Rulepath emits high-confidence findings for invariant violations and medium-confidence review hints for observations that need a human decision.
| ID | Name |
|---|---|
INV001 |
Unscoped resource access |
INV002 |
Client-controlled server-owned field |
INV003 |
Mutation without operation authorization |
INV004 |
Declared state transition invariant missing |
INV005 |
Sensitive operation lacks idempotency |
INV006 |
Bulk update/delete without scope |
INV007 |
Export/download/report without permission |
INV008 |
Service-layer sensitive mutation reachable from unprotected route |
| ID | Name |
|---|---|
HINT001 |
Possible resource not configured |
HINT002 |
Possible authorization helper not configured |
HINT003 |
Possible workflow transition |
HINT004 |
Possible money-like operation |
HINT005 |
Export-like endpoint |
HINT006 |
Auth present but scope unclear |
Every finding should include rule ID, title, severity, confidence, resource, operation, route, call path, request-controlled source, sink, missing invariant, observed evidence, expected evidence, suggested fix, and stable fingerprint.
Rules must evaluate IR and config only.
Findings are reserved for high-confidence invariant violations. INV003, INV004, INV005, INV007, and INV008 use normalized evidence from the IR and configured invariants to decide whether authorization, transition, idempotency, permission, and scope requirements are satisfied. Uncertain observations remain review hints.
Review hints are medium-confidence diagnostics and stay separate from findings in text, JSON, SARIF, and baselines. HINT002 flags authorization-looking helpers that are not configured, and HINT004 flags money-like operations that may need idempotency or operation authorization invariants.