Rubric packs

Rubrics are short, strict review questions. One LLM call returns lanes, findings and a verdict per criterion.

Built-in packs

security (on by default)

id	severity	raises to	question
sec.no-secrets	high	block	Does the change avoid adding real credentials, tokens or private keys?
sec.no-exfiltration	high	block	Does it avoid sending user, cookie, storage or environment data to unexpected external hosts?
sec.no-unsafe-exec	high	review	Does it avoid eval/new Function/shell execution of untrusted input, and piping remote scripts into a shell?
sec.input-handling	medium	–	Is untrusted input validated or escaped (no innerHTML/XSS sinks)?

correctness (on by default)

id	severity	scoring	question
cor.logic	high	pass/fail	Is the changed logic plausibly correct with no obvious bugs?
cor.errors	medium	pass/fail	Are errors handled instead of silently swallowed where it matters?
cor.tests	low	1–5	Is new or changed behaviour covered by tests?

maintainability (opt-in)

id	severity	scoring	question
mnt.readable	low	1–5	Is the code readable, with no dead or debug code left behind?
mnt.scoped	low	pass/fail	Is the change focused on one purpose?

When a rubric changes the lane

Only a failed high-severity criterion raises the lane, to its raise_to (default review), and only when the model quotes evidence that actually appears in the diff. Everything else is reported in the comment and as line comments, without changing the lane.

Custom criteria

rubrics:
  packs: [security, correctness, maintainability]
  custom:
    - id: team.no-console
      question: Does the change avoid leaving console.log calls in production code?
      severity: low
    - id: team.migrations-reversible
      question: Does every new database migration include a down/rollback step?
      severity: high
      raise_to: review

Fields: id (letters, digits, ., _, -), question, severity (low | medium | high, default medium), scoring (pass_fail | 1-5), raise_to (review | block).

Rubrics are part of .mergejudge.yml on your main branch, so they change only through a reviewed PR. See How it works.