Ai Coding Rules Scaffold

ai-coding-rules-scaffold

[](https://github.com/Sting25/ai-coding-rules-scaffold/releases/latest) [](LICENSE)

**Two-layer enforcement (pre-commit hook + CI mirror) for small teams using AI agents** — catches debug leaks (`print`, `console.log`, `breakpoint`, `pdb`), unbounded file growth, nested-if hell, silenced exceptions, hardcoded secrets/tokens, and stray `.env` or private-key files before they merge. The same `lib/check-*` scripts run in both layers, so the hook and CI can't drift apart and `--no-verify` doesn't become the escape hatch.

Agent-agnostic: works with Cursor, Claude Code, Copilot, Cline, Aider, or no AI at all. Python/FastAPI + TypeScript/React are first-class, with deny-pattern coverage for Vue, Svelte, PHP, Go, Rust, Java, Kotlin, Ruby, and shell — see [Supported stacks](./TECHNICAL.md#supported-stacks) in TECHNICAL.md.

What it does

Drop-in guardrails that **block bad code from being committed or merged**. One `./install.sh` wires up a local pre-commit hook _and_ a matching CI check — both running the same scripts, so nothing slips through and `--no-verify` can't quietly become the team habit.

**What it stops, out of the box:**

• Debug leftovers — print(), console.log, debugger, breakpoint(), pdb/ipdb, dbg!, var_dump, and the per-language equivalents.
• Secrets & key files — AWS / GCP / GitHub / GitLab / OpenAI / Anthropic / Stripe / Slack / Docker tokens, private keys, URL-embedded credentials, and stray .env / *.pem / SSH-key files.
• Runaway file growth — a hard 500-line cap that forces a file to be split before it outgrows an agent's context window (the one rule never to raise).
• Insecure shortcuts — curl | bash, rm -rf /, chmod 777, disabled TLS verification (verify=False, curl -k, rejectUnauthorized: false), raw `innerHTM