Engine catalog
See what Fettl actually checks.
Explore the patterns Fettl checks: hidden failures, hollow implementations, duplicated logic, and structural shortcuts.
This catalog follows the current engine source. The checks available in an installed version depend on that release.
Public rules
Checks by failure type.
Free includes 30 scans with eligible fixes. Checks marked “automatic fix” can be corrected and verified by Fettl.
AI Prose Artifacts
2 checksAI021-ts_ignore_without_explanationTs ignore without explanation
TypeScript @ts-ignore or @ts-expect-error without explanatory comment
AI022-rust_unwrap_in_productionRust unwrap in production
Rust unwrap() in non-test, non-entry-point code where ? or .expect() is expected
AI Slop Patterns
20 checksAI001-typescript_any_abuseTypescript any abuse
TypeScript `any` type annotations, casts, and generic widening: the most common TypeScript AI slop pattern, indicating the generator gave up on type reasoning
AI002-typescript_double_castTypescript double cast
TypeScript `as unknown as TargetType` double-cast pattern: type laundering through `unknown` to bypass TypeScript's type-compatibility check; strongly associated with AI code generation
AI003-typescript_json_parse_castTypescript json parse cast
JSON.parse(...) cast directly to a concrete type without runtime validation: AI shortcut that skips Zod, type guards, or field-by-field checks
AI004-console_log_productionConsole log production
console.log()/console.debug() in production JS/TS code: unstructured, unfiltered debug instrumentation that AI generators leave in after development
AI005-debug_labeled_console_logDebug labeled console log
console.log calls with [DEBUG] or DEBUG: prefix: debug instrumentation labeled as temporary by the AI, committed to production
AI006-console_log_bracket_tag_prefixConsole log bracket tag prefix
console.log() calls whose first argument starts with a bracket-tagged domain prefix (e.g. [model], [api]): simulated structured logging that was never wired to a real logger
AI007-hardcoded_async_sleepHardcoded async sleep
await new Promise(resolve => setTimeout(resolve, N)): blind polling sleep instead of event-driven readiness; reliable AI-slop signal
AI008-duplicate_adjacent_commentsDuplicate adjacent comments
Consecutive identical /// doc comment lines in Rust: copy-paste artifact where an AI emits the same documentation string twice for adjacent items
AI009-formulaic_rustdoc_sectionsFormulaic rustdoc sections
Mechanical # Returns / # Arguments / # Errors rustdoc sections in Rust that restate the type signature rather than explaining behavior
AI010-optional_service_field_settersOptional service field setters
Rust structs with 3+ Option<Arc<T>> fields and set_* injector methods: bolted-on dependency injection instead of constructor injection or a builder
AI011-inline_requireInline require
require() calls inside JavaScript function or method bodies: each function importing its own dependencies instead of sharing top-of-file declarations
AI012-same_value_fallback_constantSame value fallback constant
Top-level JS/TS const named with a fallback keyword but sharing an identical initializer with another const: fake resilience: two names, one value, zero distinction
AI013-global_serverless_stateGlobal serverless state
declare global { var ... } and global.X = assignments in Next.js API route files: mutable global state that silently evaporates on every cold start in serverless deployments (Vercel, AWS Lambda, Netlify)
AI014-redundant_hasattr_self_assignRedundant hasattr self assign
`if hasattr(obj, 'attr'): obj.attr = obj.attr`: vacuous hasattr guard with a self-assignment body; always a no-op and a strong AI slop signal
AI015-brittle_llm_prefix_parsingBrittle llm prefix parsing
LLM response parsed line-by-line with `.startswith('Prefix:')`: brittle custom text protocol instead of structured output (JSON schema / function calling)
AI016-function_local_stdlib_importFunction local stdlib import
`import X` / `from X import Y` inside a function or method body when X is a stdlib module: AI models generate each function in isolation with its own imports instead of lifting them to module level
AI017-mutable_default_argumentMutable default argument
Mutable container literal (`[]`, `{}`, `{...}`) as a function parameter default: the same object is shared across all calls; classic Python footgun common in AI-generated code
AI018-excessive_defensive_null_checkingExcessive defensive null checking
Stacked null guards where the second check repeats the first: AI-generated defensive stacking
AI019-unhelpful_error_messagesUnhelpful error messages
Verbose, vague, or non-actionable error messages that don't help diagnose the problem
AI020-synthetic_valuesSynthetic values
Detects fabricated data, placeholder prices, synthetic API keys, dummy URLs, and placeholder return values
Code Hygiene
30 checksCH001-absolute_pathsAbsolute paths
Hardcoded absolute filesystem paths that break portability across machines
CH002-redundant_map_errRedundant map err
Redundant .map_err(Type::from)? chains where ? would do the same From conversion
CH003-generic_namesGeneric names
