Security Rules and a Severity Gate

language-agnostic security rules with a blocking threshold

Part of: AI Code Reviewer

Most findings are advice. A few should stop a merge. A hardcoded API key or a SQL query built from user input is not a matter of taste, and a reviewer that buries it under twenty style notes has failed. This lesson adds a small set of security rules that work across languages and a gate that turns findings into a pass or fail. Rules that work in any language. Some dangerous patterns look the same in Python, JavaScript, and Java, so one table covers them all. sql-format needs two conditions on the same line, a SQL keyword and some form of string building. That split matters. cursor.execute("SELECT FROM users WHERE id = %s", (uid,)) is the safe parameterized form, and its %s sits inside the string, so it doesn't match. "SELECT FROM users WHERE id = " + uid glues user input into the query, and it does. The secret rule wants a quoted value of at least 8 characters. Short values like password = "" or token = "x" are usually placeholders, and flagging them teaches users to ignore the rule. The gate. A gate has a threshold severity. Any finding at or above it is blocking , and one blocking finding fails the gate. A team new to the reviewer might set the threshold to high so only clear pro

Challenge: Gate the Merge