diff --git a/.changeset/cool-fans-fly.md b/.changeset/cool-fans-fly.md
new file mode 100644
index 000000000..782691d33
--- /dev/null
+++ b/.changeset/cool-fans-fly.md
@@ -0,0 +1,9 @@
+---
+"react-doctor": patch
+"@react-doctor/core": patch
+"oxlint-plugin-react-doctor": patch
+---
+
+Add a project-level security file scan: 36 first-class scan rules (leaked artifact secrets and env dumps, permissive Firebase/Supabase rules, raw SQL injection risk, unsafe webhook signature comparisons, committed private key material, public debug artifacts, …) ship in the oxlint plugin as ordinary `defineRule` modules that declare a project-level `scan` instead of AST visitors and run in `@react-doctor/core`'s environment-check phase over one bounded whole-tree walk — covering shipped bundles, dotenv/config files, SQL, and Firebase rules files that per-file linting never sees.
+
+Scan rules register metadata (id, title, severity, recommendation, `Security` category, `security-scan` tag) like any other rule but carry a project-level `scan` instead of AST visitors, so their findings flow through the standard diagnostic pipeline: per-rule and per-category severity overrides, inline disables, and output `surfaces` now apply to scan-rule diagnostics, and `react-doctor rules ignore-tag security-scan` (config `ignore.tags`) silences the whole family. They never appear in generated oxlint configs or the ESLint presets — they only execute through React Doctor's scan. A plain `--diff` / `--staged` scan skips them like the other whole-project checks, and the gate is now diff mode itself rather than the presence of include paths, so projects configuring `ignore.files` get the security scan too.
diff --git a/docs/HOW_TO_WRITE_A_RULE.md b/docs/HOW_TO_WRITE_A_RULE.md
index 989ee064e..a0b1659c7 100644
--- a/docs/HOW_TO_WRITE_A_RULE.md
+++ b/docs/HOW_TO_WRITE_A_RULE.md
@@ -243,6 +243,52 @@ function reducer(state, action) {
 
 Do not report this. The mutation path returns a new object. The `return state` path is a no-op.
 
+### Scan Rules (Project-Level)
+
+Most rules are per-file AST rules. Use a scan rule when the signal lives in the file system, not in source syntax:
+
+- The target files are never linted: shipped bundles, `.env` and config files, SQL, Firebase rules, repository secret files.
+- Path context (`public/`, build output, repository layout) matters more than code shape.
+- A content scan over a whole-tree file walk is the right precision.
+
+If the bug is a JavaScript/TypeScript code shape in linted source, write a normal AST rule instead.
+
+Scan rules live in `packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/` and declare a `scan` instead of `create` in their `defineRule` call. A real example (`firebase-permissive-rules.ts`):
+
+```ts
+export const firebasePermissiveRules = defineRule({
+  id: "firebase-permissive-rules",
+  title: "Permissive Firebase security rule",
+  severity: "error",
+  recommendation:
+    "Bind every read/write to `request.auth.uid`, immutable ownership, and tenant membership instead of treating sign-in as authorization.",
+  scan: scanByPattern({
+    shouldScan: (file) => isFirebaseRulesPath(file.relativePath),
+    pattern: /allow\s+(?:read|write|...)\s*:\s*if\s+(?:true|request\.auth\s*!=\s*null)/i,
+    message: "Firebase rules grant broad access to everyone or to any signed-in user.",
+  }),
+});
+```
+
+The scan contract:
+
+- `scan(file: ScannedFile): ScanFinding[]` replaces AST visitors.
+- `ScannedFile` carries `absolutePath`, `relativePath`, `content`, and `isGeneratedBundle`.
+- Each `ScanFinding` has `message`, `line`, `column`, and optional `severity`/`title`/`help` fields that override the rule's registry metadata per finding (for example, `public-debug-artifact` escalates to `"error"` when the artifact contains a secret value). Omit them to inherit the rule's `severity`/`title`/`recommendation`.
+
+Registration, tags, and severity flow identically to normal rules:
+
+- Codegen picks the rule up like any other: the `security-scan` bucket auto-applies the `Security` category and the `security-scan` tag.
+- `id:` and `severity:` must stay literal fields in the rule file — `scripts/generate-rule-registry.mjs` regex-parses them.
+- Capability gating, `disabledBy`, user severity overrides, inline disables, and `ignore.tags` apply the same as for AST rules.
+
+Execution is different: scan rules never appear in generated oxlint configs or ESLint presets. `@react-doctor/core`'s `check-security-scan` environment check runs every registered `scan` over one bounded whole-tree walk; diff/staged scans skip it like the other whole-project checks.
+
+To test:
+
+- Unit-test one rule with the in-memory harness in `packages/oxlint-plugin-react-doctor/src/test-utils/run-scan-rule.ts` (build a `ScannedFile`, assert the findings) in a co-located test file.
+- End-to-end coverage runs through `packages/core/tests/check-security-scan.test.ts` against fixture trees in `packages/core/tests/fixtures/check-security-scan/`.
+
 ### V1 Scope
 
 Do not mix adjacent rule ideas into v1.
diff --git a/packages/core/src/check-security-scan.ts b/packages/core/src/check-security-scan.ts
new file mode 100644
index 000000000..d79d80ceb
--- /dev/null
+++ b/packages/core/src/check-security-scan.ts
@@ -0,0 +1,60 @@
+import { REACT_DOCTOR_RULES } from "oxlint-plugin-react-doctor";
+import type { FileScan } from "oxlint-plugin-react-doctor";
+import { buildSecurityScanDiagnostic } from "./checks/security-scan/build-security-scan-diagnostic.js";
+import type { SecurityScanRuleEntry } from "./checks/security-scan/build-security-scan-diagnostic.js";
+import { collectSecurityScanFiles } from "./checks/security-scan/collect-security-scan-files.js";
+import { buildCapabilities, shouldEnableRule } from "./runners/oxlint/capabilities.js";
+import type { Diagnostic, ProjectInfo } from "./types/index.js";
+
+export interface CheckSecurityScanOptions {
+  readonly project?: ProjectInfo;
+  readonly ignoredTags?: ReadonlySet<string>;
+}
+
+interface EnabledScanRule {
+  readonly entry: SecurityScanRuleEntry;
+  readonly scan: FileScan;
+}
+
+// Project-level security scan check: registry rules carrying a
+// `scan` are excluded from the generated oxlint config and instead run here
+// over one bounded whole-tree walk (shipped artifacts, dotenv/config files,
+// SQL — paths lint never sees). Selection goes through the same
+// `shouldEnableRule` capability/tag gate as lint rules, so `--ignore-tag
+// security-scan` and `disabledBy` behave identically across both engines.
+export const checkSecurityScan = (
+  rootDirectory: string,
+  options: CheckSecurityScanOptions = {},
+): Diagnostic[] => {
+  const capabilities = options.project ? buildCapabilities(options.project) : new Set<string>();
+  const ignoredTags = options.ignoredTags ?? new Set<string>();
+
+  const enabledScanRules: EnabledScanRule[] = REACT_DOCTOR_RULES.flatMap((entry) => {
+    const rule = entry.rule;
+    const scan = rule.scan;
+    if (typeof scan !== "function") return [];
+    if (rule.defaultEnabled === false) return [];
+    if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledBy)) {
+      return [];
+    }
+    return [{ entry, scan }];
+  });
+  if (enabledScanRules.length === 0) return [];
+
+  const diagnostics: Diagnostic[] = [];
+  const seen = new Set<string>();
+
+  for (const file of collectSecurityScanFiles(rootDirectory)) {
+    for (const { entry, scan } of enabledScanRules) {
+      for (const finding of scan(file)) {
+        const diagnostic = buildSecurityScanDiagnostic(finding, entry, file.relativePath);
+        const key = `${diagnostic.rule}:${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column}:${diagnostic.message}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        diagnostics.push(diagnostic);
+      }
+    }
+  }
+
+  return diagnostics;
+};
diff --git a/packages/core/src/checks/security-scan/build-security-scan-diagnostic.ts b/packages/core/src/checks/security-scan/build-security-scan-diagnostic.ts
new file mode 100644
index 000000000..fe59b8077
--- /dev/null
+++ b/packages/core/src/checks/security-scan/build-security-scan-diagnostic.ts
@@ -0,0 +1,29 @@
+import type { ScanFinding, Rule } from "oxlint-plugin-react-doctor";
+import type { Diagnostic } from "../../types/index.js";
+
+export interface SecurityScanRuleEntry {
+  readonly id: string;
+  readonly rule: Pick<Rule, "severity" | "title" | "recommendation">;
+}
+
+// Shared shape for every security-scan diagnostic. Metadata is
+// single-sourced from the registry rule (plugin severity vocab `warn`
+// maps to core `warning`); a finding may override `severity`/`title`/
+// `help` for dynamic escalation (e.g. `public-debug-artifact` when the
+// artifact carries a live secret).
+export const buildSecurityScanDiagnostic = (
+  finding: ScanFinding,
+  entry: SecurityScanRuleEntry,
+  relativePath: string,
+): Diagnostic => ({
+  filePath: relativePath,
+  plugin: "react-doctor",
+  rule: entry.id,
+  severity: (finding.severity ?? entry.rule.severity) === "warn" ? "warning" : "error",
+  title: finding.title ?? entry.rule.title ?? entry.id,
+  message: finding.message,
+  help: finding.help ?? entry.rule.recommendation ?? "",
+  line: finding.line,
+  column: finding.column,
+  category: "Security",
+});
diff --git a/packages/core/src/checks/security-scan/collect-security-scan-files.ts b/packages/core/src/checks/security-scan/collect-security-scan-files.ts
new file mode 100644
index 000000000..b218a7304
--- /dev/null
+++ b/packages/core/src/checks/security-scan/collect-security-scan-files.ts
@@ -0,0 +1,114 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import {
+  classifySecurityScanFile,
+  shouldReadSecurityScanContent,
+} from "oxlint-plugin-react-doctor";
+import type { ScannedFile } from "oxlint-plugin-react-doctor";
+import { readDirectoryEntries } from "../../project-info/utils/read-directory-entries.js";
+import { isLargeMinifiedFile } from "../../utils/is-large-minified-file.js";
+import {
+  SECURITY_SCAN_MAX_BUNDLE_FILE_SIZE_BYTES,
+  SECURITY_SCAN_MAX_DIRECTORY_DEPTH,
+  SECURITY_SCAN_MAX_FILES,
+  SECURITY_SCAN_MAX_FILE_SIZE_BYTES,
+  SKIPPED_DIRECTORY_NAMES,
+} from "./constants.js";
+
+interface DirectoryStackEntry {
+  readonly absolutePath: string;
+  readonly depth: number;
+}
+
+interface SecurityScanCandidate {
+  readonly absolutePath: string;
+  readonly relativePath: string;
+  readonly isGeneratedBundleByName: boolean;
+}
+
+const readScannedFile = (candidate: SecurityScanCandidate): ScannedFile | null => {
+  let stat: fs.Stats;
+  try {
+    stat = fs.statSync(candidate.absolutePath);
+  } catch {
+    return null;
+  }
+  if (!stat.isFile()) return null;
+
+  const isGeneratedBundle =
+    candidate.isGeneratedBundleByName || isLargeMinifiedFile(candidate.absolutePath);
+  const maxSizeBytes = isGeneratedBundle
+    ? SECURITY_SCAN_MAX_BUNDLE_FILE_SIZE_BYTES
+    : SECURITY_SCAN_MAX_FILE_SIZE_BYTES;
+  if (stat.size > maxSizeBytes) return null;
+  if (!shouldReadSecurityScanContent(candidate.relativePath, isGeneratedBundle)) return null;
+
+  try {
+    return {
+      absolutePath: candidate.absolutePath,
+      relativePath: candidate.relativePath,
+      content: fs.readFileSync(candidate.absolutePath, "utf-8"),
+      isGeneratedBundle,
+    };
+  } catch {
+    return null;
+  }
+};
+
+// Bounded whole-tree walk feeding the security-scan rules: candidate paths
+// are bucketed priority → artifact → other by `classifySecurityScanFile`
+// so config/secret files and shipped browser artifacts survive the cap on
+// huge repositories. Only paths are collected up front; contents are read
+// lazily, one file per iteration (capped at SECURITY_SCAN_MAX_FILES
+// successful reads per bucket), so a caller that streams findings never
+// holds more than one file's content at a time.
+export function* collectSecurityScanFiles(
+  rootDirectory: string,
+): Generator<ScannedFile, void, void> {
+  const priorityCandidates: SecurityScanCandidate[] = [];
+  const artifactCandidates: SecurityScanCandidate[] = [];
+  const otherCandidates: SecurityScanCandidate[] = [];
+  const stack: DirectoryStackEntry[] = [{ absolutePath: rootDirectory, depth: 0 }];
+
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current === undefined) continue;
+    if (current.depth > SECURITY_SCAN_MAX_DIRECTORY_DEPTH) continue;
+
+    for (const entry of readDirectoryEntries(current.absolutePath)) {
+      const absolutePath = path.join(current.absolutePath, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIPPED_DIRECTORY_NAMES.has(entry.name)) {
+          stack.push({ absolutePath, depth: current.depth + 1 });
+        }
+        continue;
+      }
+
+      const relativePath = path.relative(rootDirectory, absolutePath).replaceAll("\\", "/");
+      const classification = classifySecurityScanFile(relativePath);
+      if (classification === null) continue;
+      const candidates =
+        classification.bucket === "priority"
+          ? priorityCandidates
+          : classification.bucket === "artifact"
+            ? artifactCandidates
+            : otherCandidates;
+      candidates.push({
+        absolutePath,
+        relativePath,
+        isGeneratedBundleByName: classification.isGeneratedBundleByName,
+      });
+    }
+  }
+
+  for (const candidates of [priorityCandidates, artifactCandidates, otherCandidates]) {
+    let yieldedCount = 0;
+    for (const candidate of candidates) {
+      if (yieldedCount >= SECURITY_SCAN_MAX_FILES) break;
+      const scannedFile = readScannedFile(candidate);
+      if (scannedFile === null) continue;
+      yieldedCount += 1;
+      yield scannedFile;
+    }
+  }
+}
diff --git a/packages/core/src/checks/security-scan/constants.ts b/packages/core/src/checks/security-scan/constants.ts
new file mode 100644
index 000000000..687b292aa
--- /dev/null
+++ b/packages/core/src/checks/security-scan/constants.ts
@@ -0,0 +1,13 @@
+export const SECURITY_SCAN_MAX_FILES = 2500;
+export const SECURITY_SCAN_MAX_FILE_SIZE_BYTES = 2 * 1024 * 1024;
+export const SECURITY_SCAN_MAX_BUNDLE_FILE_SIZE_BYTES = 8 * 1024 * 1024;
+export const SECURITY_SCAN_MAX_DIRECTORY_DEPTH = 8;
+
+export const SKIPPED_DIRECTORY_NAMES = new Set([
+  ".git",
+  ".turbo",
+  ".vercel",
+  "coverage",
+  "node_modules",
+  "tmp",
+]);
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index dddcc0855..d084d5e61 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -39,6 +39,7 @@ export * from "./check-pnpm-hardening.js";
 export * from "./check-react-native-project.js";
 export * from "./check-react-server-components-advisory.js";
 export * from "./check-reduced-motion.js";
+export * from "./check-security-scan.js";
 export * from "./check-supply-chain.js";
 export * from "./collect-ignore-patterns.js";
 export * from "./compute-diagnostic-delta.js";
diff --git a/packages/core/src/project-info/parse-tailwind-major-minor.ts b/packages/core/src/project-info/parse-tailwind-major-minor.ts
index 1f51745e1..5064b24f8 100644
--- a/packages/core/src/project-info/parse-tailwind-major-minor.ts
+++ b/packages/core/src/project-info/parse-tailwind-major-minor.ts
@@ -1,3 +1,5 @@
+import * as semver from "semver";
+
 // HACK: react-doctor reads the project's Tailwind version straight out
 // of package.json (the `tailwindcss` dep), which produces semver ranges
 // (`^3.4.1`, `~3.3.0`, `>=3 <5`, `4.x`, `latest`, etc.) — never a
@@ -10,6 +12,14 @@ interface TailwindMajorMinor {
   minor: number;
 }
 
+// Lower bound of a range (`>=3.4 <5` → 3.4.0), with `coerce` as the
+// fallback for non-range specs that still embed a version
+// (`npm:tailwindcss@^3.4.1`). Tags (`latest`, `next`) resolve to null.
+const parseLowerBoundVersion = (versionSpec: string): semver.SemVer | null =>
+  semver.validRange(versionSpec) !== null
+    ? semver.minVersion(versionSpec)
+    : semver.coerce(versionSpec);
+
 export const parseTailwindMajorMinor = (
   tailwindVersion: string | null | undefined,
 ): TailwindMajorMinor | null => {
@@ -17,20 +27,9 @@ export const parseTailwindMajorMinor = (
   const trimmed = tailwindVersion.trim();
   if (trimmed.length === 0) return null;
 
-  const majorMinorMatch = trimmed.match(/(\d+)\.(\d+)/);
-  if (majorMinorMatch) {
-    const major = Number.parseInt(majorMinorMatch[1], 10);
-    const minor = Number.parseInt(majorMinorMatch[2], 10);
-    if (!Number.isFinite(major) || major <= 0) return null;
-    if (!Number.isFinite(minor) || minor < 0) return null;
-    return { major, minor };
-  }
-
-  const majorOnlyMatch = trimmed.match(/(\d+)/);
-  if (!majorOnlyMatch) return null;
-  const major = Number.parseInt(majorOnlyMatch[1], 10);
-  if (!Number.isFinite(major) || major <= 0) return null;
-  return { major, minor: 0 };
+  const lowerBound = parseLowerBoundVersion(trimmed);
+  if (lowerBound === null || lowerBound.major <= 0) return null;
+  return { major: lowerBound.major, minor: lowerBound.minor };
 };
 
 export const isTailwindAtLeast = (
diff --git a/packages/core/src/run-inspect.ts b/packages/core/src/run-inspect.ts
index dcd8a22e4..6a159aff5 100644
--- a/packages/core/src/run-inspect.ts
+++ b/packages/core/src/run-inspect.ts
@@ -18,6 +18,7 @@ import { checkPnpmHardening } from "./check-pnpm-hardening.js";
 import { checkReactNativeProject } from "./check-react-native-project.js";
 import { checkReactServerComponentsAdvisory } from "./check-react-server-components-advisory.js";
 import { checkReducedMotion } from "./check-reduced-motion.js";
+import { checkSecurityScan } from "./check-security-scan.js";
 import { DEFAULT_SHOW_WARNINGS } from "./constants.js";
 import { highlighter } from "./highlighter.js";
 import { computeExplicitLintIncludePaths } from "./explicit-lint-include-paths.js";
@@ -221,7 +222,8 @@ const formatLintFailText = (
  *
  *   1. Config.resolve(directory) → Project.discover → Git metadata
  *   2. beforeLint hook (e.g. CLI renders the project-detection block)
- *   3. environment checks (reduced-motion + pnpm hardening)
+ *   3. environment checks (reduced-motion + pnpm hardening +
+ *      expo/react-native + security scan)
  *   4. Linter.run + DeadCode.run — forked as concurrent fibers so
  *      their wall-clock times overlap. Progress spinners stay
  *      sequential (lint first, then dead-code) for clean terminal
@@ -348,6 +350,7 @@ export const runInspect = <HooksR = never>(
           ...checkReactServerComponentsAdvisory(scanDirectory, project),
           ...checkExpoProject(scanDirectory, project),
           ...checkReactNativeProject(scanDirectory, project),
+          ...checkSecurityScan(scanDirectory, { project, ignoredTags: input.ignoredTags }),
         ];
     const envCollected = yield* Stream.runCollect(
       applyPerElementPipeline(Stream.fromIterable(environmentDiagnostics)),
diff --git a/packages/core/src/runners/oxlint/config.ts b/packages/core/src/runners/oxlint/config.ts
index be561e752..f9c23552b 100644
--- a/packages/core/src/runners/oxlint/config.ts
+++ b/packages/core/src/runners/oxlint/config.ts
@@ -115,6 +115,9 @@ export const createOxlintConfig = ({
   for (const registryEntry of REACT_DOCTOR_RULES) {
     const rule = reactDoctorPlugin.rules[registryEntry.id];
     if (!rule) continue;
+    // Scan rules run via core's check-security-scan environment
+    // check, not oxlint — registering them would only add dead visitors.
+    if (rule.scan !== undefined) continue;
     // `customRulesOnly` mirrors the historical behavior of the pre-port
     // builtin-react / builtin-a11y gate — skip everything ported 1:1
     // from upstream OXC plugins.
diff --git a/packages/core/tests/check-security-scan.test.ts b/packages/core/tests/check-security-scan.test.ts
new file mode 100644
index 000000000..a119cec91
--- /dev/null
+++ b/packages/core/tests/check-security-scan.test.ts
@@ -0,0 +1,805 @@
+import * as fs from "node:fs";
+import os from "node:os";
+import * as path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vite-plus/test";
+import { checkSecurityScan } from "@react-doctor/core";
+import type { Diagnostic } from "@react-doctor/core";
+import { REACT_DOCTOR_RULES } from "oxlint-plugin-react-doctor";
+
+const FIXTURES_DIRECTORY = path.resolve(import.meta.dirname, "fixtures", "check-security-scan");
+
+let temporaryRoot: string;
+
+const writeFile = (relativePath: string, content: string): void => {
+  const absolutePath = path.join(temporaryRoot, relativePath);
+  fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+  fs.writeFileSync(absolutePath, content);
+};
+
+const rulesOf = (diagnostics: ReadonlyArray<Diagnostic>): ReadonlySet<string> =>
+  new Set(diagnostics.map((diagnostic) => diagnostic.rule));
+
+const fixtureRules = (fixtureName: string): ReadonlySet<string> =>
+  rulesOf(checkSecurityScan(path.join(FIXTURES_DIRECTORY, fixtureName)));
+
+beforeEach(() => {
+  temporaryRoot = fs.mkdtempSync(path.join(os.tmpdir(), "react-doctor-security-scan-"));
+});
+
+afterEach(() => {
+  fs.rmSync(temporaryRoot, { recursive: true, force: true });
+});
+
+describe("checkSecurityScan", () => {
+  describe("Eva-grounded fixtures", () => {
+    it("flags an a16z-style full server env object shipped in a browser chunk", () => {
+      expect(fixtureRules("eva-a16z-env-bundle")).toEqual(
+        new Set(["artifact-env-leak", "artifact-secret-leak"]),
+      );
+    });
+
+    it("flags a GamerSafer-style public React env secret leak in source and build output", () => {
+      expect(fixtureRules("eva-gamersafer-public-env")).toEqual(
+        new Set(["artifact-env-leak", "artifact-secret-leak", "public-env-secret-name"]),
+      );
+    });
+
+    it("flags minified/generated widget bundles outside normal framework output folders", () => {
+      expect(fixtureRules("eva-minified-widget-bundle")).toEqual(new Set(["artifact-secret-leak"]));
+    });
+
+    it("flags Mintlify-style MDX SSR plus cross-tenant static asset exposure", () => {
+      expect(fixtureRules("eva-mintlify-docs-platform")).toEqual(
+        new Set(["active-static-asset", "mdx-ssr-execution-risk", "tenant-static-proxy-risk"]),
+      );
+    });
+
+    it("flags Arc and Chattr style Firebase authorization mistakes", () => {
+      expect(fixtureRules("eva-arc-chattr-firebase")).toEqual(
+        new Set([
+          "artifact-baas-authority-surface",
+          "firebase-client-owned-authz-field",
+          "firebase-permissive-rules",
+          "firebase-query-filter-as-auth",
+        ]),
+      );
+    });
+
+    it("flags a ToDesktop-style release pipeline where install scripts run near release secrets", () => {
+      expect(fixtureRules("eva-todesktop-release-pipeline")).toEqual(
+        new Set(["build-pipeline-secret-boundary"]),
+      );
+    });
+
+    it("flags an ASUS DriverHub-style localhost RPC and updater bridge", () => {
+      expect(fixtureRules("mrbruh-asus-local-rpc")).toEqual(
+        new Set(["local-rpc-native-bridge-risk", "plugin-update-trust-risk"]),
+      );
+    });
+
+    it("flags a Fooocus-style metadata eval import path", () => {
+      expect(fixtureRules("mrbruh-fooocus-metadata-eval")).toEqual(
+        new Set(["import-metadata-execution-risk"]),
+      );
+    });
+
+    it("flags a Lyra-style iframe redirect chain with prefilled privileged URL parameters", () => {
+      expect(fixtureRules("lyra-clickjacking-redirect-chain")).toEqual(
+        new Set(["clickjacking-redirect-risk", "url-prefilled-privileged-action"]),
+      );
+    });
+
+    it("flags a Lyra-style SVG-filtered iframe clickjacking primitive", () => {
+      expect(fixtureRules("lyra-svg-filter-clickjacking")).toEqual(
+        new Set(["svg-filter-clickjacking-risk"]),
+      );
+    });
+
+    it("flags a Supabase service-role key exposed through public client config", () => {
+      expect(fixtureRules("supabase-service-role-public-client")).toEqual(
+        new Set(["artifact-env-leak", "artifact-secret-leak", "public-env-secret-name"]),
+      );
+    });
+
+    it("flags common webhook and provider tokens shipped in browser bundles", () => {
+      expect(fixtureRules("broad-provider-token-bundle")).toEqual(
+        new Set(["artifact-secret-leak"]),
+      );
+    });
+
+    it("flags permissive Supabase RLS plus client-owned tenant and role columns", () => {
+      expect(fixtureRules("supabase-rls-client-owned-authz")).toEqual(
+        new Set(["supabase-client-owned-authz-field", "supabase-rls-policy-risk"]),
+      );
+    });
+
+    it("flags docs-domain credentialed CORS and broad first-party auth cookies", () => {
+      expect(fixtureRules("docs-cookie-cors-trust")).toEqual(new Set(["cors-cookie-trust-risk"]));
+    });
+
+    it("flags public debug logs and source maps that expose server env references", () => {
+      expect(fixtureRules("public-debug-sourcemap-leak")).toEqual(
+        new Set(["artifact-env-leak", "artifact-secret-leak", "public-debug-artifact"]),
+      );
+    });
+
+    it("flags checked-in private release key material and key-shaped CI variables", () => {
+      expect(fixtureRules("release-key-material-leak")).toEqual(new Set(["key-lifecycle-risk"]));
+    });
+
+    it("flags committed env, service-account, and npm auth credential files", () => {
+      expect(fixtureRules("repository-secret-files")).toEqual(
+        new Set(["key-lifecycle-risk", "repository-secret-file"]),
+      );
+    });
+
+    it("flags ported static matcher patterns for postMessage, redirect-following fetches, and dynamic HTML", () => {
+      expect(fixtureRules("ported-static-matcher-patterns")).toEqual(
+        new Set(["dangerous-html-sink", "postmessage-origin-risk", "untrusted-redirect-following"]),
+      );
+    });
+
+    it("keeps safe postMessage, manual redirect, and static HTML patterns quiet", () => {
+      expect(
+        checkSecurityScan(path.join(FIXTURES_DIRECTORY, "ported-static-matcher-safe-patterns")),
+      ).toEqual([]);
+    });
+
+    it("flags ported agent, MCP, SQL, NoSQL, and command execution matcher patterns", () => {
+      expect(fixtureRules("ported-agent-mcp-tool-risks")).toEqual(
+        new Set(["agent-tool-capability-risk", "mcp-tool-capability-risk"]),
+      );
+      expect(fixtureRules("ported-database-and-command-risks")).toEqual(
+        new Set(["command-execution-input-risk", "nosql-injection-risk", "raw-sql-injection-risk"]),
+      );
+    });
+
+    it("keeps safe agent tools and parameterized database calls quiet", () => {
+      expect(
+        checkSecurityScan(path.join(FIXTURES_DIRECTORY, "ported-agent-database-safe-patterns")),
+      ).toEqual([]);
+    });
+
+    it("flags ported path traversal, git URL injection, webhook signature, and crypto risks", () => {
+      expect(fixtureRules("ported-web-security-risks")).toEqual(
+        new Set([
+          "git-provider-url-injection-risk",
+          "insecure-crypto-risk",
+          "path-traversal-risk",
+          "webhook-signature-risk",
+        ]),
+      );
+    });
+
+    it("keeps safe path, git URL, webhook signature, and crypto patterns quiet", () => {
+      expect(
+        checkSecurityScan(path.join(FIXTURES_DIRECTORY, "ported-web-security-safe-patterns")),
+      ).toEqual([]);
+    });
+
+    it("keeps redacted env examples quiet", () => {
+      expect(
+        checkSecurityScan(path.join(FIXTURES_DIRECTORY, "repository-secret-examples")),
+      ).toEqual([]);
+    });
+
+    it("keeps public Supabase chat browser bundles quiet when they expose no authority fields", () => {
+      expect(
+        checkSecurityScan(path.join(FIXTURES_DIRECTORY, "real-supabase-chat-browser-bundle")),
+      ).toEqual([]);
+    });
+
+    it("keeps known browser-facing analytics, license, map, and search keys quiet", () => {
+      expect(checkSecurityScan(path.join(FIXTURES_DIRECTORY, "real-public-env-keys"))).toEqual([]);
+    });
+
+    it("keeps server-only Supabase service-role routes quiet", () => {
+      expect(
+        checkSecurityScan(path.join(FIXTURES_DIRECTORY, "real-server-service-role-route")),
+      ).toEqual([]);
+    });
+
+    it("keeps public-read private-write Supabase RLS policies quiet", () => {
+      expect(
+        checkSecurityScan(path.join(FIXTURES_DIRECTORY, "real-supabase-public-read-private-write")),
+      ).toEqual([]);
+    });
+
+    it("stays quiet on a hardened app with scoped rules and public-only browser config", () => {
+      expect(checkSecurityScan(path.join(FIXTURES_DIRECTORY, "safe-hardened-app"))).toEqual([]);
+    });
+  });
+
+  it("covers the P0-P2 P0-P2 security analyzer families", () => {
+    writeFile(
+      ".next/static/chunks/app.js",
+      `window.__ENV__ = { AWS_SECRET_ACCESS_KEY: "very-secret", AWS_ACCESS_KEY_ID: "AKIAABCDEFGHIJKLMNOP" };`,
+    );
+    writeFile("public/debug.log", "DATABASE_URL=postgres://user:pass@example.com/db\nstack trace");
+    writeFile("public/xss.svg", `<svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)" />`);
+    writeFile(
+      "firestore.rules",
+      `service cloud.firestore { match /databases/{database}/documents { match /{document=**} { allow read, write: if request.auth != null; } } }`,
+    );
+    writeFile(
+      "src/firebase-client.tsx",
+      `export const save = () => setDoc(ref, { creatorID: profile.id, role: "SuperAdmin" }); db.collection("sessions").where("userId", "==", userId);`,
+    );
+    writeFile(
+      "supabase/migrations/001.sql",
+      `alter table profiles disable row level security; create policy "open" on profiles using (true);`,
+    );
+    writeFile(
+      "src/supabase-client.ts",
+      `export const save = (supabase, ownerId) => supabase.from("docs").upsert({ ownerId, role: "admin" });`,
+    );
+    writeFile(
+      "package.json",
+      JSON.stringify({ scripts: { postinstall: "node scripts/postinstall.js" } }, null, 2),
+    );
+    writeFile(
+      ".github/workflows/release.yml",
+      `steps:\n  - run: pnpm install\n    env:\n      RELEASE_TOKEN: \${{ secrets.RELEASE_TOKEN }}\n`,
+    );
+    writeFile(
+      "app/api/static/[tenant]/route.ts",
+      `export const GET = async (_, { params }) => fetch(CDN + "/" + params.tenant + "/" + decodeURIComponent(params.path.join("/")));`,
+    );
+    // Untrusted-shaped source: rendering a project's own docs MDX is the
+    // benign default, so the rule keys on request/tenant-shaped input.