Poor variable names (temp, data, x)
CH004-manual_conversion_methodsManual conversion methods
Ad-hoc pub fn as_str(&self) or pub fn from_str(...) inherent methods that should be impl Display or impl FromStr instead
CH005-nonstandard_constructorsNonstandard constructors
Non-standard constructor names (build_with_*, create, make); new_* variants, type-discriminating names, mode-named operational constructors, and factory families with no new() are exempt
CH006-primitive_obsessionPrimitive obsession
Using primitives where types belong (magic numbers, string/int pattern matching, bool proliferation)
CH007-print_alongside_loggerPrint alongside logger
print() calls in Python files that already use a proper logger: the deferred-work pattern of reaching for print() when logging infrastructure is present
CH008-summary_litterSummary litter
AI-generated status/summary/report files
CH009-random_scriptsRandom scripts
Scattered/unorganized shell scripts (.sh, .bash, .zsh) or .py scripts
CH010-over_abstractionOver abstraction
Thin wrapper functions that add no value
CH011-outdated_setupOutdated setup
Outdated edition/version in setup files (Cargo.toml, pyproject.toml)
CH012-copy_paste_detectionCopy paste detection
Duplicated code within/across files
CH013-prefer_matchPrefer match
If/else chains that should use match/pattern matching
CH014-implicit_state_machineImplicit state machine
Detects implicit state machines that should use enums
CH015-trivial_type_aliasesTrivial type aliases
Type aliases that are trivial wrappers around standard library types
CH016-unhelpful_expectUnhelpful expect
Unhelpful .expect() messages that don't explain what went wrong
CH017-conditional_wrapperConditional wrapper
Functions starting with conditional early-return that hide control flow from callers
CH018-reexport_stubsReexport stubs
Rust files that contain only `pub use` re-exports with no implementation (pass-through stubs)
CH019-duplicate_entry_pointsDuplicate entry points
Rust modules with conflicting entry points: foo/mod.rs and foo.rs coexisting, or lib.rs + main.rs both independently declaring the same module names
CH020-direct_exitDirect exit
Direct process termination (process::exit, sys.exit, process.exit) called outside designated entry points: bypasses cleanup and prevents testing
CH021-public_test_modulesPublic test modules
Test infrastructure leaked into the public API surface via pub mod tests or pub helper functions inside cfg(test)
CH022-pub_visibilityPub visibility
pub items in library crates with no cross-crate consumers: over-broad visibility that should be pub(crate) or private
CH023-borrow_checker_evasionBorrow checker evasion
Excessive .clone(), Arc<Mutex<T>> overuse, and dyn Trait overuse: density-based detection of borrow-checker evasion patterns common in AI-generated Rust
CH024-print_only_server_loggingPrint only server logging
print() calls in Python server/application code (routes/, api/, agent/, handlers/, views/, endpoints/, middleware/ paths or FastAPI/Flask/Starlette/aiohttp/Django/Tornado imports) with no logging framework imported: the AI slop pattern of using print() as the sole logging mechanism in production server code
CH025-manual_serdeManual serde
Functions with 5+ consecutive .get("literal_key").and_then(...) calls: manual struct field extraction that should use #[derive(serde::Deserialize)] instead
CH026-floating_string_statementFloating string statement
String literal expression statements inside function bodies at non-docstring positions: evaluated and silently discarded; strong AI slop signal (misplaced LangChain-style tool descriptions)
CH027-bad_coding_practicesBad coding practices
Language-specific anti-patterns: glob re-exports, fat main() (Rust); star imports, broad/bare except, type() comparisons, global mutable state, os.path.join mixed with string concat (Python); var declarations, loose equality, Function() constructor, document.write, setTimeout with string (JS/TS)
SS001-env_var_multi_readEnv var multi read
Environment variable names read in 3+ files without a central config module
SS002-duplicated_constantsDuplicated constants
Constants with identical values declared with different names across files
SS003-config_source_duplicationConfig source duplication
Config file values hardcoded in source code instead of read from config
Code Smells
1 checksCS001-type_name_dispatchType name dispatch
type(x).__name__ == '...' or x.__class__.__name__ == '...' string comparisons used for type dispatch: use isinstance() instead
Content Quality
15 checksCQ001-hyperbolic_languageHyperbolic language
Detects promotional language (amazing, revolutionary)
CQ002-dead_code_markersDead code markers
Comments marking code as deprecated/unused
CQ003-deferred_workDeferred work
TODO/FIXME/hack markers
CQ004-test_excusesTest excuses
Excuse-making in tests (known issue, will fix later)
CQ005-verbose_commentsVerbose comments
Overly verbose AI-generated comments
CQ006-speculative_generalitySpeculative generality
YAGNI violations (future use, placeholder, stub)
CQ007-agent_scaffoldingAgent scaffolding
Agent workflow markers (Phase 1, Step 3, etc.)
