vendor. Works with Hotwire. No node_modules.

Medium in 2 rulesets

Use Propshaft for Rails assets

rails

Propshaft for asset pipeline. Simpler than Sprockets. No compilation, just fingerprinting. Rails 8 default.

Medium in 2 rulesets

Use scopes for common queries

rails

Define scopes for reusable queries. Enables chaining: `Order.recent.completed.for_user(user)`.

Medium in 2 rulesets

Use SolidCable for Action Cable

rails

SolidCable: database-backed pub/sub for Action Cable. No Redis needed. Rails 8 default.

Medium in 2 rulesets

Use SolidCache for Rails caching

rails

SolidCache: database-backed cache. No Redis needed. Good for most apps. Rails 8 default.

Medium in 2 rulesets

Avoid prop drilling with Context or state management

react

Context for static data, Zustand/Jotai for simple state, Redux Toolkit for complex. No deep prop drilling.

Medium in 8 rulesets

Use Zustand for React state

react

Zustand for simple global state. No boilerplate. Hooks-based. Persist middleware for storage.

Medium in 8 rulesets

Explicit return values in methods

ruby

Return meaningful values or `self`. Predicates (`?`) return booleans. Bang methods (`!`) mutate or raise.

Medium in 3 rulesets

Use Hanami for clean Ruby architecture

ruby

Hanami for DDD-style Ruby apps. Explicit dependencies. Actions over controllers. Repositories for persistence.

Medium in 3 rulesets

Use Ruby 3+ features

ruby

Use pattern matching, endless methods (`def x = ...`), hash shorthand `{x:}`, numbered params `_1`. Ruby 3.2+.

Medium in 3 rulesets

Use Sinatra for simple Ruby APIs

ruby

Sinatra for microservices and simple APIs. Modular style for larger apps. Rack middleware compatible.

Medium in 3 rulesets

Use derive macros for common traits

rust

`#[derive(Debug, Clone, PartialEq)]` for structs. Use `thiserror` for error types, `serde` for serialization.

Medium in 1 ruleset

Follow Swift API Design Guidelines

swift

Clarity over brevity. Omit needless words. Use grammatical English phrases. SwiftLint for enforcement.

Medium in 1 ruleset

Use value types by default

swift

Structs over classes unless you need reference semantics. Enums with associated values. Protocols for polymorphism.

Medium in 1 ruleset

Integration tests over unit tests for web apps

testing

Integration tests for full request/response cycle. Unit tests for complex logic, edge cases, performance.

Medium in 7 rulesets

One assertion per test (conceptually)

testing

One logical concept per test. Multiple asserts OK if same concept. Clear test names describing behavior.

Medium in 55 rulesets

Use Capybara for Rails integration

testing

Capybara for system tests. Use semantic selectors. Wait for async. Headless Chrome in CI.

Medium in 9 rulesets

Use fixtures or factories for test data

testing

Use consistent test data setup: fixtures for stable reference data, factories for dynamic scenarios. Avoid inline object creation scattered through...

Medium in 55 rulesets

Use Mocha for Node.js testing

testing

Mocha with Chai assertions. describe/it blocks. Sinon for mocking. async/await in tests.

Medium in 14 rulesets

Use RSpec for Ruby BDD

testing

RSpec describe/context/it. let/let! for setup. FactoryBot for data. Avoid excessive mocking.

Medium in 9 rulesets

Use Vue Router properly

vue

Named routes, navigation guards. Lazy-load routes with dynamic imports. Use route meta for permissions.

Medium in 8 rulesets