Rules that now reach the code itself: the EU Cyber Resilience Act, SBOM and advisory formats, PCI DSS script controls and shorter certificate lifetimes. The linters run in your editor or CI and never upload your repository.
The checks
Oracle JDK License Gate
Finds the Java lines in your build that Oracle now bills for, and the free line that replaces each one
Open it · 92 installs on the VS Code Marketplace
Firmware Release Gate for sdkconfig and prj.conf
Finds the build-config lines that ship an ESP-IDF or Zephyr device with secure boot off, a debug port open, unsigned images or plaintext OTA.
Open it · 12 installs on the VS Code Marketplace
SBOM Field Check for CRA 2026
Names every missing field in your CycloneDX or SPDX SBOM against BSI TR-03183-2 and the CISA 2026 minimum elements. 34 rules. Runs offline.
AI Model License Lint
Reads the open-weight model IDs in your code and names the licence clause that binds you - 22 rules, 17 findings on a 33-line fixture
TLS Cert Lifetime Lint - SC-081v3 renewal check
Finds the 12 settings that break when public TLS certificates fall to 100 days on 2027-03-15: openssl -days, Terraform, cert-manager, late expiry alerts, HPKP, TLS 1.0/1.1, SHA-1, RSA-1024.
Firestore Rules Guard
Audits firestore.rules and storage.rules for public access, expired test-mode dates and missing owner checks — 13 rules, line by line, before you deploy.
SQL Card Data Lint (PCI DSS Req 3)
Names every column, index, view and seed row in a .sql migration that stores card data, with its PCI DSS Requirement 3 rule id
License Flip Audit - BUSL/SSPL/AGPL in your deps
Finds the dependencies whose licence changed under you - Terraform 1.6+ BUSL, Redis 7.4+ SSPL, Bitnami's August 2025 move, Elastic 7.11 - and names the exact version where each flip happened.
PCI Payment Page Script Audit: requirement 6.4.3 and 11.6.1 on your checkout markup
PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 have been mandatory since 2025-03-31, and the PCI SSC revised FAQ 1331 on 2026-08-04 so a QSA agreement alone no longer marks them not applicable. This reads a checkout page and names every script that has no authorization method, no integrity method and no inventory row.
Python Log Leak Lint: PCI DSS Card Data
Finds card numbers, CVV, track data, PINs, passwords and auth headers in Python log, print and raise calls, with 10 rules
Crypto Export Notice Lint (EAR 742.15)
Ten checks on the export paragraph of a repository that ships encryption
Cybersecurity Container Audit — NIST SP 800-190
Reads a Dockerfile or compose file and names the hardening controls it fails, with the NIST SP 800-171 requirement each one puts at risk.
Webfont License Audit
The 12 licence questions a foundry audit letter asks, run against your CSS
RED Cybersecurity DoC Lint (EN 18031)
Checks an EU declaration of conformity for radio equipment against Delegated Regulation (EU) 2022/30 and the EN 18031:2024 citations
CRA Annex II User Docs Lint
19 rules over the user documentation that ships with your product: support-period end date, vulnerability reporting contact, EU declaration of conformity address, secure decommissioning.
…and 13 more in the full list.
How they run
Every check runs on your machine — in the editor, the browser or CI — and your files are not uploaded. Each tool is free for the file or case in front of you; the paid part is a one-time licence key, and a team key opens every linter for five seats and CI.
The full list
All 28, with install links for VS Code, Chrome, Edge, Firefox, npm and Docker: https://getreadystack.com/collections/software-security-supply-chain?ref=devto
Top comments (0)