Rules Reference

Detects assets served without compression (gzip/brotli). Uncompressed transfers waste bandwidth and increase energy consumption.

Database query inside a loop. Each iteration hits the database separately instead of batching. Use JOINs, eager loading, or batch queries.

Query without LIMIT or pagination. As data grows, unbounded queries fetch increasingly large result sets, consuming memory and CPU.

Repeated polling via setInterval/setTimeout or sleep loops. Consider WebSockets, Server-Sent Events, or push notifications instead.

Expensive computation repeated in a loop without caching. Memoize or hoist invariant calculations outside the loop.

Heavy module loaded eagerly at startup when it may not be needed. Consider lazy/deferred loading to reduce cold start energy.

Potential memory leak from unclosed resources, accumulating event listeners, or growing data structures without bounds.

Object allocation inside a hot loop. Creates GC pressure. Pre-allocate or reuse objects where possible.

Synchronous I/O or heavy computation on the main/UI thread. Move to a worker, async call, or background thread.

Development-only code or dependencies detected in production context. Debug logging, dev servers, and test fixtures waste resources in production.

Docker image uses a large base image (e.g. ubuntu, node) when a slim or alpine alternative exists. Smaller images transfer and start faster.

Dockerfile without multi-stage build. Build tools and intermediate artifacts end up in the final image, increasing size and attack surface.

Cloud region hardcoded in source. This prevents carbon-aware scheduling that routes workloads to regions with cleaner grids.

Dependency significantly larger than lighter alternatives that provide the same functionality. Suggests replacements with size savings.

Multiple packages providing overlapping functionality. Consolidate to a single package to reduce install size and maintenance burden.

Development-only dependencies listed in production dependencies. Move to devDependencies / dev group to exclude from production installs.

Frontend bundle includes large packages that could be tree-shaken, code-split, or replaced with smaller alternatives.

Dependency is deprecated or unmaintained. May have unpatched vulnerabilities and often has better-maintained alternatives.

A direct dependency pulls in a deep chain of transitive dependencies, dramatically increasing total install size.