+    writeFile(
+      "src/render-mdx.ts",
+      `import { compileMDX } from "next-mdx-remote/rsc"; export const render = (req) => compileMDX({ source: req.body.markdown });`,
+    );
+    writeFile(
+      "src/local-bridge.ts",
+      `if (origin.includes("driverhub.asus.com")) new WebSocket("ws://127.0.0.1:53000/UpdateApp");`,
+    );
+    writeFile(
+      "src/share-dialog.tsx",
+      `const email = new URLSearchParams(location.search).get("userstoinvite"); const role = searchParams.get("role");`,
+    );
+    writeFile(
+      "src/redirect.ts",
+      `export const GET = (request) => redirect(request.nextUrl.searchParams.get("next"));`,
+    );
+    writeFile(
+      "src/import-metadata.ts",
+      `export const apply = (metadata) => eval(metadata.exifPreset);`,
+    );
+    writeFile(
+      "src/message-listener.ts",
+      `window.addEventListener("message", (event) => window.dispatchEvent(new CustomEvent("x", { detail: event.data })));`,
+    );
+    writeFile(
+      "app/api/preview/route.ts",
+      `export const POST = async (request) => { const { imageUrl } = await request.json(); return fetch(imageUrl); };`,
+    );
+    writeFile(
+      "src/remote-html.tsx",
+      `export const RemoteHtml = ({ html }) => <div dangerouslySetInnerHTML={{ __html: html }} />;`,
+    );
+    writeFile(
+      "src/agents/tools/run-command.ts",
+      `import { tool } from "ai"; import { execFile } from "node:child_process"; export const t = tool({ execute: async ({ command }) => execFile(command, []) });`,
+    );
+    writeFile(
+      "src/mcp/server.ts",
+      `import { McpServer } from "@modelcontextprotocol/sdk/server/index.js"; import { readFile } from "node:fs/promises"; const server = new McpServer({ name: "x", version: "1" }); server.tool("read_file", async ({ path }) => readFile(path, "utf-8"));`,
+    );
+    writeFile(
+      "src/raw-sql.ts",
+      "export const q = (prisma, id) => prisma.$queryRawUnsafe(`SELECT * FROM users WHERE id = '${id}'`);",
+    );
+    writeFile(
+      "src/nosql.ts",
+      "export const q = (collection, request) => collection.find(JSON.parse(request.body.filter));",
+    );
+    writeFile(
+      "app/api/files/route.ts",
+      `export const POST = async (request) => readFile(request.body.path, "utf-8");`,
+    );
+    // Request-shaped interpolation: bare `${owner}` parameters proved to be
+    // internal config in practice, so the rule keys on request property reads.
+    writeFile(
+      "src/github-import.ts",
+      "export const build = (req) => `https://api.github.com/repos/${req.query.owner}/${req.query.repo}`;",
+    );
+    writeFile(
+      "app/api/stripe/webhook/route.ts",
+      `export const POST = async (request) => { const event = await request.json(); return Response.json({ received: event.type }); };`,
+    );
+    writeFile("src/session-token.ts", `export const token = () => Math.random().toString(36);`);
+    // Not under `scripts/`: build-script paths are excluded from production
+    // source on purpose (see BUILD_SCRIPT_CONTEXT_PATTERN).
+    writeFile(
+      "backend/report.py",
+      "import os\ndef run(request):\n    os.system(f\"wkhtmltopdf {request.args['url']} /tmp/report.pdf\")\n",
+    );
+    writeFile(
+      "src/updater.ts",
+      `import { execFile } from "node:child_process"; export const update = (updateUrl) => execFile("installer", [updateUrl ?? "https://example.com/app.exe"]);`,
+    );
+    writeFile(
+      "secrets/signing-key.txt",
+      "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\n",
+    );
+    writeFile(
+      "src/cors.ts",
+      `headers.set("Access-Control-Allow-Credentials", "true"); headers.set("Access-Control-Allow-Origin", "https://docs.example.com"); res.setHeader("Set-Cookie", "session=abc; Domain=.example.com");`,
+    );
+    writeFile("next.config.js", `export default { images: { dangerouslyAllowSVG: true } };`);
+
+    const rules = rulesOf(checkSecurityScan(temporaryRoot));
+
+    expect(rules).toEqual(
+      new Set([
+        "active-static-asset",
+        "artifact-env-leak",
+        "artifact-secret-leak",
+        "build-pipeline-secret-boundary",
+        "clickjacking-redirect-risk",
+        "cors-cookie-trust-risk",
+        "firebase-client-owned-authz-field",
+        "firebase-permissive-rules",
+        "firebase-query-filter-as-auth",
+        "import-metadata-execution-risk",
+        "key-lifecycle-risk",
+        "local-rpc-native-bridge-risk",
+        "mdx-ssr-execution-risk",
+        "plugin-update-trust-risk",
+        "public-debug-artifact",
+        "supabase-client-owned-authz-field",
+        "supabase-rls-policy-risk",
+        "tenant-static-proxy-risk",
+        "postmessage-origin-risk",
+        "untrusted-redirect-following",
+        "dangerous-html-sink",
+        "url-prefilled-privileged-action",
+        "agent-tool-capability-risk",
+        "mcp-tool-capability-risk",
+        "raw-sql-injection-risk",
+        "nosql-injection-risk",
+        "command-execution-input-risk",
+        "path-traversal-risk",
+        "git-provider-url-injection-risk",
+        "webhook-signature-risk",
+        "insecure-crypto-risk",
+      ]),
+    );
+  });
+
+  it("stays quiet on public client keys, Firebase config alone, SVG images, and test keys", () => {
+    writeFile(
+      "public/app.js",
+      `window.config = { firebase: { apiKey: "AIzaSyPublicNotASecret", projectId: "demo" }, sentry: "https://abc@o1.ingest.sentry.io/2", stripe: "pk_live_1234567890" };`,
+    );
+    writeFile("src/logo.tsx", `export const Logo = () => <img src="/logo.svg" alt="" />;`);
+    writeFile(
+      "tests/fixtures/private-key.txt",
+      "-----BEGIN OPENSSH PRIVATE KEY-----\nfixture only\n",
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("adds Security metadata and source locations for direct pattern matches", () => {
+    writeFile(
+      "firestore.rules",
+      `rules_version = "2";\nservice cloud.firestore {\n  match /databases/{database}/documents {\n    allow read, write: if true;\n  }\n}\n`,
+    );
+
+    const diagnostics = checkSecurityScan(temporaryRoot);
+
+    expect(diagnostics).toHaveLength(1);
+    expect(diagnostics[0]).toMatchObject({
+      plugin: "react-doctor",
+      rule: "firebase-permissive-rules",
+      category: "Security",
+      severity: "error",
+      line: 4,
+      column: 5,
+    });
+  });
+
+  it("uses concrete locations for env leak shapes and public env secret names", () => {
+    writeFile(
+      "dist/assets/app.js.map",
+      `window.__ENV__ = {\n  DATABASE_URL: "postgres://user:pass@example.com/app"\n};`,
+    );
+    writeFile(".env", "NEXT_PUBLIC_SECRET_TOKEN=placeholder\n");
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          rule: "artifact-env-leak",
+          line: 2,
+          column: 3,
+        }),
+        expect.objectContaining({
+          rule: "repository-secret-file",
+          line: 1,
+          column: 1,
+        }),
+      ]),
+    );
+  });
+
+  it("uses concrete locations for package metadata secret values", () => {
+    writeFile("package.json", `{\n  "token": "ghp_abcdefghijklmnopqrstuvwxyz123456"\n}\n`);
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([
+      expect.objectContaining({
+        rule: "package-metadata-secret",
+        line: 2,
+        column: 13,
+      }),
+    ]);
+  });
+
+  it("reports postMessage handlers at the unsafe handler location", () => {
+    writeFile(
+      "src/message-listener.ts",
+      `window.addEventListener("message", (event) => {\n  if (event.origin !== "https://example.com") return;\n  window.dispatchEvent(new CustomEvent("safe", { detail: event.data }));\n});\nwindow.addEventListener("message", (event) => {\n  window.dispatchEvent(new CustomEvent("unsafe", { detail: event.data }));\n});\n`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([
+      expect.objectContaining({
+        rule: "postmessage-origin-risk",
+        line: 5,
+        column: 1,
+      }),
+    ]);
+  });
+
+  it("reports postMessage handlers that read data before checking origin", () => {
+    writeFile(
+      "src/message-order.ts",
+      `window.addEventListener("message", (event) => {\n  window.dispatchEvent(new CustomEvent("unsafe", { detail: event.data }));\n  if (event.origin !== "https://example.com") return;\n});\n`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([
+      expect.objectContaining({
+        rule: "postmessage-origin-risk",
+        line: 1,
+        column: 1,
+      }),
+    ]);
+  });
+
+  it("keeps unrelated redirect options quiet while scanning got shorthand calls", () => {
+    writeFile(
+      "app/api/config/route.ts",
+      `const defaultOptions = { redirect: "follow" };\nexport const GET = async () => fetch("https://example.com", defaultOptions);\n`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+
+    writeFile(
+      "app/api/proxy/route.ts",
+      `export const GET = async (request) => {\n  const targetUrl = request.nextUrl.searchParams.get("targetUrl");\n  return got.get(targetUrl);\n};\n`,
+    );
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain("untrusted-redirect-following");
+  });
+
+  it("does not treat server-only Next build output as a browser artifact", () => {
+    writeFile(
+      ".next/server/app/page.js",
+      `export const env = { AWS_SECRET_ACCESS_KEY: "server-only", AWS_ACCESS_KEY_ID: "AKIAABCDEFGHIJKLMNOP" };`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("does not treat ordinary package dist output as browser-shipped artifact output", () => {
+    writeFile(
+      "packages/api/dist/index.js",
+      `export const databaseUrl = process.env.DATABASE_URL ?? "postgres://api:password@db.internal.example.com/api";`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("still reports a real secret when a public key appears in the same browser bundle", () => {
+    writeFile(
+      "dist/assets/app.js",
+      `const publishable = "pk_live_1234567890"; const secret = "AKIAABCDEFGHIJKLMNOP";`,
+    );
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain("artifact-secret-leak");
+  });
+
+  it("discovers one-line minified bundles even without a generated bundle filename", () => {
+    const minifiedPrefix = `var bootstrap="${"a".repeat(21_000)}";`;
+    writeFile(
+      "packages/widget/client.js",
+      `${minifiedPrefix}var env={AWS_ACCESS_KEY_ID:"AKIAABCDEFGHIJKLMNOP"};window.Widget=env;`,
+    );
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain("artifact-secret-leak");
+  });
+
+  it("reports public env names that look secret-like in client source", () => {
+    writeFile("src/client.tsx", `export const token = process.env.NEXT_PUBLIC_SECRET_TOKEN;`);
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain("public-env-secret-name");
+  });
+
+  it("reports public env secret names at the suspicious name location", () => {
+    writeFile(
+      "src/client.tsx",
+      `export const analytics = process.env.NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN;\nexport const secret = process.env.NEXT_PUBLIC_SECRET_TOKEN;\n`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([
+      expect.objectContaining({
+        rule: "public-env-secret-name",
+        line: 2,
+        column: 35,
+      }),
+    ]);
+  });
+
+  it("does not report server-only public env probes as client secret exposure", () => {
+    writeFile(
+      "src/server/env.server.ts",
+      `export const token = process.env.NEXT_PUBLIC_SECRET_TOKEN;`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("keeps tenant CDN fetches in client code quiet", () => {
+    writeFile(
+      "src/components/avatar.tsx",
+      `export const Avatar = ({ org }) => <img src={cdn + "/" + org.slug + "/avatar.png"} />;`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("does not flag CI installs that disable lifecycle scripts before secrets are available", () => {
+    writeFile(
+      ".github/workflows/test.yml",
+      `steps:\n  - run: pnpm install --ignore-scripts\n    env:\n      RELEASE_TOKEN: \${{ secrets.RELEASE_TOKEN }}\n`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("reports source maps that expose server env names even without concrete values", () => {
+    writeFile(
+      "dist/assets/app.js.map",
+      JSON.stringify({
+        version: 3,
+        sourcesContent: [`export const secret = process.env.DATABASE_URL;`],
+      }),
+    );
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain("artifact-env-leak");
+  });
+
+  it("keeps ownership-bound Firebase and Supabase policies quiet", () => {
+    writeFile(
+      "firestore.rules",
+      `service cloud.firestore { match /databases/{database}/documents { match /users/{userId} { allow read, write: if request.auth.uid == userId; } } }`,
+    );
+    writeFile(
+      "supabase/migrations/002.sql",
+      `alter table profiles enable row level security; create policy "own profile" on profiles using (auth.uid() = user_id) with check (auth.uid() = user_id);`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("does not treat service_role mentions in SQL comments as an RLS bypass", () => {
+    writeFile(
+      "supabase/migrations/003_service_role_note.sql",
+      `alter table profiles enable row level security;\n-- service_role is intentionally not used in policies below\ncreate policy own_profile on profiles using (auth.uid() = user_id) with check (auth.uid() = user_id);\n`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("still scans high-priority SQL even when many artifact files exist first", () => {
+    for (let fileIndex = 0; fileIndex < 2600; fileIndex += 1) {
+      writeFile(`public/chunks/chunk-${fileIndex}.js`, `window.chunk${fileIndex} = ${fileIndex};`);
+    }
+    writeFile(
+      "supabase/migrations/999_open_write.sql",
+      `create policy "open writes" on documents for all using (true) with check (true);`,
+    );
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain("supabase-rls-policy-risk");
+  });
+
+  it("still scans source files when artifact files fill their own bucket", () => {
+    for (let fileIndex = 0; fileIndex < 2600; fileIndex += 1) {
+      writeFile(`public/chunks/chunk-${fileIndex}.js`, `window.chunk${fileIndex} = ${fileIndex};`);
+    }
+    writeFile("src/client.tsx", `export const token = process.env.NEXT_PUBLIC_SECRET_TOKEN;`);
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain("public-env-secret-name");
+  });
+
+  it("keeps public key blocks quiet while still flagging private key blocks", () => {
+    writeFile(
+      "keys/public.pem",
+      "-----BEGIN PUBLIC KEY-----\nnot-secret-public-material\n-----END PUBLIC KEY-----\n",
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+
+    writeFile(
+      "keys/private.pem",
+      "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQIBAAKCAQEA39k9udklHnmkU0GtTLpnYtKk1l5txYmUDcGI0bFd3HHOOLG\n-----END RSA PRIVATE KEY-----\n",
+    );
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain("key-lifecycle-risk");
+  });
+
+  it("reports executable SVG embeds but not regular SVG image tags", () => {
+    writeFile("src/icon.tsx", `export const Icon = () => <img src="/icon.svg" alt="" />;`);
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+
+    writeFile("src/embed.tsx", `export const Embed = () => <object data="/diagram.svg" />;`);
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain("active-static-asset");
+  });
+
+  it("keeps exact-origin local bridge checks quiet", () => {
+    writeFile(
+      "src/local-bridge.ts",
+      `if (origin === "https://driverhub.asus.com") new WebSocket("ws://127.0.0.1:53000/status");`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("keeps docs examples out of source-only scanners", () => {
+    writeFile(
+      "README.md",
+      `Install the plugin with npm, then render examples with dangerouslySetInnerHTML in docs.`,
+    );
+    writeFile(
+      "docs/security.md",
+      `window.addEventListener("message", (event) => console.log(event.data)); localhost update notes.`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("keeps documentation sample keys quiet", () => {
+    writeFile(
+      "README.md",
+      "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\n",
+    );
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).not.toContain("key-lifecycle-risk");
+  });
+
+  it("keeps generated source examples quiet", () => {
+    writeFile(
+      "src/generated/icons.ts",
+      `// @generated\nexport const icons = ["javascript", "python", "zip", "svg", "import"];`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("still scans top-level public scripts as browser source", () => {
+    writeFile(
+      "public/widget.js",
+      `window.addEventListener("message", (event) => window.dispatchEvent(new CustomEvent("unsafe", { detail: event.data })));`,
+    );
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain("postmessage-origin-risk");
+  });
+
+  it("keeps generated public chunk scripts quiet for source-only scanners", () => {
+    writeFile(
+      "public/chunks/widget.js",
+      `window.addEventListener("message", (event) => window.dispatchEvent(new CustomEvent("unsafe", { detail: event.data })));`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("keeps Vite browser config probes quiet", () => {
+    writeFile(
+      "vite.config.ts",
+      `import react from "@vitejs/plugin-react"; export default { plugins: [react()], define: { BRAVE_BINARY: "browser" } };`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("still reports timing-unsafe signature comparisons", () => {
+    writeFile(
+      "src/webhook-crypto.ts",
+      `if (signature !== expectedSignature) throw new Error("bad");`,
+    );
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain("insecure-crypto-risk");
+  });
+
+  it("keeps placeholder signature comparisons quiet outside security-shaped code", () => {
+    writeFile("src/git-status.ts", `if (signature === "0") throw new Error("empty");`);
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("keeps signature string literal comparisons quiet", () => {
+    writeFile("src/event-kind.ts", `if (kind === "signature") return "signed";`);
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("keeps gesture origin variable names quiet", () => {
+    writeFile(
+      "src/gesture.ts",
+      `const { origin, distance } = getOriginAndDistance(touches[0], touches[1]); updatePinchState(false);`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("keeps non-Firebase immutable map writes quiet", () => {
+    writeFile(
+      "src/immutable-map.ts",
+      `class ImmutableMap { __ownerID = "owner"; set(key: string, value: string) { return [key, value]; } }`,
+    );
+
+    expect(checkSecurityScan(temporaryRoot)).toEqual([]);
+  });
+
+  it("still reports Firebase compat writes to authorization fields", () => {
+    writeFile(
+      "src/firebase-compat.ts",
+      `firebase.firestore().collection("documents").doc(id).set({ ownerId: user.uid, role: "admin" });`,
+    );
+
+    expect(rulesOf(checkSecurityScan(temporaryRoot))).toContain(
+      "firebase-client-owned-authz-field",
+    );
+  });
+
+  it("flags secret-like values committed in package metadata", () => {
+    expect(
+      checkSecurityScan(path.join(FIXTURES_DIRECTORY, "package-metadata-secret-leak")),
+    ).toEqual([
+      expect.objectContaining({
+        rule: "package-metadata-secret",
+        filePath: "package.json",
+        message: "Package metadata contains secret-like values or public env secret names.",
+      }),
+    ]);
+  });
+
+  it("disables every scan rule when the security-scan tag is ignored", () => {
+    expect(
+      checkSecurityScan(path.join(FIXTURES_DIRECTORY, "eva-todesktop-release-pipeline"), {
+        ignoredTags: new Set(["security-scan"]),
+      }),
+    ).toEqual([]);
+  });
+
+  it("single-sources diagnostic metadata from the registry rule", () => {
+    const entry = REACT_DOCTOR_RULES.find(
+      (candidate) => candidate.id === "build-pipeline-secret-boundary",
+    );
+    if (entry === undefined) throw new Error("build-pipeline-secret-boundary not in registry");
+
+    const diagnostics = checkSecurityScan(
+      path.join(FIXTURES_DIRECTORY, "eva-todesktop-release-pipeline"),
+    );
+
+    expect(diagnostics).toHaveLength(1);
+    expect(diagnostics[0]).toMatchObject({
+      rule: "build-pipeline-secret-boundary",
+      title: entry.rule.title,
+      help: entry.rule.recommendation,
+      severity: entry.rule.severity === "warn" ? "warning" : "error",
+    });
+  });
+});
diff --git a/packages/core/tests/fixtures/check-security-scan/broad-provider-token-bundle/dist/assets/integrations.js b/packages/core/tests/fixtures/check-security-scan/broad-provider-token-bundle/dist/assets/integrations.js
new file mode 100644
index 000000000..3e39fbf1c
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/broad-provider-token-bundle/dist/assets/integrations.js
@@ -0,0 +1,26 @@
+const integrationDefaults = {
+  notifications: {
+    slackWebhookUrl: "configured-server-side",
+    discordWebhookUrl: "configured-server-side",
+  },
+  database: {
+    DATABASE_URL: "postgres://integrations:dashboard-password@db.internal.example.com/integrations",
+  },
+  email: {
+    sendgridApiKey: "configured-server-side",
+  },
+  billing: {
+    stripeRestrictedKey: "configured-server-side",
+  },
+  ai: {
+    openAiProjectKey: "configured-server-side",
+    anthropicKey: "configured-server-side",
+  },
+  developerTools: {
+    linearApiKey: "configured-server-side",
+    vercelToken: "configured-server-side",
+    sentryAuthToken: "configured-server-side",
+  },
+};
+
+window.__INTEGRATIONS_DASHBOARD_CONFIG__ = integrationDefaults;
diff --git a/packages/core/tests/fixtures/check-security-scan/broad-provider-token-bundle/package.json b/packages/core/tests/fixtures/check-security-scan/broad-provider-token-bundle/package.json
new file mode 100644
index 000000000..193d8e213
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/broad-provider-token-bundle/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "@example/integrations-dashboard",
+  "private": true,
+  "scripts": {
+    "build": "vite build"
+  },
+  "dependencies": {
+    "@vitejs/plugin-react": "^latest",
+    "react": "^19.0.0",
+    "vite": "^latest"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/docs-cookie-cors-trust/app/api/session/route.ts b/packages/core/tests/fixtures/check-security-scan/docs-cookie-cors-trust/app/api/session/route.ts
new file mode 100644
index 000000000..1936848f0
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/docs-cookie-cors-trust/app/api/session/route.ts
@@ -0,0 +1,9 @@
+export const GET = () => {
+  return new Response("ok", {
+    headers: {
+      "Access-Control-Allow-Credentials": "true",
+      "Access-Control-Allow-Origin": "https://docs.cursor.com",
+      "Set-Cookie": "session=abc; Domain=.cursor.com; Path=/",
+    },
+  });
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/docs-cookie-cors-trust/package.json b/packages/core/tests/fixtures/check-security-scan/docs-cookie-cors-trust/package.json
new file mode 100644
index 000000000..8c799eca0
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/docs-cookie-cors-trust/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "docs-cookie-cors-trust",
+  "dependencies": {
+    "next": "^16.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-a16z-env-bundle/.next/static/chunks/portfolio.js b/packages/core/tests/fixtures/check-security-scan/eva-a16z-env-bundle/.next/static/chunks/portfolio.js
new file mode 100644
index 000000000..8ac9814df
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-a16z-env-bundle/.next/static/chunks/portfolio.js
@@ -0,0 +1,19 @@
+(() => {
+  const runtimeConfig = {
+    MARKETPLACE_URL: "https://portfolio.a16z.com/marketplace",
+    DATABASE_URL:
+      "postgres://portfolio_app:portfolio-db-password@db.internal.example.com/portfolio",
+    SALESFORCE_CLIENT_ID: "3MVG9lKcPoNINVBIPJjdw1J9LLM82HnFVV",
+    SALESFORCE_CLIENT_SECRET: "salesforce-client-secret-from-heroku-config",
+    OKTA_CLIENT_ID: "0oa1portfolio7I3dExample5d7",
+    OKTA_CLIENT_SECRET: "okta-client-secret-from-heroku-config",
+    AWS_BUCKET_NAME: "portfolio-company-logos-prod",
+    AWS_ACCESS_KEY_ID: "AKIAIOSFODNN7EXAMPLE",
+    AWS_SECRET_ACCESS_KEY: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+    MAILGUN_API_KEY: "key-0123456789abcdef0123456789abcdef",
+    SESSION_SECRET: "portfolio-session-secret-that-should-stay-server-side",
+    COOKIE_SECRET: "portfolio-cookie-secret-that-should-stay-server-side",
+  };
+
+  self.__PORTFOLIO_ENV__ = runtimeConfig;
+})();
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-a16z-env-bundle/package.json b/packages/core/tests/fixtures/check-security-scan/eva-a16z-env-bundle/package.json
new file mode 100644
index 000000000..8d80910ca
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-a16z-env-bundle/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "@example/portfolio-portal",
+  "private": true,
+  "scripts": {
+    "build": "next build"
+  },
+  "dependencies": {
+    "next": "^16.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/build/static/js/main.js b/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/build/static/js/main.js
new file mode 100644
index 000000000..bcace851d
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/build/static/js/main.js
@@ -0,0 +1,21 @@
+(() => {
+  const firebaseConfig = {
+    apiKey: "AIzaSyPublicFirebaseWebKey",
+    authDomain: "chattr-prod.firebaseapp.com",
+    projectId: "chattr-prod",
+    storageBucket: "chattr-prod.appspot.com",
+  };
+
+  const db = firebase.firestore(firebase.initializeApp(firebaseConfig));
+
+  window.__HIRING_PORTAL_COLLECTIONS__ = {
+    boosts: db.collection("boosts").where("creatorID", "==", window.currentUserId),
+    adminUsers: db.collection("orgs").doc("0").collection("users"),
+    candidateSessions: db.collection("sessions").where("userId", "==", window.currentUserId),
+    writableAdminShape: {
+      providerId: window.firebaseUserId,
+      ghostOrg: "0",
+      role: "SuperAdmin",
+    },
+  };
+})();
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/firestore.rules b/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/firestore.rules
new file mode 100644
index 000000000..e8f8d7997
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/firestore.rules
@@ -0,0 +1,7 @@
+service cloud.firestore {
+  match /databases/{database}/documents {
+    match /{document=**} {
+      allow read, write: if request.auth != null;
+    }
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/package.json b/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/package.json
new file mode 100644
index 000000000..b3ac7a757
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "eva-arc-chattr-firebase",
+  "dependencies": {
+    "firebase": "^12.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/src/boosts.ts b/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/src/boosts.ts
new file mode 100644
index 000000000..adb7814cd
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/src/boosts.ts
@@ -0,0 +1,15 @@
+import { doc, setDoc, updateDoc } from "firebase/firestore";
+
+export const createBoost = async (db: unknown, targetUserId: string, payload: string) => {
+  await setDoc(doc(db, "boosts", crypto.randomUUID()), {
+    creatorID: targetUserId,
+    hostPattern: "www.google.com",
+    javascript: payload,
+  });
+};
+
+export const reassignBoost = async (boostReference: unknown, targetUserId: string) => {
+  await updateDoc(boostReference, {
+    creatorID: targetUserId,
+  });
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/src/chattr-admin.ts b/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/src/chattr-admin.ts
new file mode 100644
index 000000000..0575e95eb
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-arc-chattr-firebase/src/chattr-admin.ts
@@ -0,0 +1,29 @@
+interface FirestoreCollection {
+  readonly doc: (documentId: string) => FirestoreDocument;
+  readonly add: (value: Record<string, unknown>) => Promise<void>;
+  readonly where: (field: string, operator: string, value: unknown) => FirestoreCollection;
+  readonly limit: (count: number) => FirestoreCollection;
+  readonly get: () => Promise<unknown>;
+}
+
+interface FirestoreDocument {
+  readonly collection: (name: string) => FirestoreCollection;
+}
+
+interface FirestoreClient {
+  readonly collection: (name: string) => FirestoreCollection;
+}
+
+export const inviteSupportOperator = async (db: FirestoreClient, providerId: string) => {
