JevGate 0.16.0

cargo install jevgate --locked

Checked against 40 open-source projects in every supported stack (Rust, Python, JavaScript/TypeScript, Go, C#, Java, PHP, Ruby, Svelte, Astro, Vue, Supabase SQL, GitHub Actions), with every review and consider labeled by hand. On the first 17, reviews went from 140 to 107 and considers from 935 to 293, mostly false positives and repeated findings removed; undecided units stayed near 2%.

• Test redundancy: two tests that check one behavior with different inputs are a note on their own; three or more linked by such pairs stay one consider. A review ("one adds nothing") needs both tests to share the input case and expected outcome, or to read the same apart from their names; tests in different groups whose setup is not sent are at most a consider. Parameterized tests are suggested in Rust only when the crate uses rstest, test-case or yare.
• Repeated findings are reported once: the pairs of a group of overlapping tests, and copies inside tests that a test-redundancy finding already names.
• Shared logic: copies of four lines or fewer are at most a consider, and short copies in test code lower still; docstrings, Go's if err != nil checks and defer cleanups, and lists of alike statements do not make a copy; variants of one example are not compared.
• Example code (examples, demo, tutorial, docs_src, top-level samples, *.Examples.* projects, Go example_*_test.go): findings are at most notes, injection and sensitive data at most considers, and hardcoded values are not judged.
• Skipped files: Rails (db/migrate) and Alembic (alembic/versions) migrations; scripts under assets, static or vendor that open with a whole license; shadcn components; files whose header says they were generated. SQL uninstall, teardown, rollback and down scripts are left out of the access-control state.
• SvelteKit: server loads, form actions, endpoints and hooks are named to Jev with who calls them and cookies.set's secure defaults. Functions in an object literal (export const actions = {…}) and functions assigned to properties (res.status = function…, Router.prototype.handle = …) are units.
• Hardcoded values: protocol codes (HTTP status, file modes), environment variable and module names, hosts from configuration, and accounts the program creates are acceptable; module constants read from require, process.env, os.getenv, ENV, env(…) or config(…) are not values; a finding that names no value is a note.
• Comments: Sphinx version notes and @author/@since blocks are left out; framework section banners, doc blocks above declarations and PHP file headers read as documentation; optional code with "uncomment to enable" is not code turned off; comments in projects whose README says they are written for learners are at most notes.
• Follow-ups: an undecided cookie check is settled by what the cookie's flags come to; the mock-only recheck names errors around stubs, fields derived from them, expected mock calls, local test servers and hooks passed as options; Rust's random check names rand's secure generators; Ruby's exception check names Rails' 404 and 500 pages. SECURITY DEFINER functions are sent with the project functions they call.
• File organization: a consider that names no group is a note, and one whose choice leans toward two groups names both.
• The hardcoded-values, unsafe-settings, test-redundancy, file-organization and comments rule versions are bumped; the first run re-asks hardcoded-value requests and some follow-ups once. Other cached answers stay valid.