CQ008-copy_paste_acknowledgmentCopy paste acknowledgment
Comments that explicitly admit code is copied or duplicated from another location
CQ009-ai_generation_headerAi generation header
File-level AI-generation disclaimer header (GPT, Claude, Copilot, 'generated by AI', etc.). High-precision, low-recall: fires rarely in practice but is a reliable signal when it does.
CQ010-decorative_separator_commentsDecorative separator comments
Decorative separator comments (── box-drawing or 20+ repeated = or - chars) used as visual section dividers instead of module decomposition
CQ011-cross_file_separator_densityCross file separator density
Project-level separator density: fires when separator comments are dense relative to source file count, detecting structural AI slop invisible to per-file checks
CQ012-documentation_linksDocumentation links
Broken relative links in Markdown documentation files
CQ013-hardcoded_yearsHardcoded years
Hardcoded year literals (2024–2029) that may be stale AI-generated timestamps or copyright headers
CQ014-hyperbolic_language_project_densityHyperbolic language project density
Project-level hyperbolic language density: fires when a high fraction of all tracked files contain CQ001 violations, detecting systematic AI writing style invisible to per-file checks
CQ015-verbose_comments_project_densityVerbose comments project density
Verbose comments saturation across source files
Database
2 checksDB001-json_column_abuseJson column abuse
Structured data serialized as JSON into a single database column instead of proper relational tables: a performance and maintainability disaster
DB002-unsafe_sql_constructionUnsafe sql construction
SQL queries built with string formatting or concatenation (f-strings, %, .format(), +): SQL injection vector; use parameterized queries instead
Dead Code Detection
9 checksDC001-dead_local_variablesDead local variables
Wildcard bindings (let _ =) and underscore variables that suppress warnings
DC002-dead_fields_invariant_boolDead fields invariant bool
Private bool fields always initialized true, never set false, with if/else branches (the else is unreachable)
DC003-dead_methodsDead methods
Methods/functions with zero callers
DC004-dead_structsDead structs
Struct/enum/class definitions that are never constructed in production code
DC005-dead_variantsDead variants
Rust enum variants (match-arm-only use is dead) and Python enum members (attribute-access-only) defined but never used in production code
DC006-unused_trait_parametersUnused trait parameters
Trait parameters unused in ALL implementations
DC007-versioned_source_file_namesVersioned source file names
Source files with a _v{N} suffix (e.g. foo_v2.py) that coexist with the base file (foo.py): AI-generated versioned duplicates instead of editing the original
DC008-vestigial_codeVestigial code
Functions with stub bodies (todo!(), unimplemented!(), pass, ..., empty block) that silently do nothing when called
DC009-semantic_stubsSemantic stubs
Functions with non-empty bodies that look implemented but do no meaningful work: Ok(()) returns, logging-only bodies, pass-through wrappers, hardcoded expression bodies, empty match arms, stub constructors
Design Slop
39 checksDS001-blue_purple_gradientBlue purple gradient
Blue-to-purple or purple gradients in CSS/Tailwind: the single most recognizable AI slop color move
DS002-default_google_fontsDefault google fonts
Overused Google Fonts (Inter, Space Grotesk, Sora, Syne, Archivo, Cormorant, Fraunces, etc.) loaded as the brand typeface
DS003-em_dashesEm dashes
Em dash in body copy, headlines, and descriptions: a classic tell of AI writing
DS004-glowy_pill_buttonsGlowy pill buttons
Fully rounded pill buttons (border-radius: 999px) with gradient fill and soft glow or blurred drop shadow
DS005-gradient_headline_textGradient headline text
Headline words clipped to a multi-color gradient via background-clip: text
DS006-background_glowBackground glow
Soft radial blob of accent color bleeding from a corner or center of a dark section for 'atmosphere'
DS007-grid_graph_backgroundGrid graph background
Faint thin grid lines (often with radial mask) layered behind hero or section to look 'technical'
DS008-hover_boopHover boop
Button that lifts (translateY) or scales up on hover: a default template reflex
DS009-fixed_backgroundFixed background
Background layer pinned with position: fixed that trails behind the whole page under everything