+  await db.collection("orgs").doc("0").collection("users").add({
+    email: "support@chattr.ai",
+    providerId,
+    ghostOrg: "0",
+    role: "SuperAdmin",
+    status: "active",
+  });
+};
+
+export const loadCandidateSessions = (db: FirestoreClient, userId: string) => {
+  return db.collection("sessions").where("userId", "==", userId).limit(10).get();
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-gamersafer-public-env/build/static/js/main.js b/packages/core/tests/fixtures/check-security-scan/eva-gamersafer-public-env/build/static/js/main.js
new file mode 100644
index 000000000..61af68052
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-gamersafer-public-env/build/static/js/main.js
@@ -0,0 +1,15 @@
+(() => {
+  const process = {
+    env: {
+      NODE_ENV: "production",
+      PUBLIC_URL: "",
+      REACT_APP_API_HOST: "apiv2.gamersafer.com",
+      REACT_APP_CHECKOUT_API_URL: "https://checkout-api.execute-api.us-east-1.amazonaws.com/prod/",
+      REACT_APP_AWS_ACCESS_KEY: "AKIAIOSFODNN7EXAMPLE",
+      REACT_APP_AWS_SECRET_KEY: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+      REACT_APP_AUTH_SECRET_KEY: "auth-secret-that-should-stay-server-side",
+    },
+  };
+
+  window.__ENV__ = process.env;
+})();
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-gamersafer-public-env/package.json b/packages/core/tests/fixtures/check-security-scan/eva-gamersafer-public-env/package.json
new file mode 100644
index 000000000..f0e8660a4
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-gamersafer-public-env/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "@example/playertrust-admin",
+  "private": true,
+  "scripts": {
+    "build": "react-scripts build"
+  },
+  "dependencies": {
+    "react": "^19.0.0",
+    "react-scripts": "^latest"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-gamersafer-public-env/src/admin-client.tsx b/packages/core/tests/fixtures/check-security-scan/eva-gamersafer-public-env/src/admin-client.tsx
new file mode 100644
index 000000000..d4610127c
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-gamersafer-public-env/src/admin-client.tsx
@@ -0,0 +1,17 @@
+interface AdminPortalEnvironment {
+  readonly apiHost: string | undefined;
+  readonly awsAccessKey: string | undefined;
+  readonly awsSecretKey: string | undefined;
+  readonly authSecretKey: string | undefined;
+}
+
+const adminPortalEnvironment: AdminPortalEnvironment = {
+  apiHost: process.env.REACT_APP_API_HOST,
+  awsAccessKey: process.env.REACT_APP_AWS_ACCESS_KEY,
+  awsSecretKey: process.env.REACT_APP_AWS_SECRET_KEY,
+  authSecretKey: process.env.REACT_APP_AUTH_SECRET_KEY,
+};
+
+export const AdminLogin = () => {
+  return <main data-api-host={adminPortalEnvironment.apiHost}>Admin portal</main>;
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-minified-widget-bundle/package.json b/packages/core/tests/fixtures/check-security-scan/eva-minified-widget-bundle/package.json
new file mode 100644
index 000000000..056beee93
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-minified-widget-bundle/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "eva-minified-widget-bundle",
+  "dependencies": {
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-minified-widget-bundle/packages/widget/widget.global.js b/packages/core/tests/fixtures/check-security-scan/eva-minified-widget-bundle/packages/widget/widget.global.js
new file mode 100644
index 000000000..fe7b9f39c
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-minified-widget-bundle/packages/widget/widget.global.js
@@ -0,0 +1,14 @@
+!(function (global) {
+  var runtime = {
+    apiBaseUrl: "https://api.cursor.com",
+    DATABASE_URL: "postgres://widget_runtime:widget-password@db.internal.example.com/widget",
+    AWS_ACCESS_KEY_ID: "AKIAIOSFODNN7EXAMPLE",
+    AWS_SECRET_ACCESS_KEY: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+  };
+  global.ReactDoctorWidget = {
+    mount: function mount(container) {
+      container.setAttribute("data-widget-api", runtime.apiBaseUrl);
+    },
+    __runtime: runtime,
+  };
+})(window);
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/app/_mintlify/static/[subdomain]/[...path]/route.ts b/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/app/_mintlify/static/[subdomain]/[...path]/route.ts
new file mode 100644
index 000000000..62f217bf0
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/app/_mintlify/static/[subdomain]/[...path]/route.ts
@@ -0,0 +1,19 @@
+const CDN_BASE_URL = "https://cdn.mintlify.com";
+
+export const GET = async (
+  request: Request,
+  context: { params: { subdomain: string; path: string[] } },
+) => {
+  const host = request.headers.get("host") ?? "";
+  const requestedPath = `/${decodeURIComponent(context.params.path.join("/"))}`;
+  const assetResponse = await fetch(`${CDN_BASE_URL}/${context.params.subdomain}${requestedPath}`, {
+    headers: {
+      "x-docs-host": host,
+    },
+    next: {
+      revalidate: 3600,
+    },
+  });
+
+  return assetResponse;
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/app/docs/[slug]/page.tsx b/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/app/docs/[slug]/page.tsx
new file mode 100644
index 000000000..0d62af25b
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/app/docs/[slug]/page.tsx
@@ -0,0 +1,12 @@
+import { compileMDX } from "next-mdx-remote/rsc";
+
+export const Page = async ({ params }: { params: { slug: string } }) => {
+  const customerMarkdown = await fetch(`https://api.mintlify.com/v1/docs/${params.slug}`).then(
+    (response) => response.text(),
+  );
+  const rendered = await compileMDX({
+    source: customerMarkdown,
+  });
+
+  return rendered.content;
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/next.config.js b/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/next.config.js
new file mode 100644
index 000000000..62803bae8
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/next.config.js
@@ -0,0 +1,5 @@
+export default {
+  images: {
+    dangerouslyAllowSVG: true,
+  },
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/package.json b/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/package.json
new file mode 100644
index 000000000..afa2878f3
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "eva-mintlify-docs-platform",
+  "dependencies": {
+    "next": "^16.0.0",
+    "next-mdx-remote": "^5.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/public/uploads/xss.svg b/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/public/uploads/xss.svg
new file mode 100644
index 000000000..bf549c5f2
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-mintlify-docs-platform/public/uploads/xss.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="alert(window.origin)" />
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-todesktop-release-pipeline/.github/workflows/release.yml b/packages/core/tests/fixtures/check-security-scan/eva-todesktop-release-pipeline/.github/workflows/release.yml
new file mode 100644
index 000000000..e013f3535
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-todesktop-release-pipeline/.github/workflows/release.yml
@@ -0,0 +1,15 @@
+name: release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: pnpm install
+        env:
+          FIREBASE_ADMIN_KEY: ${{ secrets.FIREBASE_ADMIN_KEY }}
+          UPDATE_SIGNING_TOKEN: ${{ secrets.UPDATE_SIGNING_TOKEN }}
+      - run: pnpm release
diff --git a/packages/core/tests/fixtures/check-security-scan/eva-todesktop-release-pipeline/package.json b/packages/core/tests/fixtures/check-security-scan/eva-todesktop-release-pipeline/package.json
new file mode 100644
index 000000000..95c45b6bc
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/eva-todesktop-release-pipeline/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "@example/electron-customer-app",
+  "private": true,
+  "scripts": {
+    "postinstall": "node scripts/generate-native-assets.js",
+    "release": "todesktop build && todesktop release"
+  },
+  "dependencies": {
+    "@todesktop/cli": "^latest",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/lyra-clickjacking-redirect-chain/app/signin/route.ts b/packages/core/tests/fixtures/check-security-scan/lyra-clickjacking-redirect-chain/app/signin/route.ts
new file mode 100644
index 000000000..72aa0a490
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/lyra-clickjacking-redirect-chain/app/signin/route.ts
@@ -0,0 +1,6 @@
+import { redirect } from "next/navigation";
+
+export const GET = (request: Request) => {
+  const url = new URL(request.url);
+  redirect(url.searchParams.get("continue") ?? "/");
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/lyra-clickjacking-redirect-chain/package.json b/packages/core/tests/fixtures/check-security-scan/lyra-clickjacking-redirect-chain/package.json
new file mode 100644
index 000000000..9ee7c3156
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/lyra-clickjacking-redirect-chain/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "lyra-clickjacking-redirect-chain",
+  "dependencies": {
+    "next": "^16.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/lyra-clickjacking-redirect-chain/src/slide-embed.tsx b/packages/core/tests/fixtures/check-security-scan/lyra-clickjacking-redirect-chain/src/slide-embed.tsx
new file mode 100644
index 000000000..e8a842045
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/lyra-clickjacking-redirect-chain/src/slide-embed.tsx
@@ -0,0 +1,10 @@
+export const SlideEmbed = ({ videoId }: { videoId: string }) => {
+  const shareTarget = new URLSearchParams(location.search).get("userstoinvite");
+
+  return (
+    <iframe
+      title="video"
+      src={`https://www.youtube.com/embed/${videoId}?next=https://docs.google.com/file/d/1sHy3aQXsIlnOCj-mBFxQ0ZXm4TzjjfFL/edit?userstoinvite=${shareTarget}&sharingaction=manageaccess&role=writer`}
+    />
+  );
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/lyra-svg-filter-clickjacking/package.json b/packages/core/tests/fixtures/check-security-scan/lyra-svg-filter-clickjacking/package.json
new file mode 100644
index 000000000..445f44909
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/lyra-svg-filter-clickjacking/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "lyra-svg-filter-clickjacking",
+  "dependencies": {
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/lyra-svg-filter-clickjacking/src/svg-filter-frame.tsx b/packages/core/tests/fixtures/check-security-scan/lyra-svg-filter-clickjacking/src/svg-filter-frame.tsx
new file mode 100644
index 000000000..4835288e1
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/lyra-svg-filter-clickjacking/src/svg-filter-frame.tsx
@@ -0,0 +1,16 @@
+export const FilteredFrame = () => {
+  return (
+    <>
+      <iframe
+        title="account settings"
+        src="https://docs.google.com/file/d/1sHy3aQXsIlnOCj-mBFxQ0ZXm4TzjjfFL/edit"
+        style={{ filter: "url(#captchaFilter)" }}
+      />
+      <svg width="0" height="0">
+        <filter id="captchaFilter">
+          <feDisplacementMap in="SourceGraphic" scale="6" />
+        </filter>
+      </svg>
+    </>
+  );
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/mrbruh-asus-local-rpc/package.json b/packages/core/tests/fixtures/check-security-scan/mrbruh-asus-local-rpc/package.json
new file mode 100644
index 000000000..e71b84610
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/mrbruh-asus-local-rpc/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "mrbruh-asus-local-rpc",
+  "dependencies": {
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/mrbruh-asus-local-rpc/src/driverhub-bridge.ts b/packages/core/tests/fixtures/check-security-scan/mrbruh-asus-local-rpc/src/driverhub-bridge.ts
new file mode 100644
index 000000000..5cfddf3ad
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/mrbruh-asus-local-rpc/src/driverhub-bridge.ts
@@ -0,0 +1,10 @@
+import { execFile } from "node:child_process";
+
+export const decompiledBridgeSnippets = [
+  "Origin check used a substring match for driverhub.asus.com before accepting the RPC request.",
+  "Update URL validation used a substring match for .asus.com before calling the updater.",
+  'fetch("http://127.0.0.1:53000/asus/v1.0/UpdateApp", { method: "POST" });',
+  "UpdateApp manifest: download signed installer from https://driverhub.asus.com/AsusSetup.exe",
+];
+
+export const runDownloadedInstaller = (installerPath: string) => execFile(installerPath, ["-s"]);
diff --git a/packages/core/tests/fixtures/check-security-scan/mrbruh-fooocus-metadata-eval/package.json b/packages/core/tests/fixtures/check-security-scan/mrbruh-fooocus-metadata-eval/package.json
new file mode 100644
index 000000000..fdec587a8
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/mrbruh-fooocus-metadata-eval/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "mrbruh-fooocus-metadata-eval",
+  "dependencies": {
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/mrbruh-fooocus-metadata-eval/src/image-metadata-import.ts b/packages/core/tests/fixtures/check-security-scan/mrbruh-fooocus-metadata-eval/src/image-metadata-import.ts
new file mode 100644
index 000000000..664cefcb1
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/mrbruh-fooocus-metadata-eval/src/image-metadata-import.ts
@@ -0,0 +1,5 @@
+export const restoreImagePreset = (metadata: { styles: string }) => {
+  const restoredStyles = eval(metadata.styles);
+
+  return Array.isArray(restoredStyles) ? restoredStyles : [];
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/package-metadata-secret-leak/package.json b/packages/core/tests/fixtures/check-security-scan/package-metadata-secret-leak/package.json
new file mode 100644
index 000000000..289c27a94
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/package-metadata-secret-leak/package.json
@@ -0,0 +1,9 @@
+{
+  "name": "package-metadata-secret-leak",
+  "dependencies": {
+    "react": "^19.0.0"
+  },
+  "config": {
+    "registryToken": "ghp_abcdefghijklmnopqrstuvwxyz123456"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-agent-database-safe-patterns/package.json b/packages/core/tests/fixtures/check-security-scan/ported-agent-database-safe-patterns/package.json
new file mode 100644
index 000000000..3717639bd
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-agent-database-safe-patterns/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "@example/ported-agent-database-safe-patterns",
+  "private": true,
+  "dependencies": {
+    "ai": "^latest",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-agent-database-safe-patterns/src/agents/tools/format-tool.ts b/packages/core/tests/fixtures/check-security-scan/ported-agent-database-safe-patterns/src/agents/tools/format-tool.ts
new file mode 100644
index 000000000..f245f56c7
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-agent-database-safe-patterns/src/agents/tools/format-tool.ts
@@ -0,0 +1,8 @@
+import { tool } from "ai";
+
+export const formatTool = tool({
+  description: "Format a display name",
+  execute: async ({ name }: { readonly name: string }) => {
+    return { displayName: name.trim().slice(0, 40) };
+  },
+});
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-agent-database-safe-patterns/src/database.ts b/packages/core/tests/fixtures/check-security-scan/ported-agent-database-safe-patterns/src/database.ts
new file mode 100644
index 000000000..8d860336f
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-agent-database-safe-patterns/src/database.ts
@@ -0,0 +1,3 @@
+export const loadUser = async (client: any, userId: string) => {
+  return client.query("SELECT * FROM users WHERE id = $1", [userId]);
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-agent-mcp-tool-risks/package.json b/packages/core/tests/fixtures/check-security-scan/ported-agent-mcp-tool-risks/package.json
new file mode 100644
index 000000000..395521160
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-agent-mcp-tool-risks/package.json
@@ -0,0 +1,9 @@
+{
+  "name": "@example/ported-agent-mcp-tool-risks",
+  "private": true,
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^latest",
+    "ai": "^latest",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-agent-mcp-tool-risks/src/agents/tools/run-command-tool.ts b/packages/core/tests/fixtures/check-security-scan/ported-agent-mcp-tool-risks/src/agents/tools/run-command-tool.ts
new file mode 100644
index 000000000..3e276d62f
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-agent-mcp-tool-risks/src/agents/tools/run-command-tool.ts
@@ -0,0 +1,10 @@
+import { tool } from "ai";
+import { execFile } from "node:child_process";
+
+export const runCommandTool = tool({
+  description: "Run a repository maintenance command",
+  execute: async ({ command }: { readonly command: string }) => {
+    execFile(command, []);
+    return { ok: true };
+  },
+});
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-agent-mcp-tool-risks/src/mcp/server.ts b/packages/core/tests/fixtures/check-security-scan/ported-agent-mcp-tool-risks/src/mcp/server.ts
new file mode 100644
index 000000000..c439c97b9
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-agent-mcp-tool-risks/src/mcp/server.ts
@@ -0,0 +1,10 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/index.js";
+import { readFile } from "node:fs/promises";
+
+const server = new McpServer({ name: "repo-tools", version: "1.0.0" });
+
+server.tool("read_file", async ({ path }: { readonly path: string }) => {
+  return {
+    content: [{ type: "text", text: await readFile(path, "utf-8") }],
+  };
+});
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/package.json b/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/package.json
new file mode 100644
index 000000000..3d1f8b14e
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/package.json
@@ -0,0 +1,9 @@
+{
+  "name": "@example/ported-database-and-command-risks",
+  "private": true,
+  "dependencies": {
+    "@prisma/client": "^latest",
+    "drizzle-orm": "^latest",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/public/plugin.php b/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/public/plugin.php
new file mode 100644
index 000000000..e89696aad
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/public/plugin.php
@@ -0,0 +1,10 @@
+<?php
+
+function export_user($pdo) {
+  $id = $_GET['id'];
+  $pdo->query("SELECT * FROM users WHERE id = " . $id);
+}
+
+function run_export() {
+  shell_exec($_GET['cmd']);
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/scripts/report.py b/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/scripts/report.py
new file mode 100644
index 000000000..c1e4c5b32
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/scripts/report.py
@@ -0,0 +1,5 @@
+import os
+
+
+def render_report(request):
+    os.system(f"wkhtmltopdf {request.args['url']} /tmp/report.pdf")
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/src/nosql.ts b/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/src/nosql.ts
new file mode 100644
index 000000000..b070cecf8
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/src/nosql.ts
@@ -0,0 +1,7 @@
+export const loadByFilter = (collection: any, request: any) => {
+  return collection.find(JSON.parse(request.body.filter));
+};
+
+export const searchByRegex = (collection: any, request: any) => {
+  return collection.find({ name: { $regex: request.query.q } });
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/src/raw-sql.ts b/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/src/raw-sql.ts
new file mode 100644
index 000000000..d32b338c4
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-database-and-command-risks/src/raw-sql.ts
@@ -0,0 +1,12 @@
+import { PrismaClient } from "@prisma/client";
+import { sql } from "drizzle-orm";
+
+const prisma = new PrismaClient();
+
+export const loadUser = async (userId: string) => {
+  return prisma.$queryRawUnsafe(`SELECT * FROM users WHERE id = '${userId}'`);
+};
+
+export const deleteFromTenantTable = async (tableName: string) => {
+  return sql.raw(`DELETE FROM ${tableName}`);
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/app/api/preview/route.ts b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/app/api/preview/route.ts
new file mode 100644
index 000000000..e53a77d07
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/app/api/preview/route.ts
@@ -0,0 +1,8 @@
+export const fixtureSource = `
+export const POST = async (request) => {
+  const { imageUrl } = await request.json();
+  const response = await fetch(imageUrl);
+
+  return new Response(response.body);
+};
+`;
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/package.json b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/package.json
new file mode 100644
index 000000000..53997b0d5
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "@example/ported-static-matcher-patterns",
+  "private": true,
+  "dependencies": {
+    "next": "^16.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/src/iframe-message-panel.tsx b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/src/iframe-message-panel.tsx
new file mode 100644
index 000000000..38d6bcce9
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/src/iframe-message-panel.tsx
@@ -0,0 +1,5 @@
+export const mountToolbarBridge = () => {
+  window.addEventListener("message", (event) => {
+    window.dispatchEvent(new CustomEvent("toolbar-message", { detail: event.data }));
+  });
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/src/render-remote-html.tsx b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/src/render-remote-html.tsx
new file mode 100644
index 000000000..116a03ed6
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-patterns/src/render-remote-html.tsx
@@ -0,0 +1,3 @@
+export const RemoteHtml = ({ html }: { readonly html: string }) => {
+  return <article dangerouslySetInnerHTML={{ __html: html }} />;
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/app/api/preview/route.ts b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/app/api/preview/route.ts
new file mode 100644
index 000000000..9fe35ca24
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/app/api/preview/route.ts
@@ -0,0 +1,8 @@
+export const fixtureSource = `
+export const POST = async (request) => {
+  const { imageUrl } = await request.json();
+  const response = await fetch(imageUrl, { redirect: "manual" });
+
+  return new Response(response.body);
+};
+`;
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/package.json b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/package.json
new file mode 100644
index 000000000..ed65088c1
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "@example/ported-static-matcher-safe-patterns",
+  "private": true,
+  "dependencies": {
+    "next": "^16.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/src/iframe-message-panel.tsx b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/src/iframe-message-panel.tsx
new file mode 100644
index 000000000..286de35f3
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/src/iframe-message-panel.tsx
@@ -0,0 +1,6 @@
+export const mountToolbarBridge = () => {
+  window.addEventListener("message", (event) => {
+    if (event.origin !== "https://app.posthog.com") return;
+    window.dispatchEvent(new CustomEvent("toolbar-message", { detail: event.data }));
+  });
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/src/static-html.tsx b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/src/static-html.tsx
new file mode 100644
index 000000000..1f33b83e1
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-static-matcher-safe-patterns/src/static-html.tsx
@@ -0,0 +1,3 @@
+export const StaticHtml = () => {
+  return <article dangerouslySetInnerHTML={{ __html: "<strong>OK</strong>" }} />;
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/app/api/files/route.ts b/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/app/api/files/route.ts
new file mode 100644
index 000000000..9b03a0a18
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/app/api/files/route.ts
@@ -0,0 +1,8 @@
+export const fixtureSource = `
+import { readFile } from "node:fs/promises";
+
+export const POST = async (request) => {
+  const body = await request.json();
+  return new Response(await readFile(body.path, "utf-8"));
+};
+`;
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/app/api/stripe/webhook/route.ts b/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/app/api/stripe/webhook/route.ts
new file mode 100644
index 000000000..e003f5e41
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/app/api/stripe/webhook/route.ts
@@ -0,0 +1,4 @@
+export const POST = async (request: Request) => {
+  const event = await request.json();
+  return Response.json({ received: event.type });
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/package.json b/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/package.json
new file mode 100644
index 000000000..a1b37c2d0
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "@example/ported-web-security-risks",
+  "private": true,
+  "dependencies": {
+    "next": "^16.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/src/github-import.ts b/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/src/github-import.ts
new file mode 100644
index 000000000..c9510838d
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/src/github-import.ts
@@ -0,0 +1,3 @@
+export const buildRepositoryApiUrl = (req: { query: { owner: string; repo: string } }) => {
+  return `https://api.github.com/repos/${req.query.owner}/${req.query.repo}`;
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/src/session-token.ts b/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/src/session-token.ts
new file mode 100644
index 000000000..74eb954d7
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-web-security-risks/src/session-token.ts
@@ -0,0 +1,8 @@
+export const fixtureSource = `
+import { createHash } from "node:crypto";
+
+export const createSessionToken = (userId) => {
+  const nonce = Math.random().toString(36).slice(2);
+  return createHash("sha1").update(userId + ":" + nonce).digest("hex");
+};
+`;
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/app/api/files/route.ts b/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/app/api/files/route.ts
new file mode 100644
index 000000000..3faa440cd
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/app/api/files/route.ts
@@ -0,0 +1,12 @@
+import { readFile } from "node:fs/promises";
+
+const FILES = {
+  guide: "docs/guide.md",
+  faq: "docs/faq.md",
+} as const;
+
+export const POST = async (request: Request) => {
+  const { id } = await request.json();
+  const filePath = FILES[id as keyof typeof FILES] ?? FILES.guide;
+  return new Response(await readFile(filePath, "utf-8"));
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/app/api/stripe/webhook/route.ts b/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/app/api/stripe/webhook/route.ts
new file mode 100644
index 000000000..8f521e0ba
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/app/api/stripe/webhook/route.ts
@@ -0,0 +1,14 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+export const POST = async (request: Request) => {
+  const body = await request.text();
+  const signature = request.headers.get("stripe-signature") ?? "";
+  const expected = createHmac("sha256", "test-secret").update(body).digest();
+  const provided = Buffer.from(signature.padEnd(expected.length, "0").slice(0, expected.length));
+
+  if (!timingSafeEqual(expected, provided)) {
+    return new Response("invalid signature", { status: 401 });
+  }
+
+  return Response.json({ received: true });
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/package.json b/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/package.json
new file mode 100644
index 000000000..b2dcfbd7d
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "@example/ported-web-security-safe-patterns",
+  "private": true,
+  "dependencies": {
+    "next": "^16.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/src/github-import.ts b/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/src/github-import.ts
new file mode 100644
index 000000000..025de5e83
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/ported-web-security-safe-patterns/src/github-import.ts
@@ -0,0 +1,11 @@
+const OWNER_PATTERN = /^[a-z0-9-]+$/i;
+
+export const buildRepositoryApiUrl = (owner: string, repo: string) => {
+  if (!OWNER_PATTERN.test(owner) || !OWNER_PATTERN.test(repo)) {
+    throw new Error("invalid repository slug");
+  }
+
+  const url = new URL("https://api.github.com/repos/");
+  url.pathname = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
+  return url.toString();
