Rule Library
39 deterministic detection rules — and growing
Every rule targets a specific class of behavioral, security, or structural risk in your diff. Rules run locally; typical staged diffs complete in seconds. Core detection does not send code to external services unless you enable optional integrations.
Severity
Category
Diff Integrity
Detects unrelated changes, formatting churn, and mixed scope within a single diff.
Behavioral Change Detection
Detects removed logic (Warn), incompatible method signature changes (Block), backward-compatible extensions (Info), and cryptographic boundary changes (Block).
Breaking Change Risk
Detects [Obsolete] attribute additions and removals on public APIs. Removing a deprecation guard is Block-severity; adding one is a Warn-level review signal.
Edge Case Handling
Detects potential null dereferences and missing validation in added code.
Error Handling Integrity
Detects swallowed exceptions (empty catch blocks) and exception handling patterns that hide failures from callers and operators.
Hardcoding and Configuration
Detects hardcoded IPs, URLs, connection strings, secrets, and environment names committed to source.
Security Risk
Detects SQL injection patterns, weak crypto algorithms (MD5, SHA1, DES), dangerous APIs (Assembly.Load, Process.Start), and credential exposure.
Data Integrity Risk
Detects unchecked casts, mass assignment without validation, and SQL ON CONFLICT IGNORE patterns that silently discard errors.
Concurrency and State Risk
Detects async void methods, blocking async calls (.Result, .Wait(), .GetAwaiter().GetResult()), lock(this), and Thread.Sleep in production code. Uses ForPatternScan to ignore matches inside // comments and string literals.
Confidence and Evidence
Flags binary files that cannot be text-scanned and warns when large diffs produce no other findings.
Data and Schema Compatibility
Detects removed serialization attributes and enum member removals that may break wire formats or persisted data.
Idempotency and Retry Safety
Detects HTTP POST endpoints without idempotency keys and raw INSERT statements without upsert guards, which are unsafe under retry logic.
Resource Lifecycle
Detects disposable resources allocated without a using statement or try/finally disposal, leading to connection and handle leaks.
PII Entity Logging Leak
Detects PII-sensitive terms (email, SSN, password, etc.) appearing inside log calls in added lines.
Uncaught Exception Path
Fires when throw new is added without a corresponding Assert.Throws or Should().Throw assertion in the test suite.
Architecture Layer Guard
Checks added using directives against configured forbidden import pairs, enforcing architectural boundaries at commit time.
Pure Context Mutation
Detects assignment operators inside property getter blocks or methods decorated with [Pure], indicating unexpected side effects.
Dependency Injection Safety
Detects DI anti-patterns: service locator usage, direct instantiation of injectable types, and captive dependency violations.
External Service Safety
Detects unsafe HTTP client usage and external service call patterns that lack timeout, cancellation, or retry configuration.
Test Quality Gaps
Detects low-quality test patterns: silenced tests ([Ignore]/[Skip]), uninformative method names, and test methods missing any assertions.
TODO and Stub Detection
Fires when added lines in non-test files contain TODO, FIXME, HACK markers, or throw new NotImplementedException, indicating unfinished work.
Nullability and Type Safety
Detects null-forgiving operator (!) overuse, pragma warning disables for nullable, and unchecked as-casts that bypass the type system.
Performance Hotpath Risk
Detects Thread.Sleep, LINQ queries inside loops, and unbounded collection growth inside loops that degrade throughput in hot paths.
Complexity Control
Detects over-engineering: single-use interfaces, abstract classes without abstract members, and unnecessary indirection added in the diff.
Pattern Consistency Deviation
Detects mixed sync/async naming conventions and service locator anti-patterns introduced inconsistently within the same file.
Naming and Contract Alignment
Detects method renames where the new CRUD verb semantically contradicts the old verb, signaling an intent mismatch.
Insecure Random in Security Context
Detects System.Random instantiation within 5 lines of security-sensitive identifiers such as token, apikey, salt, or password. System.Random is not cryptographically secure.
Float and Double Equality Comparison
Detects direct equality (== / !=) comparisons involving floating-point values, which produce unreliable results due to precision loss.
SQL Column Truncation Risk
Detects short nvarchar(N) or varchar(N) column definitions that may silently truncate data when real-world values exceed the column width.
Dependency Bot API Drift
Fires when a dependency bot PR (Dependabot, Renovate, Snyk) contains both a lockfile change and a public API method signature change in C# files.
Lockfile Changed Without Source Review
Fires when a diff contains only lockfile changes with no accompanying source-file edits, which can hide malicious dependency upgrades.
Resource Exhaustion Pattern Detection
Detects patterns that lead to resource exhaustion vulnerabilities: timeout removal, iteration limit removal, resource limit increases, cleanup removal, and unbounded async operations.
Numeric Coercion Risks
Detects implicit numeric conversions that risk truncation, overflow, or loss of precision. Flags unchecked downcasts, float-to-int conversions, and assignments from large types to small types.
Method Signature Change Risk
Disabled by default (severity None). Regex-based signature detection superseded by GCI0003. Re-enable in .gauntletci.json if needed.
Async Void Abuse
Disabled by default (severity None). Public async void detection superseded by GCI0016. Re-enable for the stricter public-only filter.
Missing Test Framework
Detects production code changes when the repository has no evidence of a test framework in project files.
Synchronous File I/O
Detects synchronous File.ReadAllText/WriteAllText and similar calls. Blocking async patterns are covered by GCI0016.
Paired Implementation Consistency
Compares sibling class implementations for opposite boolean polarity on the same predicate.
Guard Deletion Remote Use
Detects removed null or validation guards where the guarded symbol is still used later in the same method.
Rules are implemented in GauntletCI.Core/Rules/Implementations/. All rules are enabled by default and can be individually disabled or reconfigured in .gauntletci.json. See the Configuration docs for details.