Configuration

CodeGuard reads codeguard.config.json from the project root. Unknown top-level keys and unknown rule IDs are validation errors.

{
  "language": "auto",
  "rules": {
    "typescript": true,
    "javascript": true,
    "security": {
      "SEC001": true,
      "SEC002": true,
      "SEC003": true,
      "SEC004": true,
      "SEC005": true
    },
    "architecture": {
      "ARCH001": true,
      "ARCH002": true
    }
  },
  "ignore": ["generated", "fixtures/**"]
}

Settings

• language: auto, typescript, or javascript. The field is retained for compatibility; analyzer enablement is controlled under rules.
• rules.typescript and rules.javascript: booleans. Both default to true.
• rules.security and rules.architecture: booleans or maps of rule ID to boolean. Both default to false; unspecified rules in a map are disabled. Boolean true enables all rules in that analyzer.
• ignore: project-relative names or glob patterns excluded from the scan.

Rule IDs

ID	Analyzer	Detection
SEC001	Security	Dynamic eval execution.
SEC002	Security	Function constructor use.
SEC003	Security	Dynamic command strings passed to selected child_process APIs.
SEC004	Security	Non-placeholder static strings assigned to credential-like names. Secret contents are omitted from findings.
SEC005	Security	String arguments to setTimeout or setInterval.
ARCH001	Architecture	Cycles among scanned local modules.
ARCH002	Architecture	Unresolved relative or configured alias imports.

Security rules are pattern checks, not proof that a vulnerability is exploitable. See Analyzers for limits.

Validation

Malformed JSON, wrong setting types, unknown keys, and unsupported rule IDs cause CLI exit code 2. Correct the indicated setting and rerun the command. codeguard init (or the built local executable) creates a default file only when none exists.