DS010-mix_blend_blobsMix blend blobs
Big blurred radial-gradient blobs with mix-blend-mode: multiply drifting behind content (candy aurora)
DS011-cool_blue_charcoalCool blue charcoal
Default 'serious dark product' base: cool blue-charcoal or slate-indigo ink (#0c0e15 family)
DS012-cream_beige_backgroundCream beige background
Warm cream, bone, or beige as the 'tasteful premium' background: overused to the point of slop
DS013-slop_graySlop gray
Default UI-kit neutral gray (#f3f4f6 / #eceef2 family) as footer band, section divider, or card fill
DS014-underline_fill_hoverUnderline fill hover
Link or button underline that grows, wipes, or travels in on hover: a reflexive 'look, it is interactive' flourish
DS015-default_shadowDefault shadow
Soft shadow bloomed evenly on every side of an element: the 'float everything on a fluffy cloud' look
DS016-inner_glow_boxInner glow box
Bordered pill, chip, badge, or box with a glowing tinted fill inside, or a pulsing glow behind a status dot
DS018-countdown_timerCountdown timer
Row of small boxes with big numbers and unit labels (DAYS/HRS/MIN/SEC) to fake urgency
DS019-floating_cardsFloating cards
Small cards layered over a hero that bob or float with a looping animation
DS020-accent_bar_cardAccent bar card
Plain dark box with a single bright accent line running down one edge
DS021-hairline_border_boxesHairline border boxes
Every card, stat box, or tile wrapped in a faint 1px light border with soft inner highlight
DS022-pastel_candy_gradientPastel candy gradient
Soft multi-stop wash of butter-yellow into peach into strawberry-milk pink, or mint-to-lavender
DS023-lucide_react_importsLucide react imports
lucide-react icon pack imported and used: the uniform thin-stroke look is a giveaway on every project
DS024-letterspaced_caps_everywhereLetterspaced caps everywhere
Single letterspaced uppercase treatment used for eyebrow, button text, figure numbers, nav, and footer colophon
DS025-monospace_house_voiceMonospace house voice
Monospace font used reflexively for copyright lines, eyebrows, captions, and labels to signal 'technical and premium'
DS140-hairline_border_wide_shadowHairline border wide shadow
Hairline border paired with a wide diffuse shadow: a recurring generated-UI signature. Commit to one: a defined edge or a soft elevation, not both at once
DS141-repeating_gradient_stripesRepeating gradient stripes
Repeating-gradient stripes used as surface decoration: a recurring generated-UI signature. Reach for a deliberate texture, or leave the surface plain
DS142-extreme_border_radius_cardsExtreme border radius cards
Over-rounding cards, sections, and inputs (24px and up on a small card) rounds everything into the same soft blob. Cards top out around 12 to 16px
DS143-all_caps_body_textAll caps body text
Long passages of uppercase body text: hard to read because all-caps removes word shape. Reserve uppercase for short labels and headings
DS144-gray_text_on_colored_bgGray text on colored bg
Gray text looks washed out on colored backgrounds. Use a darker shade of the background color, or white/near-white for contrast
DS145-marketing_buzzwordMarketing buzzword
Generic SaaS phrases (streamline, empower, supercharge, world-class, enterprise-grade) are instant AI tells. Pick a specific verb and noun that says what the product literally does
DS146-broken_or_placeholder_imageBroken or placeholder image
<img> tags with empty src, missing src, or placeholder values ship as broken-image boxes. Use real images, generated assets, or remove the tag
DS147-justified_textJustified text
Justified text without hyphenation creates uneven word spacing (rivers of white). Use text-align: left for body text
DS148-tight_line_heightTight line height
Line height below 1.3x the font size makes multi-line text hard to read. Use 1.5 to 1.7 for body text
DS149-tiny_body_textTiny body text
Body text below 12px is hard to read, especially on high-DPI screens. Use at least 14px for body content, 16px is ideal
DS150-wide_letter_spacing_bodyWide letter spacing body
Letter spacing above 0.05em on body text disrupts natural character groupings and slows reading. Reserve wide tracking for short uppercase labels only
DS151-bounce_elastic_easingBounce elastic easing
Bounce and elastic easing on interface elements feels dated and tacky. Reserve spring physics for things that are actually physical; ease interface motion out smoothly
DS152-layout_property_animationLayout property animation
