Skip to main content

Available Tags

Complete reference of all tags available for categorizing rules in diffray.

Tags help organize rules, filter findings in reports, and group related checks. When writing custom rules, use tags from this list for consistency.

Tag Usage​

rules:
  - id: my_custom_rule
    # ... other fields
    tags:
      - security
      - typescript
      - owasp

Most Used Tags​

These are the most frequently used tags across all default rules:

TagUsage CountDescription
bugs308Bug detection and prevention
typescript296TypeScript-specific rules
maintainability275Code maintainability patterns
security237Security vulnerabilities and best practices
performance235Performance optimization
javascript234JavaScript-specific rules
python171Python-specific rules
readability157Code readability and clarity
error-handling141Exception and error management
java136Java-specific rules
style-conventions131Naming and style conventions
csharp128C# and .NET rules
architecture107Architectural patterns and design
quality95General code quality
go95Go language rules
ruby92Ruby and Rails rules
database79Database and SQL patterns
best-practices79Industry best practices
testing78Testing and test quality
php77PHP-specific rules

Tags by Category​

Language-Specific Tags​

Frontend Languages​

TagDescription
typescriptTypeScript code patterns
javascriptJavaScript code patterns
reactReact and JSX patterns
vueVue.js patterns
svelteSvelte patterns
angularAngular patterns
nextjsNext.js specific rules
nuxtNuxt.js specific rules
jsxJSX syntax rules
tsxTSX syntax rules
htmlHTML markup rules
cssCSS styling rules
scssSCSS/Sass rules

Backend Languages​

TagDescription
pythonPython code patterns
javaJava code patterns
goGo language patterns
rubyRuby code patterns
phpPHP code patterns
rustRust code patterns
kotlinKotlin code patterns
swiftSwift code patterns
csharpC# and .NET patterns
nodejsNode.js specific patterns
scalaScala code patterns
cppC++ code patterns

Database & ORM​

TagDescription
sqlSQL query patterns
databaseGeneral database patterns
postgresqlPostgreSQL specific
mysqlMySQL specific
ormORM usage patterns
prismaPrisma ORM rules
typeormTypeORM rules
sequelizeSequelize ORM rules
activerecordActiveRecord (Rails) rules
hibernateHibernate (Java) rules

Framework Tags​

TagDescription
react-patternsReact design patterns
hooksReact hooks patterns
state-managementState management libraries
reduxRedux patterns
expressExpress.js patterns
fastapiFastAPI patterns
djangoDjango patterns
railsRuby on Rails patterns
springSpring Framework patterns
laravelLaravel (PHP) patterns
flaskFlask patterns
nestjsNestJS patterns

Stack Tags​

Use these to target rules for specific tech stacks:

TagDescription
stack-pythonPython stack rules
stack-nodejsNode.js stack rules
stack-reactReact stack rules
stack-vueVue.js stack rules
stack-nextjsNext.js stack rules
stack-phpPHP stack rules
stack-flutterFlutter/Dart stack rules
stack-dartDart stack rules

Security Tags​

Core Security​

TagDescription
securityGeneral security issues
owaspOWASP guidelines
owasp-top10OWASP Top 10 vulnerabilities
owasp-a01OWASP A01: Broken Access Control
owasp-a03OWASP A03: Injection
owasp-a07OWASP A07: Auth Failures
authenticationAuthentication issues
authorizationAuthorization issues
access-controlAccess control problems
encryptionEncryption usage
cryptographyCryptographic issues

Vulnerability Types​

TagDescription
injectionAll injection types
sql-injectionSQL injection vulnerabilities
command-injectionCommand injection
code-injectionCode injection
template-injectionTemplate injection (SSTI)
xssCross-site scripting
xss-preventionXSS prevention patterns
csrfCross-site request forgery
csrf-preventionCSRF prevention
ssrfServer-side request forgery
idorInsecure direct object reference
path-traversalPath traversal attacks
rceRemote code execution
open-redirectOpen redirect vulnerabilities

Secrets & Credentials​

TagDescription
secretsSecret detection
credentialsCredential exposure
secrets-credentialsCombined secrets/credentials
api-keysAPI key exposure
api-securityAPI security patterns
hardcoded-secretsHardcoded secrets

Session & Auth​

TagDescription
session-managementSession handling
session-securitySession security
session-fixationSession fixation attacks
authentication-bypassAuth bypass risks
least-privilegeLeast privilege principle
zero-trustZero trust patterns

Compliance Tags​

TagDescription
complianceGeneral compliance
compliance-gdprGDPR compliance
compliance-soc2SOC 2 compliance
compliance-soc2-essentialsSOC 2 essential controls
compliance-hipaaHIPAA compliance
compliance-pci-dssPCI DSS compliance
compliance-lgpdLGPD (Brazil) compliance
compliance-ccpaCCPA compliance
piiPersonal identifiable information
pii-protectionPII protection
privacyPrivacy concerns
privacy-piiPrivacy and PII
phiProtected health information
gdprGDPR specific
hipaaHIPAA specific
soc2SOC 2 specific
pci-dssPCI DSS specific

Code Quality Tags​

Quality Metrics​

TagDescription
qualityGeneral code quality
maintainabilityCode maintainability
readabilityCode readability
code-complexityCyclomatic complexity
complexityGeneral complexity
code-smellsCode smell patterns
code-smellSingle code smell
duplicationCode duplication
dead-codeUnused/dead code
technical-debtTechnical debt

Style & Conventions​

TagDescription
style-conventionsStyle conventions
style-consistencyStyle consistency
code-styleCode style rules
namingNaming issues
naming-conventionsNaming conventions
formattingCode formatting

