Saltar al contenido
AKOS
Rules

Motor de reglas

Ejecutado por akos rules run <project-dir>. Fail-closed: los detectores en error no reportan pass silencioso.

0
Sin CRITICAL
Ejecución completa sin hallazgos bloqueantes. Puede haber findings de severidad menor: exit 0 no significa "sin hallazgos".
1
Error operativo
Uso incorrecto, setup incompleto o ejecución interrumpida.
2
Gate bloqueante
Ejecución completa con al menos un finding bloqueante.
ReglaCategoríaSeveridadExitPacks
a11y-input-no-label
Input with no detectable accessible name
Add a visible <label htmlFor="..."> tied to this input's id, or an aria-label/aria-labelledby, before shipping.
Accesibilidadwarning0wcag, html
a11y-select-no-label
Select with no detectable accessible name
Un <select> sin nombre accesible es peor que un input sin label: no hay placeholder que sirva de recurso y el control queda sin nombre en cualquier modalidad. Añade <label htmlFor="..."> o aria-label/aria-labelledby. Comparte el escaneo de etiquetas con el detector de inputs (schemas/a11y_dom_utils.py).
Accesibilidadwarning0wcag, html
destructive-migration-no-guard
Destructive migration statement with no guard
A DROP/TRUNCATE/DELETE without a guard (IF EXISTS, transacción con verificación previa o backup declarado) puede borrar datos en producción sin vuelta atrás. Añade el guard o documenta explícitamente por qué no aplica.
DevOpserror2deployment, postgres
migration-no-down-file
Migration has no paired rollback (down) file
Add the paired *.down.sql rollback file for this migration, matching the convention this project has already adopted elsewhere.
DevOpserror2deployment, postgres
pack-expired
Knowledge pack is past its review_after date
Re-verify this pack's principles and engineering rules against its sources are still accurate, then update last_reviewed (and review_after) in metadata.yaml.
Metawarning0
secret-in-source
Likely secret literal committed to source
Move the value to an environment variable or secret manager; never commit a real key. Rotate it if it has already been pushed.
Seguridaderror2owasp-top-10, supabase
service-role-in-client
service_role reference reachable from client-side code
service_role bypasses RLS entirely — it must only be referenced server-side (edge functions, API routes), gated by a caller-identity check. Move this reference behind a server boundary.
Seguridaderror2supabase, owasp-top-10
supabase-policy-too-permissive
RLS policy with an always-true USING or WITH CHECK clause
Scope the policy to the requester — USING (auth.uid() = user_id) or an equivalent ownership check.
Seguridaderror2supabase, owasp-top-10
supabase-rls-disabled
Table created without Row Level Security enabled
Add ALTER TABLE <table> ENABLE ROW LEVEL SECURITY in the same migration, right after CREATE TABLE and before any GRANTs.
Seguridadblocker2supabase, owasp-top-10