Animating width, height, padding, or margin causes layout thrash and janky performance. Use transform and opacity instead
DS153-image_hover_transformImage hover transform
Scaling or rotating an image on hover is a recurring generated-UI signature. Let imagery sit still, or use a subtler, purposeful interaction
DS154-theater_framing_copyTheater framing copy
Dismissing something as 'theater' or 'performative' is a recurring generated-copy tic. Say plainly what the thing does or does not do
Error Handling
2 checksEH001-assert_runtime_validationAssert runtime validation
assert statements used as runtime guards: silently removed by Python's `-O` flag
EH002-duplicate_error_displayDuplicate error display
thiserror enum variants sharing an identical display template: ambiguous log messages make errors indistinguishable in production
Evasion Detection
19 checksEV001-lint_suppressionLint suppression
Lint suppressions without fixes (# noqa, #[allow])
EV002-manifest_lint_suppressionManifest lint suppression
Lint rules disabled at manifest level (Cargo.toml, pyproject.toml, ESLint config)
EV003-test_skip_evasionTest skip evasion
Skipped tests (@pytest.mark.skip)
EV004-redundant_error_handlingRedundant error handling
Empty/bare error handlers that do nothing
EV005-defensive_error_silencingDefensive error silencing
Silent error handling that hides bugs instead of failing fast
EV006-silent_fallbacksSilent fallbacks
Converting errors to defaults (.ok(), .unwrap_or_default(), catch-all match)
EV007-error_message_dispatchError message dispatch
Branching on error message text via .to_string().contains("...") instead of using typed error variants
EV008-map_err_to_stringMap err to string
.map_err(|e| Wrapper(e.to_string())) closures that silently erase structured error types
EV009-discarded_errorsDiscarded errors
Error-handling code that discards original error context: .map_err(|_| ...), bare except without chaining, catch without using error
EV010-single_use_helpersSingle use helpers
Functions called from only one place: review for reflexive extraction to dodge complexity lints
EV011-empty_test_bodiesEmpty test bodies
Test functions whose bodies cannot fail: empty, comment-only, let-only, trivially-true assertions, JS callbacks with no assertions
EV012-always_passing_testsAlways passing tests
Test functions with no assertion indicators: always pass regardless of code behavior
EV013-hidden_env_configHidden env config
Runtime env vars used as hidden behavioral toggles: possibly undocumented switches invisible to the CLI/config
EV014-hollow_test_densityHollow test density
Project-level hollow test density: fires when the combined count of empty and excused test functions exceeds a threshold, exposing systematic test scaffolding
EV015-lint_suppression_project_accumulationLint suppression project accumulation
Fires when the total count of lint suppressions exceeds the configured threshold, OR when the suppression density (suppressions per KLOC) exceeds the density threshold: catching both large low-density accumulations and small dense repos
EV016-dict_get_complex_defaultDict get complex default
Python dict.get(key, complex_default) where default is a function call or non-trivial expression
EV017-nullish_coalescing_fn_fallbackNullish coalescing fn fallback
TypeScript value ?? fn() where fallback is a function call masking absence
EV018-try_catch_default_returnTry catch default return
try/catch blocks returning default values on any exception type without distinguishing failure modes
EV019-if_let_else_hides_noneIf let else hides none
if let Some/Ok with else branch returning computed default that hides why the value was absent
Framework Hygiene
21 checksFH001-missing_key_in_mapMissing key in map
JSX elements rendered via .map() without a key prop: React can't track item identity for reordering, addition, or deletion
FH002-array_index_as_keyArray index as key
Array index used as key prop when items can reorder: index-based keys break React's reconciliation when list order changes
FH003-empty_deps_stale_closureEmpty deps stale closure
useEffect with empty dependency array but referencing state or props inside: captures stale values from first render
FH004-missing_effect_cleanup_listenerMissing effect cleanup listener
addEventListener in useEffect with no cleanup return function: event listener leak that survives unmount
FH005-missing_effect_cleanup_timerMissing effect cleanup timer
