Design / vibe coding

Code

FAM-CODE-DESIGN

Status

beta — code maturity

Availability

partial — whether it is offerable

Ingest

pull — how a target enters

Rules of Engagement

Not required

Kind

Family (a selectable assessment)

Whether the architecture itself violates a security invariant even when every individual line is correct.

It reasons over the call / dependency / module graph rather than line patterns, and each candidate carries structural evidence plus a concrete security implication — not a “smell”. It promotes only the high-severity structural classes it can substantiate from the graph.

Absence of a defect is never reported as “clean architecture”: it is the limit of what the graph can prove, so the honest verdict is UNKNOWN rather than CLEAN.

A component that concentrates privilege and is reachable from an untrusted boundary with a fail-open check is flagged with the structural path that makes it dangerous, not merely because the code “looks risky”.