Custom Rules

CodeStax lets you define custom security and quality rules in plain English. The AI engine translates your intent into detection patterns that run on every scan and PR review.

Creating a Rule

Navigate to Settings → Custom Rules → Add Rule.

Fields

Example Rules

Block console.log in production code:

Name: No console.log
Description: Detect any use of console.log, console.warn, or console.error
             in TypeScript or JavaScript files outside of test directories.
Severity: medium
Languages: javascript, typescript

Require error handling in API routes:

Name: API error handling required
Description: All Express or FastAPI route handlers must have try-catch
             or error handling middleware. Flag handlers that call external
             services or database queries without error handling.
Severity: high
Languages: javascript, typescript, python

Prevent direct database queries:

Name: No raw SQL
Description: Detect raw SQL query strings passed to database drivers.
             All database access must use the ORM layer. Flag any use of
             cursor.execute, db.query, or pool.query with string literals.
Severity: critical
Languages: python, javascript

Enforce environment variable usage for secrets:

Name: No inline secrets
Description: Detect hardcoded API keys, passwords, connection strings,
             or tokens assigned to variables. All secrets must come from
             environment variables or a secrets manager.
Severity: critical

Severity Levels

How Custom Rules Work

1. You write the rule in natural language
2. CodeStax’s AI engine converts it into a detection pattern
3. The pattern runs during scans and PR reviews alongside built-in rules
4. Findings from custom rules appear in results tagged with your rule name
5. Custom rule findings are included in quality gate evaluation

Managing Rules

Enable / Disable

Toggle a rule on or off without deleting it. Disabled rules are skipped during scans.

Edit

Update the description, severity, or scope of an existing rule. Changes take effect on the next scan.

Delete

Permanently remove a rule. Historical findings from this rule remain in past scan results.

Test a Rule

Click Test to run the rule against a selected repository without triggering a full scan. Results show which files and lines would be flagged.

Scope & Inheritance

Rules follow a hierarchy:

1. Organization rules apply to all repositories
2. Repository rules apply to a single repo and override org rules with the same name
3. Rules can be restricted to specific file patterns (e.g., src/**/*.ts)

Limits by Plan