Skip to content
RuleRoster

Verified reference directory

Platform Rules

Check what an official platform source says, the exact scope of the rule, and when its supporting evidence was last verified.

Qualified public records

Only rules that pass every discovery gate.

Repository-stage records remain reachable only at their exact noindex URL and never appear in this directory.

4 verified rules

Cloudflare

Latest verification

  • Cloudflare d1 database size limit

    Cloudflare D1 Free databases have a stated maximum size of 500 MB per database; the specific enforcement action is not stated.

    Verified

  • Cloudflare kv key size limit

    Cloudflare Workers KV keys have a stated maximum size of 512 bytes on Free and Paid plans; the specific enforcement action is not stated.

    Verified

  • Cloudflare workers free daily request limit

    Cloudflare Workers Free accounts are limited to 100,000 requests per day, reset at midnight UTC; exceeding the limit returns Error 1027, with behavior determined by route fail mode.

    Verified

1 verified rules

crates.io

Latest verification

  • crates.io yanked-version resolution behavior

    Yanking a crates.io version prevents Cargo from selecting it during dependency resolution by default, but does not delete data, block direct downloads, or affect existing lock files. Resolution errors if no compatible versions remain.

    Verified

4 verified rules

Deno

Latest verification

  • Deno frozen lockfile dependency-change behavior

    Deno uses a lockfile by default to record exact dependency versions and integrity hashes. When `lock.frozen` is `true`, Deno errors if any dependency changes; default lockfile use is distinct from frozen mode, and the lockfile can be disabled explicitly with `"lock": false`.

    Verified

  • Deno local ESM import file-extension requirement

    For ECMAScript modules in Deno, local import specifiers must include the full file extension; it cannot be omitted. This rule is scoped to local ESM imports and does not assert requirements for package specifiers, URLs, CommonJS, import-map keys, or arbitrary API strings.

    Verified

  • Deno pack dirty Git-tree refusal

    By default, `deno pack` refuses to pack when the Git working tree has uncommitted changes so releases are reproducible from the commit hash. `--allow-dirty` is the explicit opt-out; this rule applies only to `deno pack`.

    Verified

  • Deno sensitive system I/O permissions

    Deno runs code in a secure sandbox. By default, most sensitive system I/O is denied and explicit read, write, network, environment, subprocess, system, FFI, or import permission is required; explicit deny flags take precedence over allow flags. Some I/O remains available in limited capacity by default, so this is not a claim that all I/O is denied. `--allow-all` disables the sandbox rather than preserving least privilege.

    Verified

5 verified rules

Docker Hub

Latest verification

  • Docker Hub abuse rate limit

    Docker Hub has a variable abuse limit in the order of thousands of requests per minute per IPv4 address or IPv6 /64 subnet and returns 429 Too Many Requests when exceeded.

    Verified

  • Docker Hub pull counting rules

    Docker Hub does not count version checks toward usage pricing; a normal image counts as 1 pull, while a multi-architecture image counts as 1 pull per architecture.

    Verified

3 verified rules

Homebrew

Latest verification

  • Homebrew GitHub tap repository prefix requirement

    For the one-argument `brew tap` form on GitHub, the repository must be named `homebrew-<repository>` while the `homebrew-` prefix is omitted from the command. The two-argument form with an explicit supported Git URL does not impose this naming convention.

    Verified

  • Homebrew non-official tap trust requirement

    Non-official Homebrew taps require explicit trust by default since Homebrew 6.0.0. Only commands that need to load an untrusted tap or item fail until relevant trust is granted; installing a fully qualified formula or cask trusts only that item, not the whole tap. The temporary opt-out is not recommended and is not a permanent exception.

    Verified

  • Homebrew supported formula version count limit

    Homebrew supports no more than five versions of a formula in `homebrew/core` at one time, including the main formula, unless they are popular. More than 1,000 installs over 90 days is an example, not a guaranteed entitlement; removals are intended to consider usage and support status rather than age.

    Verified

4 verified rules

Kubernetes

Latest verification

  • Kubernetes CronJob name length limit

    A Kubernetes CronJob name must be no longer than 52 characters because the controller appends 11 characters and Job names are limited to 63 characters.

    Verified

  • Kubernetes ResourceQuota violation response

    When a create or update request violates an enforced ResourceQuota constraint, Kubernetes rejects it with HTTP 403 Forbidden and a message explaining the violated constraint. A Deployment can be created even when creation of a Pod it manages later fails for quota.

    Verified

  • Kubernetes Secret size limit

    Kubernetes limits each individual Secret to 1 MiB; the specific enforcement action is not stated.

    Verified

4 verified rules

npm

Latest verification

  • npm granular access token count limit

    An npm account can have up to 1,000 granular access tokens. The reviewed source does not state an over-limit response or exception.

    Verified

  • npm granular token package and scope limit

    One granular access token can access up to 50 packages and scopes combined—packages, scopes, or a mixture totaling 50—and cannot exceed its user's permissions. The reviewed source does not state an over-limit response or exception.

    Verified

  • npm staged package approval with 2FA

    Before a staged package becomes publicly available, a maintainer must review and explicitly approve it with two-factor authentication. CLI and npmjs.com approvals prompt for 2FA, trusted-publishing submissions still require that approval, and staging submission itself does not require 2FA.

    Verified

  • npm unscoped package visibility

    Unscoped npm packages are always public. The reviewed source does not state an exception or enforcement action.

    Verified

1 verified rules

pnpm

Latest verification

  • pnpm frozen-lockfile install behavior

    When pnpm frozen-lockfile behavior is enabled, it does not generate a lockfile and installation fails if the lockfile is out of sync, needs an update, or is absent. The documented default is false outside CI and true in CI only when a lockfile is already present.

    Verified

3 verified rules

PyPI

Latest verification

  • PyPI yanked release selection

    PyPI currently yanks entire releases, not individual files. Installers normally ignore a yanked release unless it is the only release matching a `==` or `===` version specifier.

    Verified