Skip to main content

Code Quality (non-security)

Maintainability signals such as high cognitive complexity and deeply nested control flow. They are reported because they correlate with bugs, not because they are a security risk, and they sit in their own bucket so they do not inflate the OWASP rollup.

What Vulkro detects​

The complexity analyzer (security::complexity) scores every parseable function with the cognitive-complexity metric and reports Medium or High findings above the configured thresholds. These findings belong to no OWASP category.

References​

  • No OWASP or CWE mapping: this category is not a security weakness.

See also: Confidence model.

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.

Last updated on