The modules

Three binaries from the same package, and each one fails for a different reason. A formatting problem and a security hole are not fixed the same way, nor with the same urgency.

rebar-check

The formatting ruler. It tells you whether the repository has CI that actually reaches the verification it declares, tests, a formatter, a license with its NOTICE, a hook with the execute bit, and whether shadcn is real or just a folder imitating the convention.

$npx github:Navesz/rebar .

rules: 23
deterministic: 18
heuristic: 5

What it does not do.

It does not look at security and it does not run the application. A repository with a perfect score here can still hold a plaintext password — that is what the module next door is for.

rebar-security

The security ruler, distilled from sixteen Brazilian technical videos: 163 candidate flaws, each judged by three independent skeptics, 82 survived. The first three were picked by coverage per hour, not by their place in the list.

$npx -p github:Navesz/rebar rebar-security .

rules: 3
all deterministic: yes

What it does not do.

It does not check Broken Access Control, which is OWASP number 1. IDOR and per-object authorization were left out because the defense lives in middleware, a policy or RLS — two identical trees on disk get opposite verdicts. Saying so is more useful than pretending to check.

rebar-new

The generator. It emits a static Next app with the gate inside, commit hooks, CI on a Windows and Linux matrix, an MCP server, and a content schema that fails the build when the data is a plausible placeholder.

$npx github:Navesz/rebar novo my-site

preset: site

What it does not do.

One preset only, the site. App and API are blocked by declared non-scope until the site preset is used unmodified on two sites.

the gate

The sequence CI runs and that you run before it, in a single command. Every step of the gate is proven by mutation: the defect is planted, and the step is required to find it.

$npm run verify

steps: 16
proof cases: 57
levels: N0–N7

What it does not do.

It is not a new layer. What blocks is the hook on your machine, CI, and the ruleset on the server — the only level an agent cannot edit, because it is not a file.

PreviousUsage