Design Principles​

TagDescription
architectureArchitectural patterns
design-patternsDesign pattern usage
design-patternSingle design pattern
anti-patternAnti-pattern detection
solidSOLID principles
srpSingle responsibility
dryDon't repeat yourself
dry-principleDRY principle
refactoringRefactoring needed
modularityModule organization
encapsulationEncapsulation issues
dependency-injectionDI patterns

Architecture Tags​

TagDescription
clean-architectureClean architecture
layered-architectureLayered architecture
microservicesMicroservices patterns
monorepo-hygieneMonorepo best practices
api-designAPI design patterns

Performance Tags​

TagDescription
performanceGeneral performance
optimizationCode optimization
memory-leakMemory leak detection
memory-safetyMemory safety
memory-optimizationMemory optimization
memory-managementMemory management
resource-leakResource leak detection
resource-cleanupResource cleanup
resource-exhaustionResource exhaustion

Database Performance​

TagDescription
query-optimizationQuery optimization
n-plus-oneN+1 query problem
lazy-loadingLazy loading patterns
eager-loadingEager loading patterns
indexingDatabase indexing
cachingCaching patterns
caching-strategyCaching strategies

Frontend Performance​

TagDescription
bundle-sizeBundle size optimization
code-splittingCode splitting
compressionCompression usage

Concurrency​

TagDescription
concurrencyConcurrency issues
race-conditionRace conditions
deadlockDeadlock detection
threadingThreading issues
timeoutTimeout handling

Error Handling Tags​

TagDescription
error-handlingError handling patterns
exception-handlingException handling
null-safetyNull safety checks
null-pointerNull pointer issues
nil-safetyNil safety (Go/Ruby)
edge-casesEdge case handling
bounds-checkBounds checking
overflowOverflow detection
underflowUnderflow detection
runtime-errorRuntime error prevention
panicPanic handling (Go/Rust)
crashCrash prevention

Testing Tags​

TagDescription
testingGeneral testing
testing-qualityTest quality
test-qualityTest quality metrics
test-coverageTest coverage
unit-testingUnit test patterns
integration-testingIntegration tests
e2eEnd-to-end testing
end-to-endE2E testing
test-isolationTest isolation
flaky-testsFlaky test detection
mockingMocking patterns
fixturesTest fixtures
test-dataTest data management
brittlenessTest brittleness
determinismTest determinism
testabilityCode testability

Testing Frameworks​

TagDescription
jestJest patterns
mochaMocha patterns
vitestVitest patterns
cypressCypress patterns
playwrightPlaywright patterns
pytestPytest patterns

API Tags​

TagDescription
apiGeneral API patterns
api-designAPI design
api-documentationAPI documentation
api-securityAPI security
restREST API patterns
rest-apiREST API rules
graphqlGraphQL patterns
grpcgRPC patterns
httpHTTP patterns
http-clientHTTP client usage
http-headersHTTP headers
corsCORS configuration
webhooksWebhook patterns
rate-limitingRate limiting
status-codesHTTP status codes

Infrastructure & DevOps Tags​

TagDescription
infrastructureInfrastructure code
devopsDevOps patterns
ci-cdCI/CD pipelines
deploymentDeployment patterns
kubernetesKubernetes patterns
dockerDocker patterns
dockerfileDockerfile rules
container-docker-hygieneContainer best practices
awsAWS patterns
azureAzure patterns
gcpGCP patterns

Infrastructure as Code​

TagDescription
terraformTerraform patterns
infrastructure-as-codeIaC patterns
iacIaC abbreviation
infra-as-codeIaC patterns
cloudformationCloudFormation
aws-cdkAWS CDK patterns
pulumiPulumi patterns

CI/CD​

TagDescription
github-actionsGitHub Actions
gitlab-ciGitLab CI
jenkinsJenkins patterns

Observability Tags​

TagDescription
observabilityObservability patterns
loggingLogging patterns
debuggingDebug code detection
tracingDistributed tracing
metricsMetrics collection
monitoringMonitoring patterns
auditAudit requirements
audit-loggingAudit logging
error-boundaryError boundaries

Accessibility Tags​

TagDescription
accessibilityGeneral accessibility
accessibility-a11yA11y patterns
a11yAccessibility shorthand
wcagWCAG compliance
wcag-1-4-1Specific WCAG criteria
keyboard-navigationKeyboard navigation
screen-readerScreen reader support
ariaARIA attributes
semantic-htmlSemantic HTML

Documentation Tags​

TagDescription
documentationDocumentation issues
docstringDocstring requirements
docstringsMultiple docstrings
jsdocJSDoc comments
javadocJavadoc comments
readmeREADME files
changelogChangelog maintenance
commentsCode comments
api-documentationAPI docs

Reliability & Resilience Tags​

TagDescription
reliabilityReliability patterns
resilienceResilience patterns
availabilityAvailability concerns
high-availabilityHA patterns
disaster-recoveryDR patterns
scalabilityScalability patterns
bulk-operationsBulk operation safety

Using Tags Effectively​

Filtering by Tags​

Tags can be used to filter rules in your .diffray/config.yaml:

# Only run security-related rules
rules:
  include_tags:
    - security
    - owasp
# Exclude certain tags from review
rules:
  exclude_tags:
    - style-conventions
    - documentation

Combining Tags​

Use multiple tags to precisely categorize rules:

rules:
  - id: py_sql_injection
    tags:
      - security          # Category
      - python           # Language
      - sql-injection    # Specific vulnerability
      - owasp-a03        # Compliance reference

Creating Custom Tags​

While using standard tags is recommended for consistency, you can create custom tags for project-specific needs:

rules:
  - id: internal_api_auth
    tags:
      - security
      - internal-api      # Custom tag
      - team-platform     # Custom tag

See also: