rules-vitest

RISK: eval() inside vi.fn()/vi.mock() executes arbitrary code strings — if the mock is seeded from any external data it becomes a code-injection vector. FIX: replace eval with explicit function implementations or use vi.importMock() with a static factory.

RISK: globalSetup scripts that spawn child processes can start live infrastructure (databases, servers) that outlive the test run and expose ports to the host. FIX: use in-process test doubles (vi.mock) or explicitly track and teardown any spawned processes in the corresponding globalTeardown.

RISK: Hardcoded credentials in test fixtures or spec files are committed to version control and can be scraped by automated secret-scanning bots (CWE-798). FIX: use placeholder strings like 'test-secret-placeholder' or read from process.env / a .env.test file that is gitignored.

RISK: Unit/integration tests that make real HTTP calls over the network are non-deterministic, slow, and may inadvertently mutate production data. FIX: intercept with msw (Mock Service Worker) or vi.mock, or move these to a dedicated e2e suite gated behind an explicit environment flag.

ADVISORY: A 0% coverage threshold in vitest configuration provides no quality gate — CI will pass regardless of how little code is covered. Set meaningful thresholds (e.g. lines: 80) so regressions in coverage cause a failed build.

If mockReset is false, mocked modules might leak state between tests. Ensure tests do not have cross-dependencies due to shared mock state.

A very large testTimeout is detected. This could indicate inefficient tests or tests that are prone to hanging (e.g. unclosed connections, infinite loops).