setTimeout or setInterval in useEffect with no cleanup return function: timer survives unmount, causing stale callbacks
FH006-setstate_during_renderSetstate during render
setState called directly during render phase (not in event handler or effect): causes infinite re-render loops
FH009-context_value_not_memoizedContext value not memoized
Context Provider value created inline (new object every render) without useMemo: causes all consumers to re-render on every provider render
FH010-dialog_without_aria_labelDialog without aria label
Dialog or role='dialog' element without aria-label or aria-labelledby: screen readers can't announce the dialog's purpose
FH011-input_without_labelInput without label
input element without associated label (label tag, aria-label, or aria-labelledby): inaccessible to screen readers
FH012-locale_independent_dateLocale independent date
Date.toLocaleDateString() or toLocaleString() called without explicit locale/timezone options: produces non-deterministic output across environments
FH013-suppress_hydration_warningSuppress hydration warning
suppressHydrationWarning used as a band-aid instead of fixing the underlying SSR/client mismatch
FH017-incomplete_effect_depsIncomplete effect deps
useEffect/useLayoutEffect with a dependency array that omits state or props referenced in the effect body: stale values when deps change
FH018-async_effect_without_guardAsync effect without guard
Async operation (fetch, await, .then) in useEffect without AbortController or is-mounted guard: state updates after unmount cause warnings and bugs
FH019-ssr_unsafe_window_accessSsr unsafe window access
window.innerWidth, matchMedia, or navigator.userAgent accessed during render phase (not in useEffect): causes SSR/hydration mismatch
FH020-nondeterministic_keyNondeterministic key
Key prop derived from Math.random(), Date.now(), nanoid(), or crypto.randomUUID(): key changes every render, breaking React reconciliation
FH021-aria_ref_nonexistent_idAria ref nonexistent id
aria-describedby, aria-labelledby, aria-controls, or aria-owns pointing to an ID that doesn't exist in the same file
FH022-error_message_without_roleError message without role
Element with error-indicating className (error, alert, warning) without role='alert': screen readers won't announce the error dynamically
FH023-derived_state_in_usestateDerived state in usestate
useState initialized from a prop or computation, but the setter is never called in the component: should be computed during render instead
FH024-focus_in_effect_without_guardFocus in effect without guard
.focus() called at the top level of a useEffect body without a conditional guard: clobbers user focus on every effect run
FH025-incomplete_callback_depsIncomplete callback deps
useCallback or useMemo with a dependency array that omits state or props referenced in the callback body: stale values when deps change
FH026-hardcoded_jsx_idHardcoded jsx id
JSX element with hardcoded id='stringLiteral': collides when the component renders multiple instances. Should use useId() or accept an id prop
Infrastructure
2 checksIF001-linter_configurationLinter configuration
Proper linter configuration (Clippy/Ruff) with complexity checking
IF002-version_consistencyVersion consistency
Version strings out of sync across config files (Cargo.toml workspace members, pyproject.toml/setup.cfg/__version__, package.json monorepo)
Performance
3 checksPF001-wasteful_roundtripWasteful roundtrip
Transform-then-inverse patterns that waste CPU and memory (format! then slice, str then int)
PF002-inline_regex_compilationInline regex compilation
Regex::new() with a static string literal inside a function body (compiled on every call)
PF003-inline_glob_compilationInline glob compilation
GlobSetBuilder::new() or GlobBuilder::new() inside a function body: glob compiled on every call instead of once
Resource Loading
1 checksRL001-module_level_openModule level open
Module-level open() calls with cwd-relative paths: breaks at import time when the process is not started from the project root
Security
1 checksSE001-security_practicesSecurity practices
Dangerous API scanner: unsafe Rust (with missing/vague SAFETY comment detection), eval/exec/pickle in Python, innerHTML/eval/child_process in JavaScript
Try Fettl
Run the checks where your code already lives.
The Free CLI stays local and requires no account. Pro adds ongoing commercial use and supported local agent hooks.