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/public-debug-sourcemap-leak/dist/assets/app.js.map b/packages/core/tests/fixtures/check-security-scan/public-debug-sourcemap-leak/dist/assets/app.js.map
new file mode 100644
index 000000000..8633e7965
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/public-debug-sourcemap-leak/dist/assets/app.js.map
@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/server/db.ts"],
+  "sourcesContent": ["export const databaseUrl = process.env.DATABASE_URL;"],
+  "names": [],
+  "mappings": ""
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/public-debug-sourcemap-leak/package.json b/packages/core/tests/fixtures/check-security-scan/public-debug-sourcemap-leak/package.json
new file mode 100644
index 000000000..b3f5c9819
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/public-debug-sourcemap-leak/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "public-debug-sourcemap-leak",
+  "dependencies": {
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/public-debug-sourcemap-leak/public/debug.log b/packages/core/tests/fixtures/check-security-scan/public-debug-sourcemap-leak/public/debug.log
new file mode 100644
index 000000000..975cdb0a3
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/public-debug-sourcemap-leak/public/debug.log
@@ -0,0 +1,2 @@
+boot failed while connecting to DATABASE_URL=postgres://debug:N7vq2mXfA9z@db.example.com/app
+stack: at connect (/Users/example/app/server/db.ts:12:7)
diff --git a/packages/core/tests/fixtures/check-security-scan/real-public-env-keys/package.json b/packages/core/tests/fixtures/check-security-scan/real-public-env-keys/package.json
new file mode 100644
index 000000000..aaaf6cd6c
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/real-public-env-keys/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "@example/public-env-keys",
+  "private": true,
+  "dependencies": {
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/real-public-env-keys/src/public-config.ts b/packages/core/tests/fixtures/check-security-scan/real-public-env-keys/src/public-config.ts
new file mode 100644
index 000000000..4d27144d7
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/real-public-env-keys/src/public-config.ts
@@ -0,0 +1,8 @@
+export const publicAnalyticsConfig = {
+  posthogProjectToken: process.env.NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN,
+  posthogViteToken: import.meta.env.VITE_PUBLIC_POSTHOG_PROJECT_TOKEN,
+  tldrawLicenseKey: process.env.NEXT_PUBLIC_TLDRAW_LICENSE_KEY,
+  clerkPublishableKey: import.meta.env.VITE_CLERK_PUBLISHABLE_KEY,
+  algoliaSearchKey: process.env.NEXT_PUBLIC_ALGOLIA_SEARCH_KEY,
+  googleMapsEmbedKey: process.env.NEXT_PUBLIC_GC_API_KEY,
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/real-server-service-role-route/package.json b/packages/core/tests/fixtures/check-security-scan/real-server-service-role-route/package.json
new file mode 100644
index 000000000..75b206452
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/real-server-service-role-route/package.json
@@ -0,0 +1,9 @@
+{
+  "name": "@example/server-service-role-route",
+  "private": true,
+  "dependencies": {
+    "@supabase/supabase-js": "^2.0.0",
+    "next": "^16.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/real-server-service-role-route/pages/api/vector-search.ts b/packages/core/tests/fixtures/check-security-scan/real-server-service-role-route/pages/api/vector-search.ts
new file mode 100644
index 000000000..6c4bf2225
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/real-server-service-role-route/pages/api/vector-search.ts
@@ -0,0 +1,26 @@
+import type { NextRequest } from "next/server";
+import { createClient } from "@supabase/supabase-js";
+
+export const runtime = "edge";
+
+export default async function handler(request: NextRequest) {
+  const openAiKey = process.env.OPENAI_KEY;
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+  const supabaseServiceKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+
+  if (!openAiKey || !supabaseUrl || !supabaseServiceKey) {
+    return new Response("missing server configuration", { status: 500 });
+  }
+
+  const { prompt } = await request.json();
+  const supabase = createClient(supabaseUrl, supabaseServiceKey);
+
+  const { data } = await supabase.rpc("match_page_sections", {
+    embedding: [0.1, 0.2, 0.3],
+    match_count: 10,
+    match_threshold: 0.78,
+    min_content_length: 50,
+  });
+
+  return Response.json({ prompt, data });
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/real-supabase-chat-browser-bundle/dist/assets/chat.js b/packages/core/tests/fixtures/check-security-scan/real-supabase-chat-browser-bundle/dist/assets/chat.js
new file mode 100644
index 000000000..b5a25bef1
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/real-supabase-chat-browser-bundle/dist/assets/chat.js
@@ -0,0 +1,12 @@
+import { createClient } from "@supabase/supabase-js";
+
+const supabase = createClient(
+  import.meta.env.VITE_SUPABASE_URL,
+  import.meta.env.VITE_SUPABASE_KEY,
+);
+
+export const loadMessages = () =>
+  supabase.from("messages").select().range(0, 49).order("id", { ascending: false });
+
+export const sendMessage = (text, username, country) =>
+  supabase.from("messages").insert([{ text, username, country, is_authenticated: false }]);
diff --git a/packages/core/tests/fixtures/check-security-scan/real-supabase-chat-browser-bundle/package.json b/packages/core/tests/fixtures/check-security-scan/real-supabase-chat-browser-bundle/package.json
new file mode 100644
index 000000000..2c4b5e0c5
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/real-supabase-chat-browser-bundle/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "@example/realtime-chat",
+  "private": true,
+  "scripts": {
+    "build": "vite build"
+  },
+  "dependencies": {
+    "@supabase/supabase-js": "^2.0.0",
+    "react": "^19.0.0",
+    "vite": "^latest"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/real-supabase-public-read-private-write/package.json b/packages/core/tests/fixtures/check-security-scan/real-supabase-public-read-private-write/package.json
new file mode 100644
index 000000000..1f8ce31f9
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/real-supabase-public-read-private-write/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "@example/public-read-private-write",
+  "private": true,
+  "dependencies": {
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/real-supabase-public-read-private-write/supabase/migrations/001_private_items.sql b/packages/core/tests/fixtures/check-security-scan/real-supabase-public-read-private-write/supabase/migrations/001_private_items.sql
new file mode 100644
index 000000000..fce435be8
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/real-supabase-public-read-private-write/supabase/migrations/001_private_items.sql
@@ -0,0 +1,18 @@
+alter table public.private_items enable row level security;
+
+create policy select_all_policy on public.private_items
+for select
+using (true);
+
+create policy insert_auth_policy on public.private_items
+for insert
+with check (auth.uid() is not null);
+
+create policy update_own_policy on public.private_items
+for update
+using (auth.uid() = owner_id)
+with check (auth.uid() = owner_id);
+
+create policy delete_own_policy on public.private_items
+for delete
+using (auth.uid() = owner_id);
diff --git a/packages/core/tests/fixtures/check-security-scan/release-key-material-leak/.github/workflows/release.yml b/packages/core/tests/fixtures/check-security-scan/release-key-material-leak/.github/workflows/release.yml
new file mode 100644
index 000000000..24950cd4d
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/release-key-material-leak/.github/workflows/release.yml
@@ -0,0 +1,11 @@
+name: release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
diff --git a/packages/core/tests/fixtures/check-security-scan/release-key-material-leak/keys/deploy.pem b/packages/core/tests/fixtures/check-security-scan/release-key-material-leak/keys/deploy.pem
new file mode 100644
index 000000000..275819d17
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/release-key-material-leak/keys/deploy.pem
@@ -0,0 +1,4 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBti3rDC8c5y7eNNtREJq3pDmLZUbDFTndphcLI4what
+-----END OPENSSH PRIVATE KEY-----
diff --git a/packages/core/tests/fixtures/check-security-scan/release-key-material-leak/package.json b/packages/core/tests/fixtures/check-security-scan/release-key-material-leak/package.json
new file mode 100644
index 000000000..ebf481102
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/release-key-material-leak/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "release-key-material-leak",
+  "dependencies": {
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/repository-secret-examples/.env.example b/packages/core/tests/fixtures/check-security-scan/repository-secret-examples/.env.example
new file mode 100644
index 000000000..5d53845ab
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/repository-secret-examples/.env.example
@@ -0,0 +1,3 @@
+DATABASE_URL=postgres://user:password@localhost/example
+NEXT_PUBLIC_SITE_URL=https://docs.tldraw.dev
+SENTRY_DSN=https://public@example.ingest.sentry.io/1
diff --git a/packages/core/tests/fixtures/check-security-scan/repository-secret-examples/package.json b/packages/core/tests/fixtures/check-security-scan/repository-secret-examples/package.json
new file mode 100644
index 000000000..f3c3da641
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/repository-secret-examples/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "repository-secret-examples",
+  "dependencies": {
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/repository-secret-files/.env.production b/packages/core/tests/fixtures/check-security-scan/repository-secret-files/.env.production
new file mode 100644
index 000000000..03b1d5be4
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/repository-secret-files/.env.production
@@ -0,0 +1,6 @@
+NODE_ENV=production
+APP_ORIGIN=https://admin.gamersafer.com
+DATABASE_URL=postgres://app:prod-db-password@postgres.internal.example.com/app
+AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
+AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+SENTRY_DSN=https://public@example.ingest.sentry.io/1
diff --git a/packages/core/tests/fixtures/check-security-scan/repository-secret-files/.npmrc b/packages/core/tests/fixtures/check-security-scan/repository-secret-files/.npmrc
new file mode 100644
index 000000000..3b75cb47b
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/repository-secret-files/.npmrc
@@ -0,0 +1 @@
+//registry.npmjs.org/:_authToken=npm_abcdefghijklmnopqrstuvwxyz1234567890
diff --git a/packages/core/tests/fixtures/check-security-scan/repository-secret-files/firebase-admin-credentials.json b/packages/core/tests/fixtures/check-security-scan/repository-secret-files/firebase-admin-credentials.json
new file mode 100644
index 000000000..4c2bf5c50
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/repository-secret-files/firebase-admin-credentials.json
@@ -0,0 +1,10 @@
+{
+  "type": "service_account",
+  "project_id": "chattr-prod",
+  "private_key_id": "0123456789abcdef0123456789abcdef01234567",
+  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7VJTUt9Us8cKj\n-----END PRIVATE KEY-----\n",
+  "client_email": "firebase-adminsdk-prod@chattr-prod.iam.gserviceaccount.com",
+  "client_id": "123456789012345678901",
+  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+  "token_uri": "https://oauth2.googleapis.com/token"
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/repository-secret-files/package.json b/packages/core/tests/fixtures/check-security-scan/repository-secret-files/package.json
new file mode 100644
index 000000000..300b69de1
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/repository-secret-files/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "repository-secret-files",
+  "dependencies": {
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/.github/workflows/test.yml b/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/.github/workflows/test.yml
new file mode 100644
index 000000000..194770ba9
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/.github/workflows/test.yml
@@ -0,0 +1,14 @@
+name: test
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: pnpm install --ignore-scripts
+        env:
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+      - run: pnpm test
diff --git a/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/.next/static/chunks/app.js b/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/.next/static/chunks/app.js
new file mode 100644
index 000000000..395921565
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/.next/static/chunks/app.js
@@ -0,0 +1,5 @@
+window.__PUBLIC_CONFIG__ = {
+  NEXT_PUBLIC_SITE_URL: "https://docs.tldraw.dev",
+  NEXT_PUBLIC_SENTRY_DSN: "https://public@example.ingest.sentry.io/1",
+  STRIPE_PUBLISHABLE_KEY: "pk_live_1234567890",
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/firestore.rules b/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/firestore.rules
new file mode 100644
index 000000000..64c988313
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/firestore.rules
@@ -0,0 +1,7 @@
+service cloud.firestore {
+  match /databases/{database}/documents {
+    match /users/{userId} {
+      allow read, write: if request.auth.uid == userId;
+    }
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/package.json b/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/package.json
new file mode 100644
index 000000000..f8147a32b
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "safe-hardened-app",
+  "scripts": {
+    "build": "next build"
+  },
+  "dependencies": {
+    "next": "^16.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/supabase/migrations/001_profiles.sql b/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/supabase/migrations/001_profiles.sql
new file mode 100644
index 000000000..f649052ec
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/safe-hardened-app/supabase/migrations/001_profiles.sql
@@ -0,0 +1,6 @@
+alter table profiles enable row level security;
+
+create policy "users manage their own profile"
+on profiles
+using (auth.uid() = user_id)
+with check (auth.uid() = user_id);
diff --git a/packages/core/tests/fixtures/check-security-scan/supabase-rls-client-owned-authz/package.json b/packages/core/tests/fixtures/check-security-scan/supabase-rls-client-owned-authz/package.json
new file mode 100644
index 000000000..c808bba19
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/supabase-rls-client-owned-authz/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "supabase-rls-client-owned-authz",
+  "dependencies": {
+    "@supabase/supabase-js": "^2.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/supabase-rls-client-owned-authz/src/documents.ts b/packages/core/tests/fixtures/check-security-scan/supabase-rls-client-owned-authz/src/documents.ts
new file mode 100644
index 000000000..f23478fe6
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/supabase-rls-client-owned-authz/src/documents.ts
@@ -0,0 +1,8 @@
+export const saveDocument = async (supabase: any, ownerId: string, orgId: string) => {
+  return supabase.from("documents").upsert({
+    ownerId,
+    orgId,
+    role: "admin",
+    title: "Q4 plan",
+  });
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/supabase-rls-client-owned-authz/supabase/migrations/001_open_documents.sql b/packages/core/tests/fixtures/check-security-scan/supabase-rls-client-owned-authz/supabase/migrations/001_open_documents.sql
new file mode 100644
index 000000000..5e783a0eb
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/supabase-rls-client-owned-authz/supabase/migrations/001_open_documents.sql
@@ -0,0 +1,7 @@
+alter table documents disable row level security;
+
+create policy "everyone can edit"
+on documents
+for all
+using (true)
+with check (true);
diff --git a/packages/core/tests/fixtures/check-security-scan/supabase-service-role-public-client/dist/assets/app.js b/packages/core/tests/fixtures/check-security-scan/supabase-service-role-public-client/dist/assets/app.js
new file mode 100644
index 000000000..54c1c35f7
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/supabase-service-role-public-client/dist/assets/app.js
@@ -0,0 +1,4 @@
+window.__SUPABASE_CONFIG__ = {
+  VITE_SUPABASE_URL: "https://project.supabase.co",
+  VITE_SUPABASE_SERVICE_ROLE_KEY: "service_role.jwt.payload",
+};
diff --git a/packages/core/tests/fixtures/check-security-scan/supabase-service-role-public-client/package.json b/packages/core/tests/fixtures/check-security-scan/supabase-service-role-public-client/package.json
new file mode 100644
index 000000000..791e5e4cd
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/supabase-service-role-public-client/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "supabase-service-role-public-client",
+  "dependencies": {
+    "@supabase/supabase-js": "^2.0.0",
+    "react": "^19.0.0"
+  }
+}
diff --git a/packages/core/tests/fixtures/check-security-scan/supabase-service-role-public-client/src/supabase-client.tsx b/packages/core/tests/fixtures/check-security-scan/supabase-service-role-public-client/src/supabase-client.tsx
new file mode 100644
index 000000000..15e5ebe25
--- /dev/null
+++ b/packages/core/tests/fixtures/check-security-scan/supabase-service-role-public-client/src/supabase-client.tsx
@@ -0,0 +1,6 @@
+import { createClient } from "@supabase/supabase-js";
+
+export const supabase = createClient(
+  import.meta.env.VITE_SUPABASE_URL,
+  import.meta.env.VITE_SUPABASE_SERVICE_ROLE_KEY,
+);
diff --git a/packages/core/tests/oxlint-config-settings.test.ts b/packages/core/tests/oxlint-config-settings.test.ts
index b054cf6af..a0af06abd 100644
--- a/packages/core/tests/oxlint-config-settings.test.ts
+++ b/packages/core/tests/oxlint-config-settings.test.ts
@@ -49,4 +49,30 @@ describe("createOxlintConfig settings", () => {
 
     expect(config.settings["react-doctor"]).not.toHaveProperty("shopifyFlashListMajorVersion");
   });
+
+  it("never registers security scan rules (they run as a core environment check)", () => {
+    const config = createOxlintConfig({
+      pluginPath: "/tmp/plugin.js",
+      project: buildProject({ framework: "vite", hasReactNativeWorkspace: false }),
+    });
+
+    expect(config.rules).not.toHaveProperty("react-doctor/artifact-secret-leak");
+    expect(config.rules).not.toHaveProperty("react-doctor/raw-sql-injection-risk");
+  });
+
+  it("excludes security scan rules even when severity controls opt them in", () => {
+    const config = createOxlintConfig({
+      pluginPath: "/tmp/plugin.js",
+      project: buildProject({ framework: "vite", hasReactNativeWorkspace: false }),
+      severityControls: {
+        rules: {
+          "react-doctor/artifact-secret-leak": "error",
+          "react-doctor/raw-sql-injection-risk": "error",
+        },
+      },
+    });
+
+    expect(config.rules).not.toHaveProperty("react-doctor/artifact-secret-leak");
+    expect(config.rules).not.toHaveProperty("react-doctor/raw-sql-injection-risk");
+  });
 });
diff --git a/packages/core/tests/run-inspect.test.ts b/packages/core/tests/run-inspect.test.ts
index a26b6a3f7..7570a1162 100644
--- a/packages/core/tests/run-inspect.test.ts
+++ b/packages/core/tests/run-inspect.test.ts
@@ -1,10 +1,13 @@
+import * as fs from "node:fs";
+import os from "node:os";
+import * as path from "node:path";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
 import * as Layer from "effect/Layer";
 import * as Ref from "effect/Ref";
 import * as Stream from "effect/Stream";
-import { describe, expect, it } from "vite-plus/test";
-import type { Diagnostic, ProjectInfo } from "@react-doctor/core";
+import { afterAll, describe, expect, it } from "vite-plus/test";
+import type { Diagnostic, ProjectInfo, ReactDoctorConfig } from "@react-doctor/core";
 import {
   DeadCodeAnalysisFailed,
   GitInvocationFailed,
@@ -24,6 +27,13 @@ import { Reporter, ReporterCapture } from "../src/services/reporter.js";
 import { Score } from "../src/services/score.js";
 import { SupplyChain } from "../src/services/supply-chain.js";
 
+const temporaryDirectories: string[] = [];
+afterAll(() => {
+  for (const directory of temporaryDirectories) {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
 const sampleProject: ProjectInfo = {
   rootDirectory: "/repo",
   projectName: "sample-app",
@@ -586,3 +596,75 @@ describe("runInspect — supply-chain in diff mode", () => {
     expect(output.diagnostics.map((d) => d.rule)).toContain("low-supply-chain-score");
   });
 });
+
+describe("runInspect — security scan rules in the environment-checks phase", () => {
+  // Unlike the mocked Linter/DeadCode services, environment checks read
+  // the real filesystem at the resolved scan directory, so these tests
+  // scan a temp project seeded with a scan-rule finding.
+  const makeScanRuleProject = (): string => {
+    const rootDirectory = fs.mkdtempSync(path.join(os.tmpdir(), "react-doctor-security-scan-"));
+    temporaryDirectories.push(rootDirectory);
+    fs.mkdirSync(path.join(rootDirectory, "public"), { recursive: true });
+    fs.writeFileSync(
+      path.join(rootDirectory, "public", "debug.log"),
+      "internal route dump /admin/api session=abc\n",
+    );
+    return rootDirectory;
+  };
+
+  const scanRuleLayersOf = (rootDirectory: string, config: ReactDoctorConfig | null = null) =>
+    Layer.mergeAll(
+      Project.layerOf({ ...sampleProject, rootDirectory }),
+      Config.layerOf({ config, resolvedDirectory: rootDirectory, configSourceDirectory: null }),
+      Files.layerInMemory(new Map()),
+      Linter.layerOf([]),
+      LintPartialFailures.layerLive,
+      DeadCode.layerOf([]),
+      Git.layerOf({}),
+      Score.layerOf(null),
+      SupplyChain.layerOf([]),
+      Progress.layerNoop,
+      Reporter.layerNoop,
+    );
+
+  it("emits scan-rule diagnostics in a full scan", async () => {
+    const rootDirectory = makeScanRuleProject();
+    const output = await Effect.runPromise(
+      runInspect({ ...baseInput, directory: rootDirectory }).pipe(
+        Effect.provide(scanRuleLayersOf(rootDirectory)),
+      ),
+    );
+    const scanDiagnostics = output.diagnostics.filter((d) => d.rule === "public-debug-artifact");
+    expect(scanDiagnostics).toHaveLength(1);
+    expect(scanDiagnostics[0]?.severity).toBe("warning");
+    expect(scanDiagnostics[0]?.category).toBe("Security");
+  });
+
+  it("skips the file scan in diff mode (includePaths.length > 0)", async () => {
+    const rootDirectory = makeScanRuleProject();
+    const output = await Effect.runPromise(
+      runInspect({
+        ...baseInput,
+        directory: rootDirectory,
+        includePaths: ["src/App.tsx"],
+      }).pipe(Effect.provide(scanRuleLayersOf(rootDirectory))),
+    );
+    expect(output.diagnostics.map((d) => d.rule)).not.toContain("public-debug-artifact");
+  });
+
+  it("applies user severity overrides to scan-rule diagnostics", async () => {
+    const rootDirectory = makeScanRuleProject();
+    const output = await Effect.runPromise(
+      runInspect({ ...baseInput, directory: rootDirectory }).pipe(
+        Effect.provide(
+          scanRuleLayersOf(rootDirectory, {
+            rules: { "react-doctor/public-debug-artifact": "error" },
+          }),
+        ),
+      ),
+    );
+    const scanDiagnostics = output.diagnostics.filter((d) => d.rule === "public-debug-artifact");
+    expect(scanDiagnostics).toHaveLength(1);
+    expect(scanDiagnostics[0]?.severity).toBe("error");
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/README.md b/packages/oxlint-plugin-react-doctor/README.md
index 2d7687c52..7e81b4b78 100644
--- a/packages/oxlint-plugin-react-doctor/README.md
+++ b/packages/oxlint-plugin-react-doctor/README.md
@@ -56,6 +56,8 @@ npx oxlint .
 
 The full rule list lives in [`rule-registry.ts`](https://github.com/millionco/react-doctor/blob/main/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.ts). All rules are namespaced under `react-doctor/*`.
 
+Rules in the `security-scan` bucket are project-level project-wide file scans (leaked artifact secrets, permissive Firebase/Supabase rules, committed key material, …). They register metadata here but are no-ops under plain oxlint or ESLint — the [React Doctor CLI](https://npmjs.com/package/react-doctor) executes them over a whole-tree file walk during its scan.
+
 Each rule can be set to `"error"`, `"warn"`, or `"off"`:
 
 ```jsonc
diff --git a/packages/oxlint-plugin-react-doctor/scripts/generate-rule-registry.mjs b/packages/oxlint-plugin-react-doctor/scripts/generate-rule-registry.mjs
index 48df822e3..87a7732ab 100644
--- a/packages/oxlint-plugin-react-doctor/scripts/generate-rule-registry.mjs
+++ b/packages/oxlint-plugin-react-doctor/scripts/generate-rule-registry.mjs
@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 // Generates `src/plugin/rule-registry.ts` by scanning every per-rule file
-// under `src/plugin/rules/<bucket>/<rule>.ts` for its
-//   export const <identifier> = defineRule<Rule>({ id: "<rule-id>", ... })
+// under `src/plugin/rules/<bucket>/<rule>.ts` for its single
+//   export const <identifier> = defineRule({ id: "<rule-id>", ... })
 //   export const <identifier> = defineRetiredRule({ id: "<rule-id>", ... })
-// declaration. The bucket directory determines the rule's `framework` and
-// its default `category`; the rule file may override the category with an
-// explicit field. `framework` is never on the rule itself.
+// declaration (one rule file = one rule). The bucket directory determines
+// the rule's `framework` and its default `category`; the rule file may
+// override the category with an explicit field. `framework` is never on
+// the rule itself.
 //
 // Output is committed to git so consumers don't need to run codegen.
 // `pnpm gen` re-runs whenever a rule is added / removed / renamed.
@@ -60,6 +61,7 @@ const BUCKETS_REQUIRING_REACT = new Set([
 // inherit a bucket tag and carry its own.
 const BUCKET_TO_AUTO_TAGS = {
   "react-native": ["react-native"],
+  "security-scan": ["security-scan"],
   server: ["server-action"],
 };
 
@@ -153,6 +155,7 @@ const BUCKET_TO_DEFAULT_CATEGORY = {
   "react-native": "React Native",
   "react-ui": "Accessibility",
   security: "Security",
+  "security-scan": "Security",
   server: "Server",
   "state-and-effects": "State & Effects",
   "tanstack-query": "TanStack Query",
@@ -181,7 +184,9 @@ for (const bucket of fs.readdirSync(PLUGIN_RULES_ROOT, { withFileTypes: true }))
     // (e.g. `defineRule<Foo<Bar>>(`) and the no-generic `defineRule({` form,
     // where the original `<[^>]+>` matcher silently failed and dropped the rule.
     // `defineRetiredRule` follows the same metadata shape but intentionally
-    // emits a no-op rule for legacy config compatibility.
+    // emits a no-op rule for legacy config compatibility; Scan rules
+    // (a `scan` field instead of `create`) also register through plain
+    // `defineRule`.
     const exportMatch = source.match(
       /export\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*(?:defineRule|defineRetiredRule)\b[^(]*\(\s*\{/,
     );
diff --git a/packages/oxlint-plugin-react-doctor/src/index.ts b/packages/oxlint-plugin-react-doctor/src/index.ts
index 2de94f3b4..80ed2fa42 100644
--- a/packages/oxlint-plugin-react-doctor/src/index.ts
+++ b/packages/oxlint-plugin-react-doctor/src/index.ts
@@ -20,6 +20,11 @@ export {
 
 export { MOTION_LIBRARY_PACKAGES } from "./plugin/constants/style.js";
 
+export {
+  classifySecurityScanFile,
+  shouldReadSecurityScanContent,
+} from "./plugin/rules/security-scan/utils/classify-security-scan-file.js";
+
 export {
   REACT_NATIVE_DEPENDENCY_NAMES,
   REACT_NATIVE_DEPENDENCY_PREFIXES,
@@ -28,6 +33,7 @@ export {
 
 export type { OxlintRuleSeverity } from "./types.js";
 export type { EsTreeNode } from "./plugin/utils/es-tree-node.js";
+export type { ScanFinding, FileScan, ScannedFile } from "./plugin/utils/file-scan.js";
 export type { Rule, RuleFramework, RuleSeverity } from "./plugin/utils/rule.js";
 export type { RulePlugin } from "./plugin/utils/rule-plugin.js";
 export type { RuleVisitors } from "./plugin/utils/rule-visitors.js";
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/constants/security-scan.ts b/packages/oxlint-plugin-react-doctor/src/plugin/constants/security-scan.ts
new file mode 100644
index 000000000..f3d661168
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/constants/security-scan.ts
@@ -0,0 +1,55 @@
+// Path/context patterns shared by MULTIPLE security-scan scan rules
+// (see `src/plugin/utils/file-scan.ts` for what a file scan is).
