Rules Hub
Coding Rules Library
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Use SHA-256 instead of SHA-1 for hashing
Default to SHA-256 (or stronger) for any hash; never reach for the cryptographically broken SHA-1, even for non-security identifiers.
Bad example
| 1 | const hash = createHash('sha1').update(normalized).digest('hex').slice(0, 8); |
Explanation (EN)
SHA-1 is collision-broken. Using it signals weak hygiene, can fail security audits, and risks accidental reuse where collisions actually matter.
Objašnjenje (HR)
SHA-1 je probijen po pitanju kolizija. Njegovo koristenje signalizira losu higijenu, moze pasti na sigurnosnim revizijama i rizicira slucajnu ponovnu upotrebu tamo gdje kolizije stvarno znace.
Good example
| 1 | const hash = createHash('sha256').update(normalized).digest('hex').slice(0, 8); |
Explanation (EN)
SHA-256 is collision-resistant and the safe default; slicing the digest still gives a short, stable identifier.
Objašnjenje (HR)
SHA-256 je otporan na kolizije i siguran zadani izbor; rezanje digesta i dalje daje kratak, stabilan identifikator.
Exceptions / Tradeoffs (EN)
Only use SHA-1 when forced for interop with an external system that mandates it, and document why.
Iznimke / Tradeoffi (HR)
Koristite SHA-1 samo kada ste prisiljeni zbog interoperabilnosti s vanjskim sustavom koji ga zahtijeva, i dokumentirajte zasto.