The test corpus (docs/TESTING.md) needs 10 synthetic "vibe-coded" sample apps with seeded, cataloged defects — every seeded defect gets an expected finding, and they define ground truth for the analyzers.
This issue: a small Express app under testdata/corpus/express-basic/ that looks like typical AI-agent output and deliberately contains:
- 1–2 dependencies in package.json that don't exist on npm
- 2–3 hardcoded fake secrets (use obviously-fake values, e.g.
sk_live_FAKEFAKE…)
- a wildcard CORS config
- a dead helper function + leftover
console.log debugging
- a defects manifest (
defects.yaml) listing each seeded defect and the rule expected to catch it
No Rust needed — this is plain JS + a YAML list. Great first contribution.
The test corpus (docs/TESTING.md) needs 10 synthetic "vibe-coded" sample apps with seeded, cataloged defects — every seeded defect gets an expected finding, and they define ground truth for the analyzers.
This issue: a small Express app under
testdata/corpus/express-basic/that looks like typical AI-agent output and deliberately contains:sk_live_FAKEFAKE…)console.logdebuggingdefects.yaml) listing each seeded defect and the rule expected to catch itNo Rust needed — this is plain JS + a YAML list. Great first contribution.