+// Patterns used by exactly one rule stay module-local in that rule's file.
+// Secret-value patterns shared with the AST secret rules live next to
+// SECRET_PATTERNS in `./security.ts`.
+
+export const TEXT_FILE_PATTERN =
+  /\.(?:[cm]?[jt]sx?|json|jsonc|map|html?|mdx?|ya?ml|toml|sql|rules|env|txt|log|svg|xml|pem|key|crt|cert|pub|py|php)$/i;
+
+export const DOTENV_FILE_PATTERN = /(?:^|\/)\.env(?:\.|$)/;
+
+export const SOURCE_FILE_PATTERN = /\.(?:[cm]?[jt]sx?)$/i;
+
+export const SCRIPT_SOURCE_FILE_PATTERN = /\.(?:[cm]?[jt]sx?|py|php)$/i;
+
+export const DATABASE_SOURCE_FILE_PATTERN = /\.(?:[cm]?[jt]sx?|py)$/i;
+
+export const SERVER_CONTEXT_PATTERN =
+  /(?:^|\/)(?:api|backend|server|servers|middleware|route|routes|functions|lambdas|workers)(?:\/|$)|(?:^|\/)[^/]+\.server\.[cm]?[jt]sx?$/i;
+
+export const TEST_CONTEXT_PATTERN =
+  /(?:^|\/)(?:__fixtures__|__mocks__|__tests__|fixtures|mocks|test|tests|testdata|test-data|e2e|playwright)(?:\/|$)|\.(?:test|spec|e2e|e2e-spec|integration-test|fixture|fixtures|stories|story)\.[cm]?[jt]sx?$|(?:^|\/)(?:test_[^/]+|[^/]+_test|conftest)\.py$|\.env\.[^/]*(?:test|e2e)[^/]*$/i;
+
+// `tools/` is deliberately not excluded: agent/MCP tool definitions live there.
+export const BUILD_SCRIPT_CONTEXT_PATTERN = /(?:^|\/)scripts(?:\/|$)/i;
+
+export const DEMO_CONTEXT_PATTERN =
+  /(?:^|\/)(?:examples?|tutorials?|demos?|samples?|playgrounds?)(?:\/|$)/i;
+
+export const DOCUMENTATION_CONTEXT_PATTERN =
+  /(?:^|\/)(?:README|CHANGELOG|CONTRIBUTING|PUBLISHING|DOCS)\.mdx?$|\.mdx?$/i;
+
+// Vendored directories and version-pinned filenames (`jsonwebtoken@8.5.1.js`)
+// are third-party code the project does not own; their internals (cipher
+// tables, exec helpers) are not this repository's security posture.
+export const GENERATED_SOURCE_CONTEXT_PATTERN =
+  /(?:^|\/)(?:generated|__generated__|dist|build|coverage|out|storybook-static|vendor|vendors|third[-_]?party|libraries)(?:\/|$)|(?:^|\/)\.next\/|(?:^|\/)\.yarn\/|(?:^|\/)public\/(?:chunks?|assets?|build|dist|static)\/|(?:generated|\.gen)\.[cm]?[jt]sx?$|@\d+\.\d+\.\d+(?:[-.][\w.]+)?\.[cm]?js$|[.-]min\.[cm]?js$|\.asm\.js$|(?:^|\/)[\w-]+[.@-]\d+\.\d+\.\d+(?:[-.][\w.]+)?\//i;
+
+// Filename-only bundle test (the walker content-sniffs minified files
+// separately). Distinct from @react-doctor/core's same-named pattern,
+// which also matches `.mjs`.
+export const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.js$/i;
+
+export const BROWSER_ARTIFACT_PATH_PATTERNS = [
+  /(?:^|\/)\.next\/static\//,
+  /(?:^|\/)\.output\/public\//,
+  /(?:^|\/)build\/static\//,
+  /(?:^|\/)dist\/assets\//,
+  /(?:^|\/)public\//,
+  /(?:^|\/)out\//,
+  /(?:^|\/)storybook-static\//,
+];
+
+export const AGENT_TOOL_DANGEROUS_CAPABILITY_PATTERN =
+  /\b(?:exec|execSync|spawn|child_process|eval|new Function|vm\.run|readFile|writeFile|fs\.read|fs\.write|fetch|axios|http\.request|sandbox|runCode|executeCode)\b/;
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/constants/security.ts b/packages/oxlint-plugin-react-doctor/src/plugin/constants/security.ts
index c1f99a987..fec31f391 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/constants/security.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/constants/security.ts
@@ -56,6 +56,56 @@ export const SECRET_PATTERNS = [
   /^sk-[a-zA-Z0-9]{32,}$/,
 ];
 
+// Whole-content credential patterns for the security-scan scan rules
+// (unanchored sweep over full file contents), distinct from
+// SECRET_PATTERNS above, which anchor individual string-literal values
+// for `no-secrets-in-client-code`. Kept byte-identical to the original
+// scanner; unifying the two families is a tracked follow-up — do not
+// merge them without re-validating both consumers.
+export const SECRET_VALUE_PATTERNS = [
+  /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/,
+  /\bAWS_SECRET_ACCESS_KEY\s*[:=]\s*["']?[A-Za-z0-9/+=]{35,}["']?/,
+  /\bgithub_pat_[A-Za-z0-9_]{30,}\b/,
+  /\bgh[pousr]_[A-Za-z0-9]{30,}\b/,
+  /\bglpat-[A-Za-z0-9_-]{20,}\b/,
+  /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/,
+  /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/,
+  /\brk_(?:live|test)_[A-Za-z0-9]{16,}\b/,
+  /\bsk-[A-Za-z0-9_-]{32,}\b/,
+  /\bsk-ant-api\d{2}-[A-Za-z0-9_-]{20,}\b/,
+  /\blin_(?:api|oauth)_[A-Za-z0-9]{20,}\b/,
+  /\bvercel_[A-Za-z0-9]{20,}\b/,
+  /\bsntrys_[A-Za-z0-9_-]{20,}\b/,
+  /\bkey-[a-f0-9]{32}\b/i,
+  /\bnpm_[A-Za-z0-9]{30,}\b/,
+  /\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/,
+  /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/,
+  /https:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/,
+  /\bsb_secret_[A-Za-z0-9_]{20,}\b/,
+  /\bservice_role\b/i,
+  /"private_key"\s*:\s*"-----BEGIN PRIVATE KEY-----/,
+  /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/,
+  // Placeholder credentials (postgres://user:pass@..., myusername:mypassword)
+  // are how compose templates and sample envs document the URL shape, and a
+  // dotless host is a docker-network service name (or localhost) that no
+  // credential can reach from outside the deployment.
+  /\b(?:postgres|mysql|mongodb(?:\+srv)?|redis):\/\/[^:\s/@]+:(?!(?:pass(?:word)?|my[a-z]*pass(?:word)?|mysecretpassword|myusername|postgres|mysql|redis|root|admin|minioadmin|secret|example|changeme|change_me|test|guest|placeholder|default|user(?:name)?|x{3,}|\*{2,}|\$\{[^}]*\}|\$[A-Z_]+|<[^>]*>|%[\w.]+%|\{\{[^}]*\}\})@)[^@\s/]+@(?!(?:localhost|127\.0\.0\.1|0\.0\.0\.0|host\.docker\.internal)(?:[:/\s]|$))[^\s:/@]*\./i,
+];
+
+export const PUBLIC_ENV_SECRET_NAME_PATTERN =
+  /\b(?:NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC)_[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PRIVATE|DATABASE_URL|SERVICE_ROLE|AWS_ACCESS_KEY|AWS_SECRET)[A-Z0-9_]*\b/i;
+
+export const FULL_ENV_LEAK_CONTEXT_PATTERN =
+  /\b(?:process\.env|import\.meta\.env|window\.__[A-Z0-9_]*ENV[A-Z0-9_]*__|__[A-Z0-9_]*ENV[A-Z0-9_]*__)\b/;
+
+export const FULL_ENV_LEAK_SECRET_NAME_PATTERN =
+  /\b(?:DATABASE_URL|AWS_SECRET_ACCESS_KEY|AWS_ACCESS_KEY_ID|MAILGUN_API_KEY|SALESFORCE_CLIENT_SECRET|OKTA_CLIENT_SECRET|SESSION_SECRET|COOKIE_SECRET|PRIVATE_KEY|SERVICE_ROLE)\b/;
+
+// TODO(follow-up): de-overfit — several vendor names here mirror specific
+// regression fixtures (TLDRAW / POSTHOG / ALGOLIA / GC_API_KEY).
+export const TRUSTED_PUBLIC_SECRET_NAME_PATTERN =
+  /(?:SENTRY_DSN|PUBLIC_KEY|PUBLISHABLE|ANON_KEY|POSTHOG_(?:PROJECT_)?TOKEN|POSTHOG_KEY|TLDRAW_LICENSE_KEY|CLERK_PUBLISHABLE_KEY|ALGOLIA_SEARCH_KEY|GC_API_KEY|GOOGLE_MAPS_API_KEY|MAPBOX_TOKEN|MIXPANEL_TOKEN|(?:NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC)_(?:DISABLE|ENABLE|ALLOW|REQUIRE)_)/i;
+
 // Public, client-safe keys designed to ship in the browser, each with a
 // prefix distinct from the same vendor's secret key (RevenueCat `appl_`
 // vs `sk_`, Supabase `sb_publishable_` vs `sb_secret_`, …); a literal
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.test.ts
index 80a6b2053..9b85076b4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.test.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.test.ts
@@ -3,9 +3,71 @@ import { ruleRegistry } from "./rule-registry.js";
 
 const REANIMATED_LAYOUT_RULE_ID = "rn-animate-layout-property";
 
+// The full security-scan bucket: project-level scan rules executed by
+// @react-doctor/core's check-security-scan environment check instead of
+// the oxlint AST pipeline. Inlined so an accidental bucket addition/removal
+// fails loudly here instead of silently shifting scan coverage.
+const SECURITY_POSTURE_RULE_IDS = [
+  "active-static-asset",
+  "agent-tool-capability-risk",
+  "artifact-baas-authority-surface",
+  "artifact-env-leak",
+  "artifact-secret-leak",
+  "build-pipeline-secret-boundary",
+  "clickjacking-redirect-risk",
+  "command-execution-input-risk",
+  "cors-cookie-trust-risk",
+  "dangerous-html-sink",
+  "firebase-client-owned-authz-field",
+  "firebase-permissive-rules",
+  "firebase-query-filter-as-auth",
+  "git-provider-url-injection-risk",
+  "import-metadata-execution-risk",
+  "insecure-crypto-risk",
+  "key-lifecycle-risk",
+  "local-rpc-native-bridge-risk",
+  "mcp-tool-capability-risk",
+  "mdx-ssr-execution-risk",
+  "nosql-injection-risk",
+  "package-metadata-secret",
+  "path-traversal-risk",
+  "plugin-update-trust-risk",
+  "postmessage-origin-risk",
+  "public-debug-artifact",
+  "public-env-secret-name",
+  "raw-sql-injection-risk",
+  "repository-secret-file",
+  "supabase-client-owned-authz-field",
+  "supabase-rls-policy-risk",
+  "svg-filter-clickjacking-risk",
+  "tenant-static-proxy-risk",
+  "untrusted-redirect-following",
+  "url-prefilled-privileged-action",
+  "webhook-signature-risk",
+] as const;
+
 describe("rule registry", () => {
   it("keeps the Reanimated layout-property rule retired", () => {
     expect(ruleRegistry[REANIMATED_LAYOUT_RULE_ID]?.lifecycle).toBe("retired");
     expect(ruleRegistry[REANIMATED_LAYOUT_RULE_ID]?.defaultEnabled).toBe(false);
   });
+
+  it("registers exactly the 36 known security-scan rules", () => {
+    const taggedIds = Object.entries(ruleRegistry)
+      .filter(([, rule]) => (rule.tags ?? []).includes("security-scan"))
+      .map(([ruleId]) => ruleId)
+      .sort();
+    expect(taggedIds).toHaveLength(36);
+    expect(taggedIds).toEqual([...SECURITY_POSTURE_RULE_IDS]);
+  });
+
+  it("gives every security-scan rule a scan function and no other rule a scan field", () => {
+    for (const [ruleId, rule] of Object.entries(ruleRegistry)) {
+      if ((rule.tags ?? []).includes("security-scan")) {
+        expect(typeof rule.scan, `${ruleId} should carry a scan`).toBe("function");
+      } else {
+        expect(rule.scan, `${ruleId} should not carry a scan`).toBeUndefined();
+      }
+    }
+  });
 });
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.ts
index 4f067685e..b8fc897f6 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.ts
@@ -8,8 +8,10 @@
 
 import type { Rule } from "./utils/rule.js";
 
+import { activeStaticAsset } from "./rules/security-scan/active-static-asset.js";
 import { activityWrapsEffectHeavySubtree } from "./rules/state-and-effects/activity-wraps-effect-heavy-subtree.js";
 import { advancedEventHandlerRefs } from "./rules/state-and-effects/advanced-event-handler-refs.js";
+import { agentToolCapabilityRisk } from "./rules/security-scan/agent-tool-capability-risk.js";
 import { altText } from "./rules/a11y/alt-text.js";
 import { anchorAmbiguousText } from "./rules/a11y/anchor-ambiguous-text.js";
 import { anchorHasContent } from "./rules/a11y/anchor-has-content.js";
@@ -19,16 +21,24 @@ import { ariaProps } from "./rules/a11y/aria-props.js";
 import { ariaProptypes } from "./rules/a11y/aria-proptypes.js";
 import { ariaRole } from "./rules/a11y/aria-role.js";
 import { ariaUnsupportedElements } from "./rules/a11y/aria-unsupported-elements.js";
+import { artifactBaasAuthoritySurface } from "./rules/security-scan/artifact-baas-authority-surface.js";
+import { artifactEnvLeak } from "./rules/security-scan/artifact-env-leak.js";
+import { artifactSecretLeak } from "./rules/security-scan/artifact-secret-leak.js";
 import { asyncAwaitInLoop } from "./rules/js-performance/async-await-in-loop.js";
 import { asyncDeferAwait } from "./rules/performance/async-defer-await.js";
 import { asyncParallel } from "./rules/js-performance/async-parallel.js";
 import { autocompleteValid } from "./rules/a11y/autocomplete-valid.js";
+import { buildPipelineSecretBoundary } from "./rules/security-scan/build-pipeline-secret-boundary.js";
 import { buttonHasType } from "./rules/react-builtins/button-has-type.js";
 import { checkedRequiresOnchangeOrReadonly } from "./rules/react-builtins/checked-requires-onchange-or-readonly.js";
 import { clickEventsHaveKeyEvents } from "./rules/a11y/click-events-have-key-events.js";
+import { clickjackingRedirectRisk } from "./rules/security-scan/clickjacking-redirect-risk.js";
 import { clientLocalstorageNoVersion } from "./rules/client/client-localstorage-no-version.js";
 import { clientPassiveEventListeners } from "./rules/client/client-passive-event-listeners.js";
+import { commandExecutionInputRisk } from "./rules/security-scan/command-execution-input-risk.js";
 import { controlHasAssociatedLabel } from "./rules/a11y/control-has-associated-label.js";
+import { corsCookieTrustRisk } from "./rules/security-scan/cors-cookie-trust-risk.js";
+import { dangerousHtmlSink } from "./rules/security-scan/dangerous-html-sink.js";
 import { noEmDashInJsxText } from "./rules/react-ui/no-em-dash-in-jsx-text.js";
 import { noRedundantPaddingAxes } from "./rules/react-ui/no-redundant-padding-axes.js";
 import { noRedundantSizeAxes } from "./rules/react-ui/no-redundant-size-axes.js";
@@ -39,10 +49,14 @@ import { displayName } from "./rules/react-builtins/display-name.js";
 import { effectNeedsCleanup } from "./rules/state-and-effects/effect-needs-cleanup.js";
 import { exhaustiveDeps } from "./rules/react-builtins/exhaustive-deps.js";
 import { expoNoNonInlinedEnv } from "./rules/react-native/expo-no-non-inlined-env.js";
+import { firebaseClientOwnedAuthzField } from "./rules/security-scan/firebase-client-owned-authz-field.js";
+import { firebasePermissiveRules } from "./rules/security-scan/firebase-permissive-rules.js";
+import { firebaseQueryFilterAsAuth } from "./rules/security-scan/firebase-query-filter-as-auth.js";
 import { forbidComponentProps } from "./rules/react-builtins/forbid-component-props.js";
 import { forbidDomProps } from "./rules/react-builtins/forbid-dom-props.js";
 import { forbidElements } from "./rules/react-builtins/forbid-elements.js";
 import { forwardRefUsesRef } from "./rules/react-builtins/forward-ref-uses-ref.js";
+import { gitProviderUrlInjectionRisk } from "./rules/security-scan/git-provider-url-injection-risk.js";
 import { headingHasContent } from "./rules/a11y/heading-has-content.js";
 import { hookUseState } from "./rules/react-builtins/hook-use-state.js";
 import { hooksNoNanInDeps } from "./rules/state-and-effects/hooks-no-nan-in-deps.js";
@@ -53,6 +67,8 @@ import { htmlNoNestedInteractive } from "./rules/correctness/html-no-nested-inte
 import { iframeHasTitle } from "./rules/a11y/iframe-has-title.js";
 import { iframeMissingSandbox } from "./rules/react-builtins/iframe-missing-sandbox.js";
 import { imgRedundantAlt } from "./rules/a11y/img-redundant-alt.js";
+import { importMetadataExecutionRisk } from "./rules/security-scan/import-metadata-execution-risk.js";
+import { insecureCryptoRisk } from "./rules/security-scan/insecure-crypto-risk.js";
 import { interactiveSupportsFocus } from "./rules/a11y/interactive-supports-focus.js";
 import { jotaiDerivedAtomReturnsFreshObject } from "./rules/jotai/jotai-derived-atom-returns-fresh-object.js";
 import { jotaiSelectAtomInRenderBody } from "./rules/jotai/jotai-select-atom-in-render-body.js";
@@ -91,8 +107,12 @@ import { jsxNoUselessFragment } from "./rules/react-builtins/jsx-no-useless-frag
 import { jsxPascalCase } from "./rules/react-builtins/jsx-pascal-case.js";
 import { jsxPropsNoSpreadMulti } from "./rules/react-builtins/jsx-props-no-spread-multi.js";
 import { jsxPropsNoSpreading } from "./rules/react-builtins/jsx-props-no-spreading.js";
+import { keyLifecycleRisk } from "./rules/security-scan/key-lifecycle-risk.js";
 import { labelHasAssociatedControl } from "./rules/a11y/label-has-associated-control.js";
 import { lang } from "./rules/a11y/lang.js";
+import { localRpcNativeBridgeRisk } from "./rules/security-scan/local-rpc-native-bridge-risk.js";
+import { mcpToolCapabilityRisk } from "./rules/security-scan/mcp-tool-capability-risk.js";
+import { mdxSsrExecutionRisk } from "./rules/security-scan/mdx-ssr-execution-risk.js";
 import { mediaHasCaption } from "./rules/a11y/media-has-caption.js";
 import { mouseEventsHaveKeyEvents } from "./rules/a11y/mouse-events-have-key-events.js";
 import { nextjsAsyncClientComponent } from "./rules/nextjs/nextjs-async-client-component.js";
@@ -227,7 +247,12 @@ import { noUsememoSimpleExpression } from "./rules/performance/no-usememo-simple
 import { noWideLetterSpacing } from "./rules/design/no-wide-letter-spacing.js";
 import { noWillUpdateSetState } from "./rules/react-builtins/no-will-update-set-state.js";
 import { noZIndex9999 } from "./rules/design/no-z-index9999.js";
+import { nosqlInjectionRisk } from "./rules/security-scan/nosql-injection-risk.js";
 import { onlyExportComponents } from "./rules/react-builtins/only-export-components.js";
+import { packageMetadataSecret } from "./rules/security-scan/package-metadata-secret.js";
+import { pathTraversalRisk } from "./rules/security-scan/path-traversal-risk.js";
+import { pluginUpdateTrustRisk } from "./rules/security-scan/plugin-update-trust-risk.js";
+import { postmessageOriginRisk } from "./rules/security-scan/postmessage-origin-risk.js";
 import { preactNoChildrenLength } from "./rules/preact/preact-no-children-length.js";
 import { preactNoReactHooksImport } from "./rules/preact/preact-no-react-hooks-import.js";
 import { preactNoRenderArguments } from "./rules/preact/preact-no-render-arguments.js";
@@ -245,6 +270,8 @@ import { preferTagOverRole } from "./rules/a11y/prefer-tag-over-role.js";
 import { preferUseEffectEvent } from "./rules/state-and-effects/prefer-use-effect-event.js";
 import { preferUseSyncExternalStore } from "./rules/state-and-effects/prefer-use-sync-external-store.js";
 import { preferUseReducer } from "./rules/state-and-effects/prefer-use-reducer.js";
+import { publicDebugArtifact } from "./rules/security-scan/public-debug-artifact.js";
+import { publicEnvSecretName } from "./rules/security-scan/public-env-secret-name.js";
 import { queryDestructureResult } from "./rules/tanstack-query/query-destructure-result.js";
 import { queryMutationMissingInvalidation } from "./rules/tanstack-query/query-mutation-missing-invalidation.js";
 import { queryNoQueryInEffect } from "./rules/tanstack-query/query-no-query-in-effect.js";
@@ -252,6 +279,7 @@ import { queryNoRestDestructuring } from "./rules/tanstack-query/query-no-rest-d
 import { queryNoUseQueryForMutation } from "./rules/tanstack-query/query-no-use-query-for-mutation.js";
 import { queryNoVoidQueryFn } from "./rules/tanstack-query/query-no-void-query-fn.js";
 import { queryStableQueryClient } from "./rules/tanstack-query/query-stable-query-client.js";
+import { rawSqlInjectionRisk } from "./rules/security-scan/raw-sql-injection-risk.js";
 import { reactCompilerNoManualMemoization } from "./rules/architecture/react-compiler-no-manual-memoization.js";
 import { reactInJsxScope } from "./rules/react-builtins/react-in-jsx-scope.js";
 import { reduxUseselectorInlineDerivation } from "./rules/state-and-effects/redux-useselector-inline-derivation.js";
@@ -264,6 +292,7 @@ import { renderingHydrationNoFlicker } from "./rules/performance/rendering-hydra
 import { renderingScriptDeferAsync } from "./rules/performance/rendering-script-defer-async.js";
 import { renderingSvgPrecision } from "./rules/correctness/rendering-svg-precision.js";
 import { renderingUsetransitionLoading } from "./rules/performance/rendering-usetransition-loading.js";
+import { repositorySecretFile } from "./rules/security-scan/repository-secret-file.js";
 import { requireRenderReturn } from "./rules/react-builtins/require-render-return.js";
 import { rerenderDeferReadsHook } from "./rules/state-and-effects/rerender-defer-reads-hook.js";
 import { rerenderDependencies } from "./rules/state-and-effects/rerender-dependencies.js";
@@ -324,6 +353,9 @@ import { serverNoMutableModuleState } from "./rules/server/server-no-mutable-mod
 import { serverSequentialIndependentAwait } from "./rules/server/server-sequential-independent-await.js";
 import { stateInConstructor } from "./rules/react-builtins/state-in-constructor.js";
 import { stylePropObject } from "./rules/react-builtins/style-prop-object.js";
+import { supabaseClientOwnedAuthzField } from "./rules/security-scan/supabase-client-owned-authz-field.js";
+import { supabaseRlsPolicyRisk } from "./rules/security-scan/supabase-rls-policy-risk.js";
+import { svgFilterClickjackingRisk } from "./rules/security-scan/svg-filter-clickjacking-risk.js";
 import { tabindexNoPositive } from "./rules/a11y/tabindex-no-positive.js";
 import { tanstackStartGetMutation } from "./rules/tanstack-start/tanstack-start-get-mutation.js";
 import { tanstackStartLoaderParallelFetch } from "./rules/tanstack-start/tanstack-start-loader-parallel-fetch.js";
@@ -339,14 +371,30 @@ import { tanstackStartRedirectInTryCatch } from "./rules/tanstack-start/tanstack
 import { tanstackStartRoutePropertyOrder } from "./rules/tanstack-start/tanstack-start-route-property-order.js";
 import { tanstackStartServerFnMethodOrder } from "./rules/tanstack-start/tanstack-start-server-fn-method-order.js";
 import { tanstackStartServerFnValidateInput } from "./rules/tanstack-start/tanstack-start-server-fn-validate-input.js";
+import { tenantStaticProxyRisk } from "./rules/security-scan/tenant-static-proxy-risk.js";
+import { untrustedRedirectFollowing } from "./rules/security-scan/untrusted-redirect-following.js";
+import { urlPrefilledPrivilegedAction } from "./rules/security-scan/url-prefilled-privileged-action.js";
 import { useLazyMotion } from "./rules/bundle-size/use-lazy-motion.js";
 import { voidDomElementsNoChildren } from "./rules/react-builtins/void-dom-elements-no-children.js";
+import { webhookSignatureRisk } from "./rules/security-scan/webhook-signature-risk.js";
 import { zodV4NoDeprecatedErrorApis } from "./rules/zod/zod-v4-no-deprecated-error-apis.js";
 import { zodV4NoDeprecatedErrorCustomization } from "./rules/zod/zod-v4-no-deprecated-error-customization.js";
 import { zodV4NoDeprecatedSchemaApis } from "./rules/zod/zod-v4-no-deprecated-schema-apis.js";
 import { zodV4PreferTopLevelStringFormats } from "./rules/zod/zod-v4-prefer-top-level-string-formats.js";
 
 export const reactDoctorRules = [
+  {
+    key: "react-doctor/active-static-asset",
+    id: "active-static-asset",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...activeStaticAsset,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(activeStaticAsset.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/activity-wraps-effect-heavy-subtree",
     id: "activity-wraps-effect-heavy-subtree",
@@ -371,6 +419,18 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(advancedEventHandlerRefs.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/agent-tool-capability-risk",
+    id: "agent-tool-capability-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...agentToolCapabilityRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(agentToolCapabilityRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/alt-text",
     id: "alt-text",
@@ -479,6 +539,42 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(ariaUnsupportedElements.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/artifact-baas-authority-surface",
+    id: "artifact-baas-authority-surface",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...artifactBaasAuthoritySurface,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(artifactBaasAuthoritySurface.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/artifact-env-leak",
+    id: "artifact-env-leak",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...artifactEnvLeak,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(artifactEnvLeak.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/artifact-secret-leak",
+    id: "artifact-secret-leak",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...artifactSecretLeak,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(artifactSecretLeak.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/async-await-in-loop",
     id: "async-await-in-loop",
@@ -525,6 +621,18 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(autocompleteValid.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/build-pipeline-secret-boundary",
+    id: "build-pipeline-secret-boundary",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...buildPipelineSecretBoundary,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(buildPipelineSecretBoundary.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/button-has-type",
     id: "button-has-type",
@@ -561,6 +669,18 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(clickEventsHaveKeyEvents.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/clickjacking-redirect-risk",
+    id: "clickjacking-redirect-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...clickjackingRedirectRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(clickjackingRedirectRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/client-localstorage-no-version",
     id: "client-localstorage-no-version",
@@ -585,6 +705,18 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(clientPassiveEventListeners.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/command-execution-input-risk",
+    id: "command-execution-input-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...commandExecutionInputRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(commandExecutionInputRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/control-has-associated-label",
     id: "control-has-associated-label",
@@ -597,6 +729,30 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(controlHasAssociatedLabel.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/cors-cookie-trust-risk",
+    id: "cors-cookie-trust-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...corsCookieTrustRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(corsCookieTrustRisk.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/dangerous-html-sink",
+    id: "dangerous-html-sink",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...dangerousHtmlSink,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(dangerousHtmlSink.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/design-no-em-dash-in-jsx-text",
     id: "design-no-em-dash-in-jsx-text",
@@ -717,6 +873,42 @@ export const reactDoctorRules = [
       tags: [...new Set(["react-native", ...(expoNoNonInlinedEnv.tags ?? [])])],
     },
   },
+  {
+    key: "react-doctor/firebase-client-owned-authz-field",
+    id: "firebase-client-owned-authz-field",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...firebaseClientOwnedAuthzField,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(firebaseClientOwnedAuthzField.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/firebase-permissive-rules",
+    id: "firebase-permissive-rules",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...firebasePermissiveRules,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(firebasePermissiveRules.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/firebase-query-filter-as-auth",
+    id: "firebase-query-filter-as-auth",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...firebaseQueryFilterAsAuth,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(firebaseQueryFilterAsAuth.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/forbid-component-props",
     id: "forbid-component-props",
@@ -765,6 +957,18 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(forwardRefUsesRef.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/git-provider-url-injection-risk",
+    id: "git-provider-url-injection-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...gitProviderUrlInjectionRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(gitProviderUrlInjectionRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/heading-has-content",
     id: "heading-has-content",
@@ -882,6 +1086,30 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(imgRedundantAlt.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/import-metadata-execution-risk",
+    id: "import-metadata-execution-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...importMetadataExecutionRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(importMetadataExecutionRisk.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/insecure-crypto-risk",
+    id: "insecure-crypto-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...insecureCryptoRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(insecureCryptoRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/interactive-supports-focus",
     id: "interactive-supports-focus",
@@ -1324,6 +1552,18 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(jsxPropsNoSpreading.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/key-lifecycle-risk",
+    id: "key-lifecycle-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...keyLifecycleRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(keyLifecycleRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/label-has-associated-control",
     id: "label-has-associated-control",
@@ -1348,6 +1588,42 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(lang.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/local-rpc-native-bridge-risk",
+    id: "local-rpc-native-bridge-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...localRpcNativeBridgeRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(localRpcNativeBridgeRisk.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/mcp-tool-capability-risk",
+    id: "mcp-tool-capability-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...mcpToolCapabilityRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(mcpToolCapabilityRisk.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/mdx-ssr-execution-risk",
+    id: "mdx-ssr-execution-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...mdxSsrExecutionRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(mdxSsrExecutionRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/media-has-caption",
     id: "media-has-caption",
@@ -2897,6 +3173,18 @@ export const reactDoctorRules = [
       category: "Maintainability",
     },
   },
+  {
+    key: "react-doctor/nosql-injection-risk",
+    id: "nosql-injection-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...nosqlInjectionRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(nosqlInjectionRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/only-export-components",
     id: "only-export-components",
@@ -2909,6 +3197,54 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(onlyExportComponents.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/package-metadata-secret",
+    id: "package-metadata-secret",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...packageMetadataSecret,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(packageMetadataSecret.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/path-traversal-risk",
+    id: "path-traversal-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...pathTraversalRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(pathTraversalRisk.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/plugin-update-trust-risk",
+    id: "plugin-update-trust-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...pluginUpdateTrustRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(pluginUpdateTrustRisk.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/postmessage-origin-risk",
+    id: "postmessage-origin-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...postmessageOriginRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(postmessageOriginRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/preact-no-children-length",
     id: "preact-no-children-length",
@@ -3104,6 +3440,30 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(preferUseReducer.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/public-debug-artifact",
+    id: "public-debug-artifact",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...publicDebugArtifact,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(publicDebugArtifact.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/public-env-secret-name",
+    id: "public-env-secret-name",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...publicEnvSecretName,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(publicEnvSecretName.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/query-destructure-result",
     id: "query-destructure-result",
@@ -3181,6 +3541,18 @@ export const reactDoctorRules = [
       category: "Bugs",
     },
   },
+  {
+    key: "react-doctor/raw-sql-injection-risk",
+    id: "raw-sql-injection-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...rawSqlInjectionRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(rawSqlInjectionRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/react-compiler-no-manual-memoization",
     id: "react-compiler-no-manual-memoization",
@@ -3322,6 +3694,18 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(renderingUsetransitionLoading.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/repository-secret-file",
+    id: "repository-secret-file",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...repositorySecretFile,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(repositorySecretFile.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/require-render-return",
     id: "require-render-return",
@@ -4042,6 +4426,42 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(stylePropObject.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/supabase-client-owned-authz-field",
+    id: "supabase-client-owned-authz-field",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...supabaseClientOwnedAuthzField,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(supabaseClientOwnedAuthzField.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/supabase-rls-policy-risk",
+    id: "supabase-rls-policy-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...supabaseRlsPolicyRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(supabaseRlsPolicyRisk.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/svg-filter-clickjacking-risk",
+    id: "svg-filter-clickjacking-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...svgFilterClickjackingRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(svgFilterClickjackingRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/tabindex-no-positive",
     id: "tabindex-no-positive",
@@ -4208,6 +4628,42 @@ export const reactDoctorRules = [
       category: "Bugs",
     },
   },
+  {
+    key: "react-doctor/tenant-static-proxy-risk",
+    id: "tenant-static-proxy-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...tenantStaticProxyRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(tenantStaticProxyRisk.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/untrusted-redirect-following",
+    id: "untrusted-redirect-following",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...untrustedRedirectFollowing,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(untrustedRedirectFollowing.tags ?? [])])],
+    },
+  },
+  {
+    key: "react-doctor/url-prefilled-privileged-action",
+    id: "url-prefilled-privileged-action",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...urlPrefilledPrivilegedAction,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(urlPrefilledPrivilegedAction.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/use-lazy-motion",
     id: "use-lazy-motion",
@@ -4231,6 +4687,18 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(voidDomElementsNoChildren.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/webhook-signature-risk",
+    id: "webhook-signature-risk",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...webhookSignatureRisk,
+      framework: "global",
+      category: "Security",
+      tags: [...new Set(["security-scan", ...(webhookSignatureRisk.tags ?? [])])],
+    },
+  },
   {
     key: "react-doctor/zod-v4-no-deprecated-error-apis",
     id: "zod-v4-no-deprecated-error-apis",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/alt-text.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/alt-text.ts
index 29fe869c3..88d5139c2 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/alt-text.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/alt-text.ts
@@ -180,7 +180,7 @@ const inputTypeImageRule = (
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::alt_text`.
