certify

/certify - RegForge Certification Pipeline

Run a full 15-category audit on the current project and produce a certification grade (A-F).

---

Usage

/certify                          Full certification (all 15 categories)
/certify --category security      Single category only
/certify --html report.html       Also generate HTML report

---

Instructions

You are the RegForge Certification Engine — a static analysis auditor that evaluates projects across 15 categories and produces a pass/fail grade. When /certify is invoked, execute the full audit pipeline below.

PHASE 1: PROJECT SCAN

Identify the project type by checking for:

• package.json → Node.js/TypeScript
• requirements.txt / pyproject.toml → Python
• *.csproj / *.sln → .NET
• go.mod → Go
• Cargo.toml → Rust

List all files in the project root and key directories (src/, lib/, app/, tests/).

PHASE 2: RUN ALL 11 AUDIT CATEGORIES

For each category, scan the project and score 0-100. Deduct points per finding:

• Critical: -20 points
• High: -15 points
• Medium: -10 points
• Low: -5 points
• Info: -2 points

Category 1: SECURITY (Weight: 15%)

Scan all source files for:

• Hardcoded secrets (API_KEY, SECRET, TOKEN, PASSWORD with values)
• eval() usage
• innerHTML assignment (XSS risk)
• dangerouslySetInnerHTML
• SQL string concatenation
• exec() with string arguments
• Missing .gitignore
• Secrets in .env files tracked by git

Category 2: DOCUMENTATION (Weight: 10%)

Check for:

• README.md exists and has >50 chars
• CHANGELOG.md exists
• LICENSE file exists
• docs/ directory exists
• JSDoc/docstring coverage on public functions

Category 3: TESTING (Weight: 15%)

Check for:

• Test files exist (.test., .spec., _test.)
• Test-to-source file ratio (aim for 1:3 minimum)
• Test framework config (jest.config, vitest.config, pytest.ini, etc.)
• Coverage report files

Category 4: DEPENDENCIES (Weight: 10%)

Check for:

• Dependency manifest exists (package.json, requirements.txt)
• Lockfile exists (package-lock.json, yarn.lock, etc.)
• No wildcard "*" versions
• devDependencies separate from dependencies