Rules Hub
Code Ruleset
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Read env vars and constants once, not inside hot functions
Validate and reuse process-static configuration; do not assume process.env is immutable or use fallback secrets.
Bad example
| 1 | function sign(payload) { |
| 2 | const secret = process.env.TOKEN || 'fallback'; |
| 3 | const algorithm = 'HS256'; |
| 4 | return jwt.sign(payload, secret, { algorithm }); |
| 5 | } |
Explanation (EN)
Repeated parsing scatters a static configuration contract, and a fallback signing secret can silently weaken authentication.
Objašnjenje (HR)
Good example
| 1 | const secret = process.env.TOKEN; |
| 2 | if (!secret) throw new Error("TOKEN is required"); |
| 3 | const algorithm = "HS256"; |
| 4 | function sign(payload: object) { |
| 5 | return jwt.sign(payload, secret, { algorithm }); |
| 6 | } |
Explanation (EN)
Bootstrap rejects a missing required secret. This snapshot is appropriate only when configuration is intentionally static.
Objašnjenje (HR)
Notes (EN)
Validate intentionally process-static configuration at bootstrap and inject or reuse the parsed value in hot paths.
Exceptions / Tradeoffs (EN)
process.env is mutable. Tests, rotation and reloadable configuration may need a different lifecycle; do not freeze them at import time accidentally. Required signing secrets must never use a hardcoded fallback.