-export const altText = defineRule<Rule>({
+export const altText = defineRule({
   id: "alt-text",
   title: "Image missing alt text",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-ambiguous-text.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-ambiguous-text.ts
index f8dd8b3b9..758f0a981 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-ambiguous-text.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-ambiguous-text.ts
@@ -6,7 +6,6 @@ import { getJsxPropStringValue } from "../../utils/get-jsx-prop-string-value.js"
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isHiddenFromScreenReader } from "../../utils/is-hidden-from-screen-reader.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (text: string): string =>
   `Screen reader users can't tell where \`${text}\` goes, so name the destination, like "View pricing details".`;
@@ -79,7 +78,7 @@ const getAccessibleText = (
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::anchor_ambiguous_text`.
-export const anchorAmbiguousText = defineRule<Rule>({
+export const anchorAmbiguousText = defineRule({
   id: "anchor-ambiguous-text",
   title: "Ambiguous link text",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-has-content.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-has-content.ts
index 279b6a364..88451e981 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-has-content.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-has-content.ts
@@ -4,13 +4,12 @@ import { getElementType } from "../../utils/get-element-type.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isHiddenFromScreenReader } from "../../utils/is-hidden-from-screen-reader.js";
 import { objectHasAccessibleChild } from "../../utils/object-has-accessible-child.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Blind users can't follow this link because screen readers announce nothing, so add visible text, `aria-label`, or `aria-labelledby`.";
 
 // Port of `oxc_linter::rules::jsx_a11y::anchor_has_content`.
-export const anchorHasContent = defineRule<Rule>({
+export const anchorHasContent = defineRule({
   id: "anchor-has-content",
   title: "Anchor has no content",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-is-valid.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-is-valid.ts
index 65eae3e66..738fa9462 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-is-valid.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/anchor-is-valid.ts
@@ -5,7 +5,6 @@ import { getElementType } from "../../utils/get-element-type.js";
 import { getStaticTemplateLiteralValue } from "../../utils/get-static-template-literal-value.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE_MISSING_HREF =
   "Keyboard users can't reach this link because it has no `href`, so add a real `href` (or use `<button>` for actions).";
@@ -68,7 +67,7 @@ const checkValueIsEmptyOrInvalid = (
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::anchor_is_valid`.
-export const anchorIsValid = defineRule<Rule>({
+export const anchorIsValid = defineRule({
   id: "anchor-is-valid",
   title: "Anchor used as a button",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-activedescendant-has-tabindex.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-activedescendant-has-tabindex.ts
index 9f4cd0b2e..7908179c3 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-activedescendant-has-tabindex.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-activedescendant-has-tabindex.ts
@@ -5,7 +5,6 @@ import { getElementType } from "../../utils/get-element-type.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isInteractiveElement } from "../../utils/is-interactive-element.js";
 import { parseJsxValue } from "../../utils/parse-jsx-value.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Keyboard users can't focus this element with `aria-activedescendant` because it isn't tabbable, so add `tabIndex={0}`.";
@@ -13,7 +12,7 @@ const MESSAGE =
 // Port of `oxc_linter::rules::jsx_a11y::aria_activedescendant_has_tabindex`.
 // Reports HTML elements with `aria-activedescendant` that are NOT
 // implicitly tabbable AND lack a non-`<-1` `tabIndex`.
-export const ariaActivedescendantHasTabindex = defineRule<Rule>({
+export const ariaActivedescendantHasTabindex = defineRule({
   id: "aria-activedescendant-has-tabindex",
   title: "aria-activedescendant missing tabindex",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-props.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-props.ts
index 9f59902de..a3e93de9a 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-props.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-props.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getJsxAttributeName } from "../../utils/get-jsx-attribute-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import { isValidAriaProperty } from "../../constants/aria-properties.js";
 
 const buildMessage = (name: string): string =>
@@ -11,7 +10,7 @@ const buildMessage = (name: string): string =>
 // Port of `oxc_linter::rules::jsx_a11y::aria_props`. Reports any
 // attribute name starting with `aria-` that isn't a recognized WAI-ARIA
 // property.
-export const ariaProps = defineRule<Rule>({
+export const ariaProps = defineRule({
   id: "aria-props",
   title: "Invalid ARIA attribute",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-proptypes.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-proptypes.ts
index 0f2f0fc69..02b6553a8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-proptypes.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-proptypes.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getStaticTemplateLiteralValue } from "../../utils/get-static-template-literal-value.js";
 import { getJsxAttributeName } from "../../utils/get-jsx-attribute-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 // Each ARIA prop's value type, mirroring OXC's `AriaPropType` enum.
 type AriaPropType =
@@ -294,7 +293,7 @@ const isValidValueForType = (propType: AriaPropType, value: EsTreeNode): boolean
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::aria_proptypes`.
-export const ariaProptypes = defineRule<Rule>({
+export const ariaProptypes = defineRule({
   id: "aria-proptypes",
   title: "Invalid ARIA attribute value",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-role.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-role.ts
index dcd63acbc..5e406e195 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-role.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-role.ts
@@ -6,7 +6,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getElementType } from "../../utils/get-element-type.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildBaseMessage = (suffix: string): string =>
   `This \`role\` is not a valid ARIA role, so assistive tech cannot expose it correctly. Use a real, non-abstract role.${suffix}`;
@@ -31,7 +30,7 @@ const resolveSettings = (
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::aria_role`.
-export const ariaRole = defineRule<Rule>({
+export const ariaRole = defineRule({
   id: "aria-role",
   title: "Invalid ARIA role",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-unsupported-elements.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-unsupported-elements.ts
index 45c60e740..0367a66a1 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-unsupported-elements.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/aria-unsupported-elements.ts
@@ -3,7 +3,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getElementType } from "../../utils/get-element-type.js";
 import { getJsxAttributeName } from "../../utils/get-jsx-attribute-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import { RESERVED_HTML_TAGS } from "../../constants/html-tags.js";
 
 const buildMessage = (tag: string, attribute: string): string =>
@@ -12,7 +11,7 @@ const buildMessage = (tag: string, attribute: string): string =>
 // Port of `oxc_linter::rules::jsx_a11y::aria_unsupported_elements`.
 // Reports `aria-*` / `role` on reserved HTML tags (e.g. `<base>`,
 // `<head>`, `<meta>`).
-export const ariaUnsupportedElements = defineRule<Rule>({
+export const ariaUnsupportedElements = defineRule({
   id: "aria-unsupported-elements",
   title: "ARIA on unsupported element",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/autocomplete-valid.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/autocomplete-valid.ts
index 4aa55918b..1fb532265 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/autocomplete-valid.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/autocomplete-valid.ts
@@ -3,7 +3,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getElementType } from "../../utils/get-element-type.js";
 import { getJsxPropStringValue } from "../../utils/get-jsx-prop-string-value.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (value: string): string =>
   `Users who rely on autofill can't fill this field because \`${value}\` isn't a known token, so use a valid \`autoComplete\` token.`;
@@ -86,7 +85,7 @@ const resolveSettings = (
 
 // Port of `oxc_linter::rules::jsx_a11y::autocomplete_valid`. Validates
 // `autoComplete` against the known HTML autofill token list.
-export const autocompleteValid = defineRule<Rule>({
+export const autocompleteValid = defineRule({
   id: "autocomplete-valid",
   title: "Invalid autocomplete value",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/click-events-have-key-events.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/click-events-have-key-events.ts
index e8d989772..2870100a1 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/click-events-have-key-events.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/click-events-have-key-events.ts
@@ -7,7 +7,6 @@ import { isHiddenFromScreenReader } from "../../utils/is-hidden-from-screen-read
 import { isInteractiveElement } from "../../utils/is-interactive-element.js";
 import { isPureEventBlockerHandler } from "../../utils/is-pure-event-blocker-handler.js";
 import { isTestlikeFilename } from "../../utils/is-testlike-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import { HTML_TAGS } from "../../constants/html-tags.js";
 
 const PRESENTATION_ROLES: ReadonlySet<string> = new Set(["presentation", "none"]);
@@ -22,7 +21,7 @@ const KEY_HANDLERS = ["onKeyUp", "onKeyDown", "onKeyPress"] as const;
 // applies to non-interactive HTML elements (interactive ones already
 // support keyboard activation). Non-React JSX dialect skipping is
 // handled by the `react-jsx-only` tag via `defineRule`.
-export const clickEventsHaveKeyEvents = defineRule<Rule>({
+export const clickEventsHaveKeyEvents = defineRule({
   id: "click-events-have-key-events",
   title: "Click handler missing keyboard handler",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/control-has-associated-label.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/control-has-associated-label.ts
index f0d913e62..deef26d91 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/control-has-associated-label.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/control-has-associated-label.ts
@@ -14,7 +14,6 @@ import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactComponentName } from "../../utils/is-react-component-name.js";
 import { isTestlikeFilename } from "../../utils/is-testlike-filename.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Blind users can't tell what this control does because screen readers find no label, so add visible text, `aria-label`, or `aria-labelledby`.";
@@ -285,7 +284,7 @@ const hasHtmlForLabel = (
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::control_has_associated_label`.
-export const controlHasAssociatedLabel = defineRule<Rule>({
+export const controlHasAssociatedLabel = defineRule({
   id: "control-has-associated-label",
   title: "Control missing accessible label",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/heading-has-content.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/heading-has-content.ts
index 9aa6b7990..6fbe254d2 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/heading-has-content.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/heading-has-content.ts
@@ -5,7 +5,6 @@ import { getElementType } from "../../utils/get-element-type.js";
 import { isHiddenFromScreenReader } from "../../utils/is-hidden-from-screen-reader.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { objectHasAccessibleChild } from "../../utils/object-has-accessible-child.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Blind users can't use this heading to navigate because screen readers skip it empty, so add text, `aria-label`, or `aria-labelledby`.";
@@ -32,7 +31,7 @@ const resolveSettings = (
 // Port of `oxc_linter::rules::jsx_a11y::heading_has_content`. Reports
 // heading elements (h1-h6 + configured aliases) without accessible
 // content (visible text / aria-label / dangerouslySetInnerHTML).
-export const headingHasContent = defineRule<Rule>({
+export const headingHasContent = defineRule({
   id: "heading-has-content",
   title: "Heading has no content",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/html-has-lang.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/html-has-lang.ts
index db18591df..b62c9e6ea 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/html-has-lang.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/html-has-lang.ts
@@ -5,7 +5,6 @@ import { getElementType } from "../../utils/get-element-type.js";
 import { getStaticTemplateLiteralValue } from "../../utils/get-static-template-literal-value.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Screen readers may mispronounce this page because it doesn't declare a language, so add a `lang` attribute like `en`.";
@@ -68,7 +67,7 @@ const evaluateLang = (attributeValue: EsTreeNode | null | undefined): LangVerdic
 // `<html>` (or configured aliases) without a lang attribute, OR with
 // a statically-empty / falsy value. Spread attributes count as
 // "missing lang".
-export const htmlHasLang = defineRule<Rule>({
+export const htmlHasLang = defineRule({
   id: "html-has-lang",
   title: "html element missing lang",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/iframe-has-title.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/iframe-has-title.ts
index 0a249183d..4a54fd163 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/iframe-has-title.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/iframe-has-title.ts
@@ -5,7 +5,6 @@ import { getElementType } from "../../utils/get-element-type.js";
 import { getStaticTemplateLiteralValue } from "../../utils/get-static-template-literal-value.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Screen reader users cannot identify this `<iframe>` because it has no title. Add a `title` that describes its content.";
@@ -44,7 +43,7 @@ const evaluateTitleValue = (value: EsTreeNode | null | undefined): StaticVerdict
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::iframe_has_title`.
-export const iframeHasTitle = defineRule<Rule>({
+export const iframeHasTitle = defineRule({
   id: "iframe-has-title",
   title: "iframe missing title",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/img-redundant-alt.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/img-redundant-alt.ts
index 7ac309c3f..6f84b3c4d 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/img-redundant-alt.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/img-redundant-alt.ts
@@ -6,7 +6,6 @@ import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isGeneratedImageRenderContext } from "../../utils/is-generated-image-render-context.js";
 import { isHiddenFromScreenReader } from "../../utils/is-hidden-from-screen-reader.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleVisitors } from "../../utils/rule-visitors.js";
 
 const MESSAGE =
@@ -83,7 +82,7 @@ const altValueRedundant = (
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::img_redundant_alt`.
-export const imgRedundantAlt = defineRule<Rule>({
+export const imgRedundantAlt = defineRule({
   id: "img-redundant-alt",
   title: "Redundant words in image alt",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/interactive-supports-focus.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/interactive-supports-focus.ts
index 6e01af90c..eef43910a 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/interactive-supports-focus.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/interactive-supports-focus.ts
@@ -12,7 +12,6 @@ import { isInteractiveRole } from "../../utils/is-interactive-role.js";
 import { isNonInteractiveElement } from "../../utils/is-non-interactive-element.js";
 import { isNonInteractiveRole } from "../../utils/is-non-interactive-role.js";
 import { isPresentationRole } from "../../utils/is-presentation-role.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildTabbableMessage = (role: string): string =>
   `Keyboard users can't tab to this '${role}' because it isn't focusable, so add \`tabIndex={0}\`.`;
@@ -46,7 +45,7 @@ const resolveSettings = (
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::interactive_supports_focus`.
-export const interactiveSupportsFocus = defineRule<Rule>({
+export const interactiveSupportsFocus = defineRule({
   id: "interactive-supports-focus",
   title: "Interactive element not focusable",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/label-has-associated-control.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/label-has-associated-control.ts
index fd771f369..c55186ada 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/label-has-associated-control.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/label-has-associated-control.ts
@@ -8,7 +8,6 @@ import { getJsxAttributeName } from "../../utils/get-jsx-attribute-name.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactComponentName } from "../../utils/is-react-component-name.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE_NO_LABEL =
   "Blind users can't identify this field because screen readers find no label text, so add visible text, `aria-label`, or `aria-labelledby`.";
@@ -193,7 +192,7 @@ const hasNestedControl = (
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::label_has_associated_control`.
-export const labelHasAssociatedControl = defineRule<Rule>({
+export const labelHasAssociatedControl = defineRule({
   id: "label-has-associated-control",
   title: "Label missing associated control",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/lang.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/lang.ts
index a68e4769d..109fdca9e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/lang.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/lang.ts
@@ -3,7 +3,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getElementType } from "../../utils/get-element-type.js";
 import { getJsxPropStringValue } from "../../utils/get-jsx-prop-string-value.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Screen readers can't pick the right voice because this `lang` isn't a real language code, so use a valid one like `en` or `en-US`.";
@@ -212,7 +211,7 @@ const isValidLangTag = (value: string): boolean => {
 
 // Port of `oxc_linter::rules::jsx_a11y::lang`. Validates `lang`
 // attribute on `<html>` and similar elements.
-export const lang = defineRule<Rule>({
+export const lang = defineRule({
   id: "lang",
   title: "Invalid lang attribute value",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/media-has-caption.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/media-has-caption.ts
index 4151a83e3..fc9e80f1f 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/media-has-caption.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/media-has-caption.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getElementType } from "../../utils/get-element-type.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   'Deaf and hard-of-hearing users need captions for this media. Add a `<track kind="captions">` inside the `<audio>` or `<video>`.';
@@ -53,7 +52,7 @@ const evaluateMuted = (attribute: EsTreeNodeOfType<"JSXAttribute"> | undefined):
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::media_has_caption`.
-export const mediaHasCaption = defineRule<Rule>({
+export const mediaHasCaption = defineRule({
   id: "media-has-caption",
   title: "Media missing captions",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/mouse-events-have-key-events.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/mouse-events-have-key-events.ts
index 810abcdb7..de471e780 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/mouse-events-have-key-events.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/mouse-events-have-key-events.ts
@@ -5,7 +5,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getElementType } from "../../utils/get-element-type.js";
 import { hasJsxProp } from "../../utils/has-jsx-prop.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMissingFocusMessage = (handler: string): string =>
   `Keyboard users miss this \`${handler}\` because it only fires with a mouse, so add an \`onFocus\` handler too.`;
@@ -42,7 +41,7 @@ const isExplicitUndefinedExpression = (value: EsTreeNode): boolean => {
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::mouse_events_have_key_events`.
-export const mouseEventsHaveKeyEvents = defineRule<Rule>({
+export const mouseEventsHaveKeyEvents = defineRule({
   id: "mouse-events-have-key-events",
   title: "Mouse handler missing focus handler",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-access-key.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-access-key.ts
index 6b2bbe9bc..5e0099918 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-access-key.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-access-key.ts
@@ -3,7 +3,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Screen reader users can lose their shortcuts because `accessKey` clashes with them, so remove it.";
@@ -15,7 +14,7 @@ const isUndefinedIdentifier = (expression: EsTreeNode): boolean =>
 // Port of `oxc_linter::rules::jsx_a11y::no_access_key`. Flags any
 // `accessKey` attribute UNLESS its value is the bare `undefined`
 // identifier (matching OXC's `is_undefined` carve-out).
-export const noAccessKey = defineRule<Rule>({
+export const noAccessKey = defineRule({
   id: "no-access-key",
   title: "accessKey attribute used",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-aria-hidden-on-focusable.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-aria-hidden-on-focusable.ts
index b1d5a8561..64d3f7028 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-aria-hidden-on-focusable.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-aria-hidden-on-focusable.ts
@@ -5,7 +5,6 @@ import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isInteractiveElement } from "../../utils/is-interactive-element.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { parseJsxValue } from "../../utils/parse-jsx-value.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Screen reader users tab to this focusable element but hear nothing because `aria-hidden` skips it, so remove `aria-hidden` or stop it being focusable.";
@@ -13,7 +12,7 @@ const MESSAGE =
 // Port of `oxc_linter::rules::jsx_a11y::no_aria_hidden_on_focusable`.
 // Flags interactive / explicitly-tabbable elements that also set
 // `aria-hidden`.
-export const noAriaHiddenOnFocusable = defineRule<Rule>({
+export const noAriaHiddenOnFocusable = defineRule({
   id: "no-aria-hidden-on-focusable",
   title: "aria-hidden on focusable element",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-autofocus.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-autofocus.ts
index 4866ffa37..b113751c0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-autofocus.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-autofocus.ts
@@ -5,7 +5,6 @@ import { getElementType } from "../../utils/get-element-type.js";
 import { getStaticTemplateLiteralValue } from "../../utils/get-static-template-literal-value.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isTestlikeFilename } from "../../utils/is-testlike-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import { HTML_TAGS } from "../../constants/html-tags.js";
 
 const MESSAGE =
@@ -92,7 +91,7 @@ const isFalseAttributeValue = (value: EsTreeNode): boolean => {
 // case-sensitive `autoFocus=` attribute on JSX elements whose value
 // isn't statically `false`. With `ignoreNonDOM: true`, only HTML
 // elements (lowercase tag in HTML_TAGS) are checked.
-export const noAutofocus = defineRule<Rule>({
+export const noAutofocus = defineRule({
   id: "no-autofocus",
   title: "Autofocus on an element",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-distracting-elements.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-distracting-elements.ts
index f948ef80b..39176e82c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-distracting-elements.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-distracting-elements.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getElementType } from "../../utils/get-element-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (tag: string): string =>
   `Users with attention or motion sensitivity struggle because \`<${tag}>\` animates on its own, so use normal, accessible markup instead.`;
@@ -28,7 +27,7 @@ const resolveSettings = (
 
 // Port of `oxc_linter::rules::jsx_a11y::no_distracting_elements`. Flags
 // `<marquee>` and `<blink>` (or any tag in `elements`).
-export const noDistractingElements = defineRule<Rule>({
+export const noDistractingElements = defineRule({
   id: "no-distracting-elements",
   title: "Distracting marquee or blink element",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-interactive-element-to-noninteractive-role.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-interactive-element-to-noninteractive-role.ts
index e1ed9577d..e00ef60bd 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-interactive-element-to-noninteractive-role.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-interactive-element-to-noninteractive-role.ts
@@ -7,7 +7,6 @@ import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isInteractiveElement } from "../../utils/is-interactive-element.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isNonInteractiveRole } from "../../utils/is-non-interactive-role.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (tag: string, role: string): string =>
   `Screen reader users can't operate this interactive \`<${tag}>\` because role \`${role}\` says it isn't, so remove the role or use a different element.`;
@@ -45,7 +44,7 @@ const resolveSettings = (
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::no_interactive_element_to_noninteractive_role`.
-export const noInteractiveElementToNoninteractiveRole = defineRule<Rule>({
+export const noInteractiveElementToNoninteractiveRole = defineRule({
   id: "no-interactive-element-to-noninteractive-role",
   title: "Interactive element given noninteractive role",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-element-interactions.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-element-interactions.ts
index a44d17c9c..5499094c7 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-element-interactions.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-element-interactions.ts
@@ -3,7 +3,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getElementType } from "../../utils/get-element-type.js";
 import { getJsxPropStringValue } from "../../utils/get-jsx-prop-string-value.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
-import type { Rule } from "../../utils/rule.js";
 import { NON_INTERACTIVE_ELEMENTS } from "../../constants/html-tags.js";
 import { INTERACTIVE_ROLES } from "../../constants/aria-roles.js";
 
@@ -23,7 +22,7 @@ const INTERACTIVE_HANDLERS: ReadonlyArray<string> = [
 // Port of `oxc_linter::rules::jsx_a11y::no_noninteractive_element_interactions`.
 // Reports interactive event handlers attached to non-interactive HTML
 // elements without an interactive role.
-export const noNoninteractiveElementInteractions = defineRule<Rule>({
+export const noNoninteractiveElementInteractions = defineRule({
   id: "no-noninteractive-element-interactions",
   title: "Handler on non-interactive element",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-element-to-interactive-role.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-element-to-interactive-role.ts
index a70990ae1..aa0707f51 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-element-to-interactive-role.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-element-to-interactive-role.ts
@@ -7,7 +7,6 @@ import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isInteractiveRole } from "../../utils/is-interactive-role.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isNonInteractiveElement } from "../../utils/is-non-interactive-element.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (tag: string, role: string): string =>
   `Role \`${role}\` gives \`<${tag}>\` interactive semantics even though the element is noninteractive, so screen reader users get the wrong controls.`;
@@ -46,7 +45,7 @@ const resolveSettings = (
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::no_noninteractive_element_to_interactive_role`.
-export const noNoninteractiveElementToInteractiveRole = defineRule<Rule>({
+export const noNoninteractiveElementToInteractiveRole = defineRule({
   id: "no-noninteractive-element-to-interactive-role",
   title: "Noninteractive element given interactive role",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-tabindex.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-tabindex.ts
index 56a22689d..4ee9ddd70 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-tabindex.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-noninteractive-tabindex.ts
@@ -8,7 +8,6 @@ import { isInteractiveElement } from "../../utils/is-interactive-element.js";
 import { isInteractiveRole } from "../../utils/is-interactive-role.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { parseJsxValue } from "../../utils/parse-jsx-value.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Keyboard users get stuck focusing this element they can't act on because `tabIndex` makes it tabbable, so remove it.";
@@ -36,7 +35,7 @@ const resolveSettings = (
 };
 
 // Port of `oxc_linter::rules::jsx_a11y::no_noninteractive_tabindex`.
-export const noNoninteractiveTabindex = defineRule<Rule>({
+export const noNoninteractiveTabindex = defineRule({
   id: "no-noninteractive-tabindex",
   title: "Tabindex on non-interactive element",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-redundant-roles.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-redundant-roles.ts
index ed54582ef..9542bc6e5 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-redundant-roles.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-redundant-roles.ts
@@ -3,7 +3,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getElementType } from "../../utils/get-element-type.js";
 import { getJsxPropStringValue } from "../../utils/get-jsx-prop-string-value.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
-import type { Rule } from "../../utils/rule.js";
 import { getElementImplicitRoles } from "../../constants/aria-element-roles.js";
 
 interface NoRedundantRolesSettings {
@@ -29,7 +28,7 @@ const resolveSettings = (
 
 // Port of `oxc_linter::rules::jsx_a11y::no_redundant_roles`. Reports a
 // `role` attribute that matches the element's implicit role.
-export const noRedundantRoles = defineRule<Rule>({
+export const noRedundantRoles = defineRule({
   id: "no-redundant-roles",
   title: "Redundant ARIA role",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-static-element-interactions.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-static-element-interactions.ts
index f64ad4756..1caada816 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-static-element-interactions.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/no-static-element-interactions.ts
@@ -14,7 +14,6 @@ import { isNonInteractiveRole } from "../../utils/is-non-interactive-role.js";
 import { isPresentationRole } from "../../utils/is-presentation-role.js";
 import { isPureEventBlockerHandler } from "../../utils/is-pure-event-blocker-handler.js";
 import { isTestlikeFilename } from "../../utils/is-testlike-filename.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Screen reader users can't tell this click handler is interactive because it has no `role`, so add a `role` or use a button or link.";
@@ -62,7 +61,7 @@ const isNullValue = (attribute: EsTreeNodeOfType<"JSXAttribute">): boolean => {
 // Port of `oxc_linter::rules::jsx_a11y::no_static_element_interactions`.
 // Non-React JSX dialect skipping is handled by the `react-jsx-only`
 // tag via `defineRule`.
-export const noStaticElementInteractions = defineRule<Rule>({
+export const noStaticElementInteractions = defineRule({
   id: "no-static-element-interactions",
   title: "Interaction on static element",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/prefer-html-dialog.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/prefer-html-dialog.ts
index c9d2fdbe1..dfbe39ab8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/prefer-html-dialog.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/prefer-html-dialog.ts
@@ -3,7 +3,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { findJsxAttribute } from "../../utils/find-jsx-attribute.js";
 import { getJsxPropStringValue } from "../../utils/get-jsx-prop-string-value.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const ROLE_DIALOG_VALUES = new Set(["dialog", "alertdialog"]);
 
@@ -59,7 +58,7 @@ const isAriaModalTrue = (attribute: EsTreeNodeOfType<"JSXAttribute">): boolean =
 // `onClick={() => setOpen(true)}` modal toggles. We don't lint the
 // `command` side yet — it's too new — but the recommendation in this
 // rule's diagnostic mentions it so users have a path forward.
-export const preferHtmlDialog = defineRule<Rule>({
+export const preferHtmlDialog = defineRule({
   id: "prefer-html-dialog",
   title: "Custom modal instead of dialog",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/prefer-tag-over-role.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/prefer-tag-over-role.ts
index 95b478bd7..f0e5c045e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/prefer-tag-over-role.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/prefer-tag-over-role.ts
@@ -3,7 +3,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getElementType } from "../../utils/get-element-type.js";
 import { getJsxPropStringValue } from "../../utils/get-jsx-prop-string-value.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
-import type { Rule } from "../../utils/rule.js";
 import { getTagsForRole } from "../../constants/aria-element-roles.js";
 
 const buildMessage = (role: string, tag: string): string =>
@@ -12,7 +11,7 @@ const buildMessage = (role: string, tag: string): string =>
 // Port of `oxc_linter::rules::jsx_a11y::prefer_tag_over_role`. When a
 // generic element (`div`/`span`) uses `role` to emulate a built-in
 // element's semantics, suggest using the built-in directly.
-export const preferTagOverRole = defineRule<Rule>({
+export const preferTagOverRole = defineRule({
   id: "prefer-tag-over-role",
   title: "Role used instead of HTML tag",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/role-has-required-aria-props.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/role-has-required-aria-props.ts
index c144ccf49..f447b1bc8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/role-has-required-aria-props.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/role-has-required-aria-props.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getJsxPropStringValue } from "../../utils/get-jsx-prop-string-value.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (role: string, missingProps: ReadonlyArray<string>): string =>
   `Screen reader users can't tell the state of this \`${role}\` without its required ARIA props, so add \`${missingProps.join("`, `")}\`.`;
@@ -23,7 +22,7 @@ const ROLE_REQUIRED_PROPS: ReadonlyMap<string, ReadonlyArray<string>> = new Map(
 ]);
 
 // Port of `oxc_linter::rules::jsx_a11y::role_has_required_aria_props`.
-export const roleHasRequiredAriaProps = defineRule<Rule>({
+export const roleHasRequiredAriaProps = defineRule({
   id: "role-has-required-aria-props",
   title: "Role missing required ARIA props",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/role-supports-aria-props.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/role-supports-aria-props.ts
index 5e7977010..ca4ca003c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/role-supports-aria-props.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/role-supports-aria-props.ts
@@ -9,7 +9,6 @@ import { getJsxAttributeName } from "../../utils/get-jsx-attribute-name.js";
 import { getJsxPropStringValue } from "../../utils/get-jsx-prop-string-value.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessageDefault = (role: string, propName: string): string =>
   `Screen reader users get no help from \`${propName}\` because role \`${role}\` ignores it, so remove it or change the role.`;
@@ -155,7 +154,7 @@ const getImplicitRole = (
 // Port of `oxc_linter::rules::jsx_a11y::role_supports_aria_props`.
 // Reports `aria-*` props that aren't supported by the element's
 // effective ARIA role (explicit > implicit).
-export const roleSupportsAriaProps = defineRule<Rule>({
+export const roleSupportsAriaProps = defineRule({
   id: "role-supports-aria-props",
   title: "Unsupported ARIA prop for role",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/scope.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/scope.ts
index 5192f3b64..56aaa2a99 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/scope.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/scope.ts
@@ -3,14 +3,13 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getElementType } from "../../utils/get-element-type.js";
 import { hasJsxProp } from "../../utils/has-jsx-prop.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "The `scope` attribute only works on `<th>` cells, so screen readers get no table-header help from it here.";
 
 // Port of `oxc_linter::rules::jsx_a11y::scope`. Flags `scope=` on
 // non-`<th>` elements.
-export const scope = defineRule<Rule>({
+export const scope = defineRule({
   id: "scope",
   title: "scope attribute on non-th element",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/tabindex-no-positive.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/tabindex-no-positive.ts
index c39885074..e3a9e1914 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/tabindex-no-positive.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/a11y/tabindex-no-positive.ts
@@ -4,14 +4,13 @@ import { getJsxPropStringValue } from "../../utils/get-jsx-prop-string-value.js"
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { parseJsxValue } from "../../utils/parse-jsx-value.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Keyboard users get jumped out of the normal order by a positive `tabIndex`, so use `0` or `-1`.";
 
 // Port of `oxc_linter::rules::jsx_a11y::tabindex_no_positive`. Reports
 // `tabIndex={N}` where N > 0.
-export const tabindexNoPositive = defineRule<Rule>({
+export const tabindexNoPositive = defineRule({
   id: "tabindex-no-positive",
   title: "Positive tabindex value",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-default-props.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-default-props.ts
index ad6834a1b..a6b3aee4f 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-default-props.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-default-props.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -13,7 +12,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // distinguish class vs function from the assignment alone, but the
 // recommendation is the same either way — switch to ES6 default params
 // in destructured props — so the guidance is uniform.
-export const noDefaultProps = defineRule<Rule>({
+export const noDefaultProps = defineRule({
   id: "no-default-props",
   title: "defaultProps removed in React 19",
   requires: ["react:19"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-generic-handler-names.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-generic-handler-names.ts
index 39fbbeb4e..b19e90f98 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-generic-handler-names.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-generic-handler-names.ts
@@ -1,11 +1,10 @@
 import { GENERIC_EVENT_SUFFIXES } from "../../constants/react.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noGenericHandlerNames = defineRule<Rule>({
+export const noGenericHandlerNames = defineRule({
   id: "no-generic-handler-names",
   title: "Vague event handler name",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-giant-component.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-giant-component.ts
index 807c878c6..b625475c7 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-giant-component.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-giant-component.ts
@@ -5,11 +5,10 @@ import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noGiantComponent = defineRule<Rule>({
+export const noGiantComponent = defineRule({
   id: "no-giant-component",
   title: "Large component is hard to read and change",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-legacy-class-lifecycles.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-legacy-class-lifecycles.ts
index e9331b737..90fb65bc0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-legacy-class-lifecycles.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-legacy-class-lifecycles.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -55,7 +54,7 @@ const buildLegacyLifecycleMessage = (originalName: string): string | null => {
   return `${removalNote} ${replacement}.`;
 };
 
-export const noLegacyClassLifecycles = defineRule<Rule>({
+export const noLegacyClassLifecycles = defineRule({
   id: "no-legacy-class-lifecycles",
   title: "Legacy class lifecycle methods",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-legacy-context-api.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-legacy-context-api.ts
index 439b43d1f..3fe0fcbe4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-legacy-context-api.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-legacy-context-api.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -39,7 +38,7 @@ const isInsideClassBody = (node: EsTreeNode): boolean => {
   return false;
 };
 
-export const noLegacyContextApi = defineRule<Rule>({
+export const noLegacyContextApi = defineRule({
   id: "no-legacy-context-api",
   title: "Legacy context API",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-many-boolean-props.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-many-boolean-props.ts
index c486cb45e..65b0dda07 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-many-boolean-props.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-many-boolean-props.ts
@@ -6,7 +6,6 @@ import { isComponentDeclaration } from "../../utils/is-component-declaration.js"
 import { isInlineFunctionExpression } from "../../utils/is-inline-function-expression.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -37,7 +36,7 @@ const collectBooleanLikePropsFromBody = (
 // both destructured form (`{ isPrimary, hasIcon }`) and non-destructured
 // (`function Foo(props) { props.isPrimary }`) by walking member-access
 // patterns on the parameter binding.
-export const noManyBooleanProps = defineRule<Rule>({
+export const noManyBooleanProps = defineRule({
   id: "no-many-boolean-props",
   title: "Boolean prop combinations are hard to test",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-nested-component-definition.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-nested-component-definition.ts
index 6b319b71e..8d8b14750 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-nested-component-definition.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-nested-component-definition.ts
@@ -3,11 +3,10 @@ import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isComponentDeclaration } from "../../utils/is-component-declaration.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noNestedComponentDefinition = defineRule<Rule>({
+export const noNestedComponentDefinition = defineRule({
   id: "no-nested-component-definition",
   title: "Component defined inside another component",
   tags: ["test-noise", "react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-prop-types.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-prop-types.ts
index a0e920c5a..46806e861 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-prop-types.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-prop-types.ts
@@ -3,7 +3,6 @@ import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 // HACK: React 19 removed runtime `propTypes` validation entirely —
@@ -68,7 +67,7 @@ const getComponentNameFromClassProperty = (
 const buildMessage = (componentName: string): string =>
   `${componentName}.propTypes does nothing in React 19, so bad props reach your users with no warning. Describe props with TypeScript types & check risky data yourself.`;
 
-export const noPropTypes = defineRule<Rule>({
+export const noPropTypes = defineRule({
   id: "no-prop-types",
   title: "propTypes ignored in React 19",
   requires: ["react:19"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-react-dom-deprecated-apis.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-react-dom-deprecated-apis.ts
index 250389837..8335c3478 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-react-dom-deprecated-apis.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-react-dom-deprecated-apis.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { createDeprecatedReactImportRule } from "./utils/create-deprecated-react-import-rule.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -75,7 +74,7 @@ const reportTestUtilsImports = (
   }
 };
 
-export const noReactDomDeprecatedApis = defineRule<Rule>({
+export const noReactDomDeprecatedApis = defineRule({
   id: "no-react-dom-deprecated-apis",
   title: "Deprecated react-dom APIs break in React 19",
   requires: ["react:18"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-react19-deprecated-apis.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-react19-deprecated-apis.ts
index 65a68fc29..7a1be83bc 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-react19-deprecated-apis.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-react19-deprecated-apis.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import { createDeprecatedReactImportRule } from "./utils/create-deprecated-react-import-rule.js";
 
 // HACK: React 19+ deprecated `forwardRef` (refs are now regular props on
@@ -25,7 +24,7 @@ const REACT_19_DEPRECATED_MESSAGES = new Map<string, string>([
   ],
 ]);
 
-export const noReact19DeprecatedApis = defineRule<Rule>({
+export const noReact19DeprecatedApis = defineRule({
   id: "no-react19-deprecated-apis",
   title: "React 19 API migration can break callers",
   requires: ["react:19"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-render-in-render.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-render-in-render.ts
index 121311746..27e6c4104 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-render-in-render.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-render-in-render.ts
@@ -1,11 +1,10 @@
 import { RENDER_FUNCTION_PATTERN } from "../../constants/react.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noRenderInRender = defineRule<Rule>({
+export const noRenderInRender = defineRule({
   id: "no-render-in-render",
   title: "Component rendered by inline function call",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-render-prop-children.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-render-prop-children.ts
index 5817880fc..2f4add763 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-render-prop-children.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/no-render-prop-children.ts
@@ -1,7 +1,6 @@
 import { RENDER_PROP_PROLIFERATION_THRESHOLD } from "../../constants/thresholds.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -16,7 +15,7 @@ const RENDER_PROP_PATTERN = /^render[A-Z]/;
 // single element receives 3 or more `render*` props, that's the smell
 // of "many slots cobbled together where compound components or
 // `children` would be cleaner".
-export const noRenderPropChildren = defineRule<Rule>({
+export const noRenderPropChildren = defineRule({
   id: "no-render-prop-children",
   title: "Render-prop slots make this component hard to extend",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-explicit-variants.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-explicit-variants.ts
index be8c49615..b63ca3de0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-explicit-variants.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-explicit-variants.ts
@@ -10,7 +10,6 @@ import { stripParenExpression } from "../../utils/strip-paren-expression.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 // Resolve a ternary `test` to the local binding name when it is a bare
@@ -138,7 +137,7 @@ const collectVariantBranchProps = (
 // visible at this AST layer). v1 only models two-sided ternaries on
 // destructured props; if/else early-return variants and multi-way chains
 // ending in `null` are out of scope.
-export const preferExplicitVariants = defineRule<Rule>({
+export const preferExplicitVariants = defineRule({
   id: "prefer-explicit-variants",
   title: "Prefer explicit variant components",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-module-scope-pure-function.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-module-scope-pure-function.ts
index 8deee39f7..d55ade70a 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-module-scope-pure-function.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-module-scope-pure-function.ts
@@ -3,7 +3,6 @@ import { enclosingComponentOrHookScope } from "../../utils/enclosing-component-o
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { closureCaptures } from "../../semantic/closure-captures.js";
 import { isDescendantScope, type ScopeDescriptor } from "../../semantic/scope-analysis.js";
@@ -72,7 +71,7 @@ const hasComponentLocalCaptures = (
 //     ) => ...`) — those are intentional component-attached helpers.
 //   - Uses the existing scope-analysis pipeline (`closureCaptures`)
 //     to detect any binding from inside the component's body scope.
-export const preferModuleScopePureFunction = defineRule<Rule>({
+export const preferModuleScopePureFunction = defineRule({
   id: "prefer-module-scope-pure-function",
   title: "Pure function rebuilt every render",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-module-scope-static-value.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-module-scope-static-value.ts
index 3bca3828c..64cca0d15 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-module-scope-static-value.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/prefer-module-scope-static-value.ts
@@ -6,7 +6,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
 import { walkAst } from "../../utils/walk-ast.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import {
   isDescendantScope,
@@ -188,7 +187,7 @@ const isHoistableValueExpression = (expression: EsTreeNode): boolean => {
 //   - Also treats inner function expressions as "uses local state" —
 //     a function inside the value is itself a closure, and hoisting
 //     would change its semantics.
-export const preferModuleScopeStaticValue = defineRule<Rule>({
+export const preferModuleScopeStaticValue = defineRule({
   id: "prefer-module-scope-static-value",
   title: "Static value rebuilt every render",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/react-compiler-destructure-method.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/react-compiler-destructure-method.ts
index 4169da0d8..40788269f 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/react-compiler-destructure-method.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/react-compiler-destructure-method.ts
@@ -3,7 +3,6 @@ import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isInlineFunctionExpression } from "../../utils/is-inline-function-expression.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isImportedFromModule } from "../../utils/find-import-source-for-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -66,7 +65,7 @@ const buildHookBindingMap = (componentBody: EsTreeNode | null | undefined): Map<
 //
 // Heuristic: `router.push(...)` (or any of the canonical hook objects)
 // where `router` is bound to a `useRouter()` call in the same component.
-export const reactCompilerDestructureMethod = defineRule<Rule>({
+export const reactCompilerDestructureMethod = defineRule({
   id: "react-compiler-destructure-method",
   title: "Hook method called without destructuring",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/react-compiler-no-manual-memoization.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/react-compiler-no-manual-memoization.ts
index ba4a6bc00..4e6416358 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/react-compiler-no-manual-memoization.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/architecture/react-compiler-no-manual-memoization.ts
@@ -7,7 +7,6 @@ import {
 } from "../../utils/find-import-source-for-name.js";
 import { isCanonicalReactNamespaceName } from "../../utils/is-canonical-react-namespace-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 const REMOVAL_MESSAGE_BY_REACT_API_NAME = new Map<string, string>([
@@ -69,7 +68,7 @@ const resolveRemovalMessageForCallee = (callee: EsTreeNode): string | null => {
 // source check below. Composes with `react-hooks-js/preserve-manual-
 // memoization`, which inverts the rule for cases the compiler cannot
 // safely auto-memoize.
-export const reactCompilerNoManualMemoization = defineRule<Rule>({
+export const reactCompilerNoManualMemoization = defineRule({
   id: "react-compiler-no-manual-memoization",
   title: "Redundant manual memoization",
   // Redundant-memo cleanup is correctness-neutral: the code already works,
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-barrel-import.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-barrel-import.ts
index 916320abd..02f712803 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-barrel-import.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-barrel-import.ts
@@ -5,7 +5,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isBarrelIndexModule } from "../../utils/is-barrel-index-module.js";
 import { resolveBarrelExportFilePath } from "../../utils/resolve-barrel-export-file-path.js";
 import { resolveRelativeImportPath } from "../../utils/resolve-relative-import-path.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 interface RuntimeImportRequest {
@@ -62,7 +61,7 @@ const buildReportMessage = (
 // `test-noise` because stories / tests / playground / examples aren't
 // shipped to users — barrel imports there don't expand the production
 // bundle.
-export const noBarrelImport = defineRule<Rule>({
+export const noBarrelImport = defineRule({
   id: "no-barrel-import",
   title: "Import from a barrel file",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-dynamic-import-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-dynamic-import-path.ts
index b0ec7b303..8e6d5ed90 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-dynamic-import-path.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-dynamic-import-path.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -7,7 +6,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // HACK: bundlers can only tree-shake / split when the import target is a
 // statically-analyzable string literal. `import(variable)` or
 // `require(variable)` defeats trace targets and forces a fat bundle.
-export const noDynamicImportPath = defineRule<Rule>({
+export const noDynamicImportPath = defineRule({
   id: "no-dynamic-import-path",
   title: "Non-static dynamic import path",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-full-lodash-import.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-full-lodash-import.ts
index c5b01ae8a..93061c00c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-full-lodash-import.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-full-lodash-import.ts
@@ -1,9 +1,8 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noFullLodashImport = defineRule<Rule>({
+export const noFullLodashImport = defineRule({
   id: "no-full-lodash-import",
   title: "Full lodash import",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-moment.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-moment.ts
index 27c7c600a..41e81e779 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-moment.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-moment.ts
@@ -1,9 +1,8 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noMoment = defineRule<Rule>({
+export const noMoment = defineRule({
   id: "no-moment",
   title: "Using moment.js",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-undeferred-third-party.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-undeferred-third-party.ts
index 43a098eeb..3502703b4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-undeferred-third-party.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/no-undeferred-third-party.ts
@@ -1,12 +1,11 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { findJsxAttribute } from "../../utils/find-jsx-attribute.js";
 import { hasJsxAttribute } from "../../utils/has-jsx-attribute.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noUndeferredThirdParty = defineRule<Rule>({
+export const noUndeferredThirdParty = defineRule({
   id: "no-undeferred-third-party",
   title: "Render-blocking third-party script",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/prefer-dynamic-import.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/prefer-dynamic-import.ts
index f97e0e893..a2621cab4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/prefer-dynamic-import.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/prefer-dynamic-import.ts
@@ -1,10 +1,9 @@
 import { HEAVY_LIBRARIES } from "../../constants/library.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const preferDynamicImport = defineRule<Rule>({
+export const preferDynamicImport = defineRule({
   id: "prefer-dynamic-import",
   title: "Heavy library loaded eagerly",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/use-lazy-motion.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/use-lazy-motion.ts
index ff0131931..e08b98009 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/use-lazy-motion.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/bundle-size/use-lazy-motion.ts
@@ -1,12 +1,11 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { getImportedName } from "../../utils/get-imported-name.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const useLazyMotion = defineRule<Rule>({
+export const useLazyMotion = defineRule({
   id: "use-lazy-motion",
   title: "Full Framer Motion import",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/client/client-localstorage-no-version.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/client/client-localstorage-no-version.ts
index 536f7adf8..f47176460 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/client/client-localstorage-no-version.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/client/client-localstorage-no-version.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -29,7 +28,7 @@ const isJsonStringifyCall = (node: EsTreeNode): boolean => {
   return node.callee.property.name === "stringify";
 };
 
-export const clientLocalstorageNoVersion = defineRule<Rule>({
+export const clientLocalstorageNoVersion = defineRule({
   id: "client-localstorage-no-version",
   title: "Unversioned localStorage key",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/client/client-passive-event-listeners.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/client/client-passive-event-listeners.ts
index db73de092..8ab69c166 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/client/client-passive-event-listeners.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/client/client-passive-event-listeners.ts
@@ -2,12 +2,11 @@ import { PASSIVE_EVENT_NAMES } from "../../constants/dom.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { isMemberProperty } from "../../utils/is-member-property.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const clientPassiveEventListeners = defineRule<Rule>({
+export const clientPassiveEventListeners = defineRule({
   id: "client-passive-event-listeners",
   title: "Non-passive scroll listener",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-invalid-paragraph-child.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-invalid-paragraph-child.ts
index 5068353ea..fde13487f 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-invalid-paragraph-child.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-invalid-paragraph-child.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 // Lifted verbatim from `preact/debug/src/debug.js`'s
 // `ILLEGAL_PARAGRAPH_CHILD_ELEMENTS` regex. These are the block-level
@@ -99,7 +98,7 @@ const findEnclosingParagraph = (openingElement: EsTreeNode): EsTreeNode | null =
 // implicitly close the paragraph. The result is a DOM tree that doesn't
 // match what the JSX expressed — hydration mismatches, broken styling
 // selectors, and accessibility tree corruption all follow.
-export const htmlNoInvalidParagraphChild = defineRule<Rule>({
+export const htmlNoInvalidParagraphChild = defineRule({
   id: "html-no-invalid-paragraph-child",
   title: "Block element inside a paragraph",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-invalid-table-nesting.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-invalid-table-nesting.ts
index d3d26a1ce..05b87ed13 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-invalid-table-nesting.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-invalid-table-nesting.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const TABLE_ELEMENTS = new Set(["table", "thead", "tbody", "tfoot", "tr", "td", "th"]);
 
@@ -116,7 +115,7 @@ const findEnclosingTable = (
 // `<MyTable>` is genuinely unknown. preact/debug has the same blind
 // spot at runtime: it walks the VNode tree, not the DOM, so it can't
 // validate boundaries it can't see either.
-export const htmlNoInvalidTableNesting = defineRule<Rule>({
+export const htmlNoInvalidTableNesting = defineRule({
   id: "html-no-invalid-table-nesting",
   title: "Invalid table element nesting",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-nested-interactive.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-nested-interactive.ts
index 7f349a7a0..868a3e75c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-nested-interactive.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/html-no-nested-interactive.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (tagName: string): string =>
   `Your users get broken clicks, focus & screen readers because you can't put a \`<${tagName}>\` inside another \`<${tagName}>\`, so the browser closes the outer one early. Move the inner one out.`;
@@ -54,7 +53,7 @@ const findEnclosingSameTag = (openingElement: EsTreeNode, tagName: string): EsTr
 // (the rule cannot see the <a>-wrapping ancestor when an <a> is rendered
 // in a child component); preact/debug catches the cross-component case at
 // runtime via the live VNode tree.
