cargo install jevgate --locked
- Java, C#, PHP and Ruby are judged. Java and C# get the maintainability, test and security rules; PHP gets security and tests (PHPUnit, Pest), with a page script's top-level code judged like a function; Ruby gets maintainability and tests (RSpec, Minitest), with each example's groups, hooks,
let/subject and support helpers as evidence. JUnit, TestNG, xUnit, NUnit and MSTest tests are recognized.
- Frameworks: Django and Django REST framework (views with their routes and
|safe templates, settings modules and the files that select them, CSRF exemptions, literal secrets, unsafe deserialization, error handlers), Next.js (route handlers, Server Actions, pages/api, middleware, client components, dangerouslySetInnerHTML, open redirects, raw Prisma and Drizzle queries, NEXT_PUBLIC_ secrets, next.config headers), ASP.NET Core (controller actions, minimal APIs, exception handlers, EF Core raw SQL, JWT options and signing keys written in code), Slim and Laravel, and Spring MVC tests linked to the controller method they reach.
- Documentation rules also read MDX, reStructuredText and AsciiDoc. Undecided staleness, duplication and large-doc checks are settled by what a section treats its names as and how two sections relate, which removed most duplicate-section noise.
- Security checks that stay undecided get a narrow follow-up question (where redirect targets come from, how markup is rendered, which origins CORS allows, what logs write, where code runs), which can only clear a check.
- Tests: overlapping tests are grouped only when their pairs connect them; a test pair's subject skips getters, setters and fixtures most tests call; undecided pairs and mock-only checks are asked again with the code under test.
- Copies of three lines or fewer are at most a consider.
