Documentation
Scanner rules
Scanner reports canonical CERBI rule families across local, JSON, SARIF, Markdown, HTML, and CI output. The current engine also keeps compatibility detections from earlier rule implementations.
Current detection families
| Rule | Category | What it identifies |
|---|---|---|
CERBI001 | Sensitive data | Sensitive data appears in a log message or structured field. |
CERBI002 | Credential-like data | A secret-like token, password, API key, JWT, connection string, or credential appears in a logging path. |
CERBI003 | Structured-field governance | Structured fields are checked against policy allow/disallow rules; compatibility checks also cover required-field gaps. |
CERBI004 | Cardinality and object logging | High-cardinality fields are surfaced; compatibility checks also identify risky object destructuring. |
CERBI005 | Debug, dynamic, and payload logging | Debug/trace or dynamic logging is surfaced; compatibility checks also identify raw body or payload logging. |
CERBI006 | Exception and serialized state | Exception or object-state exposure is surfaced; compatibility checks also cover dynamic-template or serialized logging. |
CERBI007 | Governance relaxation | Intentional governance-relaxation or bypass patterns are surfaced for review when enabled by the active profile. |
Canonical IDs and compatibility checks
CERBI-003 to the canonical form CERBI003. Some compatibility detectors intentionally remain under the CERBI003-CERBI006 families, so the finding's rule name explains the specific condition that fired.Built-in defaults and policy overrides
Scanner can run with built-in defaults, or teams can supply a policy file to disable a rule family, override its severity, control allowed and disallowed structured fields, and add organization-specific sensitive-field patterns.
See Policy & config for the supported policy keys and suppression behavior.
Static analysis, not runtime inspection
Finding contract
Findings carry a rule ID, rule name, severity, confidence, source location when available, explanation, remediation guidance, and logger/framework context. The same language-neutral contract is used across supported C#, Go, Java, Node/TypeScript, and Python scanners.
Use JSON or SARIF output when another tool needs to consume findings programmatically.