Feat/kern 5 r2 m3 31d m4 1 canonicalizer#538
kern-guard: 12 new issues (+196 advisory)
ℹ️ Inline review comments — no changes.
Mode: ephemeral
Sources: ast
Changed files: 25
All findings: 219
New to this PR: 208
Shown: 12
Hidden: 196 (advisory or muted rules)
Excluded: 179 findings on paths matched by 18 install patterns
Fix suggestions: 1 shown finding
Confidence: 70%-80% on shown findings
Breakdown: ast=12
Annotations
Check warning on line 1 in examples/kern-canonicalizer/canonicalizer.kern
kern-guard / kern-guard
file-too-monolithic
.kern file has 20 top-level concern declarations outside any `module` block (20 fns); limit is 12. Group related declarations under `module Name` blocks or split into separate files to keep the structural layer scannable.
Raw output
Confidence: 70%
Suggestion:
Wrap related declarations in `module Name` blocks — declarations inside modules don't count toward this limit. Example: `module name=domain` followed by indented `fn`/`route`/`handler` children.
Check warning on line 163 in scripts/kern-canonicalizer/rehydrate.mjs
kern-guard / kern-guard
empty-collection-access
Collection 'cache' is initialized empty and never populated — reads will always be empty
Raw output
Confidence: 80%
Check warning on line 1 in packages/core/src/runner-runtime-scope.ts
kern-guard / kern-guard
secrets/high-entropy-string
A high-entropy string that looks like a random secret was committed here. If it is a credential, move it to an env var or secret store and rotate it. Matched value: `./ir…(40 chars)`.
Raw output
Confidence: 72%
Check warning on line 6 in scripts/check-kern-canonicalizer.mjs
kern-guard / kern-guard
secrets/high-entropy-string ×7
A high-entropy string that looks like a random secret was committed here. If it is a credential, move it to an env var or secret store and rotate it. Matched value: `../p…(56 chars)`.
(+6 more of this rule in this file)
Raw output
Confidence: 72%
Check warning on line 5 in scripts/kern-canonicalizer/fixtures.mjs
kern-guard / kern-guard
secrets/high-entropy-string ×2
A high-entropy string that looks like a random secret was committed here. If it is a credential, move it to an env var or secret store and rotate it. Matched value: `./re…(30 chars)`.
(+1 more of this rule in this file)
Raw output
Confidence: 72%