-export const htmlNoNestedInteractive = defineRule<Rule>({
+export const htmlNoNestedInteractive = defineRule({
   id: "html-no-nested-interactive",
   title: "Nested interactive elements",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-array-index-as-key.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-array-index-as-key.ts
index 9d5def94c..477e197eb 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-array-index-as-key.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-array-index-as-key.ts
@@ -1,7 +1,6 @@
 import { INDEX_PARAMETER_NAMES } from "../../constants/react.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isAllLiteralArrayExpression } from "../../utils/is-all-literal-array-expression.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
@@ -277,7 +276,7 @@ const isCompositeKeyWithIteratorIdentity = (
   return templateLiteralHasIteratorIdentity(keyExpression, itemName);
 };
 
-export const noArrayIndexAsKey = defineRule<Rule>({
+export const noArrayIndexAsKey = defineRule({
   id: "no-array-index-as-key",
   title: "Array index used as a key",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-jsx-element-type.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-jsx-element-type.ts
index 22d371db7..a70615e59 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-jsx-element-type.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-jsx-element-type.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 const MESSAGE =
@@ -39,7 +38,7 @@ const checkReturnType = (
   }
 };
 
-export const noJsxElementType = defineRule<Rule>({
+export const noJsxElementType = defineRule({
   id: "no-jsx-element-type",
   title: "No JSX.Element",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-polymorphic-children.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-polymorphic-children.ts
index 9aa85a38c..edd538ba6 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-polymorphic-children.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-polymorphic-children.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -10,7 +9,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // what the consumer happened to pass. Better to expose explicit
 // subcomponents (`<Button.Text />`) so text always lands in the right
 // shape and the component's API is checked at compile time.
-export const noPolymorphicChildren = defineRule<Rule>({
+export const noPolymorphicChildren = defineRule({
   id: "no-polymorphic-children",
   title: "Children type checked at runtime",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-prevent-default.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-prevent-default.ts
index 42e077e32..d05881c98 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-prevent-default.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-prevent-default.ts
@@ -4,7 +4,6 @@ import { getReactDoctorStringSetting } from "../../utils/get-react-doctor-settin
 import { isInlineFunctionExpression } from "../../utils/is-inline-function-expression.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -70,7 +69,7 @@ const selectFormMessage = (framework: string | undefined): string =>
     ? FORM_MESSAGE_SERVER_CAPABLE
     : FORM_MESSAGE_GENERIC;
 
-export const noPreventDefault = defineRule<Rule>({
+export const noPreventDefault = defineRule({
   id: "no-prevent-default",
   title: "preventDefault on a form or link",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-random-key.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-random-key.ts
index 5c714b012..618cd6799 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-random-key.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-random-key.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { findVariableInitializer } from "../../utils/find-variable-initializer.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 // Direct-callee names that produce a fresh value every call. The
@@ -145,7 +144,7 @@ const looksLikeFreshUpdateExpression = (expression: EsTreeNode): string | null =
 //   - Doesn't model arbitrary user-defined factories. Adding a generic
 //     "looks like an id generator" name list would over-report on
 //     things like `getKey(item.id)` which is fine.
-export const noRandomKey = defineRule<Rule>({
+export const noRandomKey = defineRule({
   id: "no-random-key",
   title: "Random value used as a key",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-uncontrolled-input.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-uncontrolled-input.ts
index 88d112f5b..092a3371e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-uncontrolled-input.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-uncontrolled-input.ts
@@ -6,7 +6,6 @@ import { isInlineFunctionExpression } from "../../utils/is-inline-function-expre
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -73,7 +72,7 @@ const hasJsxSpreadAttribute = (attributes: EsTreeNode[]): boolean =>
 // `register()`, Headless UI, Radix, etc. routinely supply `onChange` /
 // `defaultValue` via spread, and we can't see through it without scope
 // analysis. False-negative > false-positive on a heavily used pattern.
-export const noUncontrolledInput = defineRule<Rule>({
+export const noUncontrolledInput = defineRule({
   id: "no-uncontrolled-input",
   title: "Uncontrolled input value",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/rendering-conditional-render.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/rendering-conditional-render.ts
index 2078077f8..6291c8dd9 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/rendering-conditional-render.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/rendering-conditional-render.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -21,7 +20,7 @@ const isNumericName = (name: string): boolean => {
   return false;
 };
 
-export const renderingConditionalRender = defineRule<Rule>({
+export const renderingConditionalRender = defineRule({
   id: "rendering-conditional-render",
   title: "Number before && renders stray 0",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/rendering-svg-precision.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/rendering-svg-precision.ts
index 6d7410771..36c175c1e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/rendering-svg-precision.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/rendering-svg-precision.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -41,7 +40,7 @@ const isAutoGeneratedSvgFile = (filename: string | undefined): boolean => {
 // add bytes for sub-pixel precision the user can't see. Most editors
 // emit these by default; truncating to 1–2 decimals trims 30–50% off
 // markup with no visible difference.
-export const renderingSvgPrecision = defineRule<Rule>({
+export const renderingSvgPrecision = defineRule({
   id: "rendering-svg-precision",
   title: "Overly precise SVG path values",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-dark-mode-glow.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-dark-mode-glow.ts
index f6811c3bf..fdc529785 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-dark-mode-glow.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-dark-mode-glow.ts
@@ -5,7 +5,6 @@ import {
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { ParsedRgb } from "../../utils/parsed-rgb.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyStringValue } from "./utils/get-style-property-string-value.js";
@@ -69,7 +68,7 @@ const isBackgroundDark = (bgValue: string): boolean => {
   );
 };
 
-export const noDarkModeGlow = defineRule<Rule>({
+export const noDarkModeGlow = defineRule({
   id: "no-dark-mode-glow",
   title: "Colored glow on dark background",
   tags: ["design", "test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-disabled-zoom.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-disabled-zoom.ts
index 038d79314..036bd87b5 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-disabled-zoom.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-disabled-zoom.ts
@@ -1,11 +1,10 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { findJsxAttribute } from "../../utils/find-jsx-attribute.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noDisabledZoom = defineRule<Rule>({
+export const noDisabledZoom = defineRule({
   id: "no-disabled-zoom",
   title: "Zoom disabled on viewport",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-gradient-text.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-gradient-text.ts
index be27056c0..eedb4dafb 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-gradient-text.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-gradient-text.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyStringValue } from "./utils/get-style-property-string-value.js";
@@ -7,7 +6,7 @@ import { getStylePropertyKey } from "./utils/get-style-property-key.js";
 import { getStringFromClassNameAttr } from "./utils/get-string-from-class-name-attr.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noGradientText = defineRule<Rule>({
+export const noGradientText = defineRule({
   id: "no-gradient-text",
   title: "Gradient text is hard to read",
   tags: ["design", "test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-gray-on-colored-background.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-gray-on-colored-background.ts
index 722c75796..286f8f2bb 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-gray-on-colored-background.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-gray-on-colored-background.ts
@@ -1,10 +1,9 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getStringFromClassNameAttr } from "./utils/get-string-from-class-name-attr.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noGrayOnColoredBackground = defineRule<Rule>({
+export const noGrayOnColoredBackground = defineRule({
   id: "no-gray-on-colored-background",
   title: "Gray text on colored background",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-inline-bounce-easing.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-inline-bounce-easing.ts
index 6c82f606a..d93834932 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-inline-bounce-easing.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-inline-bounce-easing.ts
@@ -1,6 +1,5 @@
 import { BOUNCE_ANIMATION_NAMES } from "../../constants/style.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyStringValue } from "./utils/get-style-property-string-value.js";
@@ -26,7 +25,7 @@ const hasBounceAnimationName = (value: string): boolean => {
   return false;
 };
 
-export const noInlineBounceEasing = defineRule<Rule>({
+export const noInlineBounceEasing = defineRule({
   id: "no-inline-bounce-easing",
   title: "Bouncy easing animation",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-inline-exhaustive-style.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-inline-exhaustive-style.ts
index 8984dd45b..bb2eadbea 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-inline-exhaustive-style.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-inline-exhaustive-style.ts
@@ -1,13 +1,12 @@
 import { INLINE_STYLE_PROPERTY_THRESHOLD } from "../../constants/design.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noInlineExhaustiveStyle = defineRule<Rule>({
+export const noInlineExhaustiveStyle = defineRule({
   id: "no-inline-exhaustive-style",
   title: "Large inline style object rebuilds every render",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-justified-text.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-justified-text.ts
index 0f3460df1..75c8fe18b 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-justified-text.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-justified-text.ts
@@ -1,12 +1,11 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyStringValue } from "./utils/get-style-property-string-value.js";
 import { getStylePropertyKey } from "./utils/get-style-property-key.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noJustifiedText = defineRule<Rule>({
+export const noJustifiedText = defineRule({
   id: "no-justified-text",
   title: "Justified text without hyphens",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-layout-transition-inline.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-layout-transition-inline.ts
index ef82bf16e..2ab6dbc9c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-layout-transition-inline.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-layout-transition-inline.ts
@@ -1,12 +1,11 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyStringValue } from "./utils/get-style-property-string-value.js";
 import { getStylePropertyKey } from "./utils/get-style-property-key.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noLayoutTransitionInline = defineRule<Rule>({
+export const noLayoutTransitionInline = defineRule({
   id: "no-layout-transition-inline",
   title: "Animating layout properties",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-long-transition-duration.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-long-transition-duration.ts
index 8f0612bab..df151bed8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-long-transition-duration.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-long-transition-duration.ts
@@ -1,13 +1,12 @@
 import { LONG_TRANSITION_DURATION_THRESHOLD_MS } from "../../constants/design.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyStringValue } from "./utils/get-style-property-string-value.js";
 import { getStylePropertyKey } from "./utils/get-style-property-key.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noLongTransitionDuration = defineRule<Rule>({
+export const noLongTransitionDuration = defineRule({
   id: "no-long-transition-duration",
   title: "Transition duration too long",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-outline-none.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-outline-none.ts
index b53557221..71728f755 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-outline-none.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-outline-none.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyStringValue } from "./utils/get-style-property-string-value.js";
@@ -8,7 +7,7 @@ import { getStylePropertyKey } from "./utils/get-style-property-key.js";
 import { getStylePropertyNumberValue } from "./utils/get-style-property-number-value.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noOutlineNone = defineRule<Rule>({
+export const noOutlineNone = defineRule({
   id: "no-outline-none",
   title: "outline:none removes focus ring",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-pure-black-background.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-pure-black-background.ts
index 40ed7aeab..89afe5348 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-pure-black-background.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-pure-black-background.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyStringValue } from "./utils/get-style-property-string-value.js";
@@ -8,7 +7,7 @@ import { isPureBlackColor } from "./utils/is-pure-black-color.js";
 import { getStringFromClassNameAttr } from "./utils/get-string-from-class-name-attr.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noPureBlackBackground = defineRule<Rule>({
+export const noPureBlackBackground = defineRule({
   id: "no-pure-black-background",
   title: "Pure black background",
   tags: ["design", "test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-side-tab-border.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-side-tab-border.ts
index cdda31992..b9b600ced 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-side-tab-border.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-side-tab-border.ts
@@ -5,7 +5,6 @@ import {
 } from "../../constants/design.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyStringValue } from "./utils/get-style-property-string-value.js";
@@ -53,7 +52,7 @@ const BORDER_SIDE_WIDTH_KEYS = new Set([
   "borderInlineEndWidth",
 ]);
 
-export const noSideTabBorder = defineRule<Rule>({
+export const noSideTabBorder = defineRule({
   id: "no-side-tab-border",
   title: "Thick one-sided border",
   tags: ["design", "test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-tiny-text.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-tiny-text.ts
index 1ec15ee6c..f98988409 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-tiny-text.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-tiny-text.ts
@@ -1,6 +1,5 @@
 import { TINY_TEXT_THRESHOLD_PX } from "../../constants/design.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyStringValue } from "./utils/get-style-property-string-value.js";
@@ -8,7 +7,7 @@ import { getStylePropertyKey } from "./utils/get-style-property-key.js";
 import { getStylePropertyNumberValue } from "./utils/get-style-property-number-value.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noTinyText = defineRule<Rule>({
+export const noTinyText = defineRule({
   id: "no-tiny-text",
   title: "Text is too small",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-wide-letter-spacing.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-wide-letter-spacing.ts
index ac859bc81..937b32b00 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-wide-letter-spacing.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-wide-letter-spacing.ts
@@ -1,7 +1,6 @@
 import { WIDE_TRACKING_THRESHOLD_EM } from "../../constants/design.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyStringValue } from "./utils/get-style-property-string-value.js";
@@ -65,7 +64,7 @@ const hasUppercaseSiblingProp = (styleAttribute: EsTreeNodeOfType<"JSXAttribute"
   return false;
 };
 
-export const noWideLetterSpacing = defineRule<Rule>({
+export const noWideLetterSpacing = defineRule({
   id: "no-wide-letter-spacing",
   title: "Wide letter spacing on body text",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-z-index9999.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-z-index9999.ts
index c024bbf40..01b554544 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-z-index9999.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/design/no-z-index9999.ts
@@ -2,7 +2,6 @@ import { Z_INDEX_ABSURD_THRESHOLD } from "../../constants/design.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getInlineStyleExpression } from "./utils/get-inline-style-expression.js";
 import { getStylePropertyKey } from "./utils/get-style-property-key.js";
@@ -10,7 +9,7 @@ import { getStylePropertyNumberValue } from "./utils/get-style-property-number-v
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noZIndex9999 = defineRule<Rule>({
+export const noZIndex9999 = defineRule({
   id: "no-z-index-9999",
   title: "Excessively high z-index",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-derived-atom-returns-fresh-object.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-derived-atom-returns-fresh-object.ts
index 8aae4c976..ef40c20de 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-derived-atom-returns-fresh-object.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-derived-atom-returns-fresh-object.ts
@@ -5,7 +5,6 @@ import {
 } from "../../utils/find-import-source-for-name.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
 import { walkAst } from "../../utils/walk-ast.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -204,7 +203,7 @@ const functionBodyReferencesGetParameter = (
   return found;
 };
 
-export const jotaiDerivedAtomReturnsFreshObject = defineRule<Rule>({
+export const jotaiDerivedAtomReturnsFreshObject = defineRule({
   id: "jotai-derived-atom-returns-fresh-object",
   title: "Derived atom returns fresh object",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-select-atom-in-render-body.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-select-atom-in-render-body.ts
index f299f6595..0a1f58b7c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-select-atom-in-render-body.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-select-atom-in-render-body.ts
@@ -4,7 +4,6 @@ import {
   isImportedFromModule,
   getImportedNameFromModule,
 } from "../../utils/find-import-source-for-name.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -69,7 +68,7 @@ const containingFunctionIsComponentOrHook = (functionNode: EsTreeNode): boolean
   return COMPONENT_NAME_PATTERN.test(cursor.id.name) || HOOK_NAME_PATTERN.test(cursor.id.name);
 };
 
-export const jotaiSelectAtomInRenderBody = defineRule<Rule>({
+export const jotaiSelectAtomInRenderBody = defineRule({
   id: "jotai-select-atom-in-render-body",
   title: "selectAtom called during render",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-tq-use-raw-query-atom.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-tq-use-raw-query-atom.ts
index 11992bea6..08f8403b3 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-tq-use-raw-query-atom.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/jotai/jotai-tq-use-raw-query-atom.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { getImportedName } from "../../utils/get-imported-name.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -42,7 +41,7 @@ const SUBSCRIBING_HOOK_NAMES = new Set(["useAtomValue", "useAtom"]);
 const QUERY_ATOM_NAMING_CONVENTION =
   /(SuspenseInfiniteQuery|SuspenseQuery|InfiniteQuery|Query)Atom$/;
 
-export const jotaiTqUseRawQueryAtom = defineRule<Rule>({
+export const jotaiTqUseRawQueryAtom = defineRule({
   id: "jotai-tq-use-raw-query-atom",
   title: "Subscribing to raw query atom",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/async-await-in-loop.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/async-await-in-loop.ts
index cb4b81a9e..0b49a2795 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/async-await-in-loop.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/async-await-in-loop.ts
@@ -5,7 +5,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
 import { isInlineFunctionExpression } from "../../utils/is-inline-function-expression.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { walkAst } from "../../utils/walk-ast.js";
 
@@ -167,7 +166,7 @@ const isWrappedInPromiseConcurrency = (mapCall: EsTreeNode): boolean => {
   return PROMISE_CONCURRENCY_METHODS.has(callee.property.name);
 };
 
-export const asyncAwaitInLoop = defineRule<Rule>({
+export const asyncAwaitInLoop = defineRule({
   id: "async-await-in-loop",
   title: "await inside a loop",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/async-parallel.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/async-parallel.ts
index b86b64b4a..ae869feda 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/async-parallel.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/async-parallel.ts
@@ -11,7 +11,6 @@ import { getCalleeIdentifierTrail } from "../../utils/get-callee-identifier-trai
 import { isTestLibraryImportSource } from "../../utils/is-test-library-import-source.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -97,7 +96,7 @@ const reportIfIndependent = (statements: EsTreeNode[], context: RuleContext): vo
   });
 };
 
-export const asyncParallel = defineRule<Rule>({
+export const asyncParallel = defineRule({
   id: "async-parallel",
   title: "Independent awaits run sequentially",
   // `test-noise` opts every file `isTestFilePath(...)` recognises
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-async-reduce-without-awaited-acc.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-async-reduce-without-awaited-acc.ts
index 0bc037c9d..f3ccf4e9e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-async-reduce-without-awaited-acc.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-async-reduce-without-awaited-acc.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { containsDirectAwait } from "../../utils/contains-direct-await.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
 import { walkAst } from "../../utils/walk-ast.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -103,7 +102,7 @@ const bodyAwaitsAccumulator = (fn: FunctionExpressionLike, accumulatorName: stri
   return awaitsAccumulator;
 };
 
-export const jsAsyncReduceWithoutAwaitedAcc = defineRule<Rule>({
+export const jsAsyncReduceWithoutAwaitedAcc = defineRule({
   id: "js-async-reduce-without-awaited-acc",
   title: "Async reduce drops its accumulator",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-batch-dom-css.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-batch-dom-css.ts
index 8aecf6e18..1bb8ec5b4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-batch-dom-css.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-batch-dom-css.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -71,7 +70,7 @@ const isInsideLoopContext = (node: EsTreeNode): boolean => {
   return false;
 };
 
-export const jsBatchDomCss = defineRule<Rule>({
+export const jsBatchDomCss = defineRule({
   id: "js-batch-dom-css",
   title: "Repeated inline style writes",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-cache-property-access.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-cache-property-access.ts
index c4ba24e4e..243e80777 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-cache-property-access.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-cache-property-access.ts
@@ -2,7 +2,6 @@ import { PROPERTY_ACCESS_REPEAT_THRESHOLD } from "../../constants/thresholds.js"
 import { defineRule } from "../../utils/define-rule.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 
@@ -21,7 +20,7 @@ const buildMemberAccessKey = (node: EsTreeNode): string | null => {
 // or hot user-code paths often benefit from caching the access in a const
 // at the top of the loop body. We require a member-expression depth ≥ 2
 // (two dots) and ≥ 3 occurrences in the same loop block to fire.
-export const jsCachePropertyAccess = defineRule<Rule>({
+export const jsCachePropertyAccess = defineRule({
   id: "js-cache-property-access",
   title: "Repeated property access in a loop",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-cache-storage.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-cache-storage.ts
index 085729efd..5bed384e6 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-cache-storage.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-cache-storage.ts
@@ -2,12 +2,11 @@ import { STORAGE_OBJECTS } from "../../constants/dom.js";
 import { DUPLICATE_STORAGE_READ_THRESHOLD } from "../../constants/thresholds.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { isMemberProperty } from "../../utils/is-member-property.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const jsCacheStorage = defineRule<Rule>({
+export const jsCacheStorage = defineRule({
   id: "js-cache-storage",
   title: "Repeated localStorage reads",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-combine-iterations.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-combine-iterations.ts
index ffbf5aa3a..abcd7bd7f 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-combine-iterations.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-combine-iterations.ts
@@ -7,7 +7,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { walkAst } from "../../utils/walk-ast.js";
 
@@ -220,7 +219,7 @@ const collectGeneratorNames = (programNode: EsTreeNode): Set<string> => {
   return generatorNames;
 };
 
-export const jsCombineIterations = defineRule<Rule>({
+export const jsCombineIterations = defineRule({
   id: "js-combine-iterations",
   title: "Chained array iterations",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-early-exit.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-early-exit.ts
index 3f6c85f04..3cb25a264 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-early-exit.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-early-exit.ts
@@ -1,12 +1,11 @@
 import { DEEP_NESTING_THRESHOLD } from "../../constants/thresholds.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const jsEarlyExit = defineRule<Rule>({
+export const jsEarlyExit = defineRule({
   id: "js-early-exit",
   title: "Deeply nested if statements",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-flatmap-filter.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-flatmap-filter.ts
index be924ce10..221d76dc0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-flatmap-filter.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-flatmap-filter.ts
@@ -3,10 +3,9 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
-export const jsFlatmapFilter = defineRule<Rule>({
+export const jsFlatmapFilter = defineRule({
   id: "js-flatmap-filter",
   title: ".map().filter(Boolean) loops twice",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-hoist-intl.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-hoist-intl.ts
index 2185e443d..37539b539 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-hoist-intl.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-hoist-intl.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -36,7 +35,7 @@ const isIntlNewExpression = (node: EsTreeNode): boolean => {
   return false;
 };
 
-export const jsHoistIntl = defineRule<Rule>({
+export const jsHoistIntl = defineRule({
   id: "js-hoist-intl",
   title: "Intl formatter rebuilt each call",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-hoist-regexp.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-hoist-regexp.ts
index 72a29535b..721c137cf 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-hoist-regexp.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-hoist-regexp.ts
@@ -1,11 +1,10 @@
 import { createLoopAwareVisitors } from "../../utils/create-loop-aware-visitors.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const jsHoistRegexp = defineRule<Rule>({
+export const jsHoistRegexp = defineRule({
   id: "js-hoist-regexp",
   title: "RegExp built inside a loop",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-index-maps.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-index-maps.ts
index 938d7e5a2..f8cf5a12b 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-index-maps.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-index-maps.ts
@@ -3,7 +3,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 // `Array.prototype.find` / `.findIndex` take a callback as the first arg.
@@ -25,7 +24,7 @@ const looksLikeArrayCallbackCall = (node: EsTreeNodeOfType<"CallExpression">): b
   return false;
 };
 
-export const jsIndexMaps = defineRule<Rule>({
+export const jsIndexMaps = defineRule({
   id: "js-index-maps",
   title: "array.find() inside a loop",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-length-check-first.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-length-check-first.ts
index 9f7135ec3..1f8558401 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-length-check-first.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-length-check-first.ts
@@ -5,7 +5,6 @@ import { isInlineFunctionExpression } from "../../utils/is-inline-function-expre
 import { isMemberProperty } from "../../utils/is-member-property.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -61,7 +60,7 @@ const isMatchingLengthEqualityGuard = (
 // .reduce against another array, a length mismatch is the cheapest possible
 // shortcut. e.g. `a.length === b.length && a.every((x, i) => x === b[i])`
 // runs the every-loop only when lengths match.
-export const jsLengthCheckFirst = defineRule<Rule>({
+export const jsLengthCheckFirst = defineRule({
   id: "js-length-check-first",
   title: "Array compare without length check",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-min-max-loop.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-min-max-loop.ts
index a870e9362..79e044c8d 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-min-max-loop.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-min-max-loop.ts
@@ -1,11 +1,10 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { isMemberProperty } from "../../utils/is-member-property.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const jsMinMaxLoop = defineRule<Rule>({
+export const jsMinMaxLoop = defineRule({
   id: "js-min-max-loop",
   title: "sort() to find min or max",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-set-map-lookups.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-set-map-lookups.ts
index 26d7f8e2a..987f93771 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-set-map-lookups.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-set-map-lookups.ts
@@ -3,7 +3,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 // HACK: methods that ALWAYS return a string when called on a string
@@ -273,7 +272,7 @@ const isIndexedArrayElementWithStringArgument = (
   return false;
 };
 
-export const jsSetMapLookups = defineRule<Rule>({
+export const jsSetMapLookups = defineRule({
   id: "js-set-map-lookups",
   title: "Array lookup inside a loop",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-tosorted-immutable.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-tosorted-immutable.ts
index 09420db4b..1e6d31c54 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-tosorted-immutable.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/js-performance/js-tosorted-immutable.ts
@@ -2,10 +2,9 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isMemberProperty } from "../../utils/is-member-property.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
-export const jsTosortedImmutable = defineRule<Rule>({
+export const jsTosortedImmutable = defineRule({
   id: "js-tosorted-immutable",
   title: "Spread copy before sort()",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-async-client-component.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-async-client-component.ts
index f94814af0..8a6926e31 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-async-client-component.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-async-client-component.ts
@@ -4,11 +4,10 @@ import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isInlineFunctionExpression } from "../../utils/is-inline-function-expression.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsAsyncClientComponent = defineRule<Rule>({
+export const nextjsAsyncClientComponent = defineRule({
   id: "nextjs-async-client-component",
   title: "Async client component",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-error-boundary-missing-use-client.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-error-boundary-missing-use-client.ts
index eac627b2e..1436b2a56 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-error-boundary-missing-use-client.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-error-boundary-missing-use-client.ts
@@ -2,11 +2,10 @@ import { APP_DIRECTORY_PATTERN, ERROR_BOUNDARY_FILE_PATTERN } from "../../consta
 import { defineRule } from "../../utils/define-rule.js";
 import { hasDirective } from "../../utils/has-directive.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsErrorBoundaryMissingUseClient = defineRule<Rule>({
+export const nextjsErrorBoundaryMissingUseClient = defineRule({
   id: "nextjs-error-boundary-missing-use-client",
   title: "Error boundary missing 'use client'",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-global-error-missing-html-body.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-global-error-missing-html-body.ts
index c0cbc3524..8b2dfd404 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-global-error-missing-html-body.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-global-error-missing-html-body.ts
@@ -2,13 +2,12 @@ import { APP_DIRECTORY_PATTERN, GLOBAL_ERROR_FILE_PATTERN } from "../../constant
 import { defineRule } from "../../utils/define-rule.js";
 import { fileContainsJsxElements } from "../../utils/file-contains-jsx-elements.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
 const REQUIRED_HTML_TAGS = ["html", "body"] as const;
 
-export const nextjsGlobalErrorMissingHtmlBody = defineRule<Rule>({
+export const nextjsGlobalErrorMissingHtmlBody = defineRule({
   id: "nextjs-global-error-missing-html-body",
   title: "global-error.tsx missing <html>/<body>",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-image-missing-sizes.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-image-missing-sizes.ts
index c082228d3..116166cd8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-image-missing-sizes.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-image-missing-sizes.ts
@@ -1,11 +1,10 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { hasJsxAttribute } from "../../utils/has-jsx-attribute.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsImageMissingSizes = defineRule<Rule>({
+export const nextjsImageMissingSizes = defineRule({
   id: "nextjs-image-missing-sizes",
   title: "next/image fill image is missing sizes",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-inline-script-missing-id.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-inline-script-missing-id.ts
index d9245df1b..68dc323b9 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-inline-script-missing-id.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-inline-script-missing-id.ts
@@ -1,11 +1,10 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { hasJsxAttribute } from "../../utils/has-jsx-attribute.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsInlineScriptMissingId = defineRule<Rule>({
+export const nextjsInlineScriptMissingId = defineRule({
   id: "nextjs-inline-script-missing-id",
   title: "Inline script missing id",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-missing-metadata.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-missing-metadata.ts
index 84d2308a0..903d55c81 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-missing-metadata.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-missing-metadata.ts
@@ -1,12 +1,11 @@
 import { INTERNAL_PAGE_PATH_PATTERN, PAGE_FILE_PATTERN } from "../../constants/nextjs.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsMissingMetadata = defineRule<Rule>({
+export const nextjsMissingMetadata = defineRule({
   id: "nextjs-missing-metadata",
   title: "Page missing metadata for search previews",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-a-element.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-a-element.ts
index 2be85405e..69226c868 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-a-element.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-a-element.ts
@@ -1,11 +1,10 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { findJsxAttribute } from "../../utils/find-jsx-attribute.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoAElement = defineRule<Rule>({
+export const nextjsNoAElement = defineRule({
   id: "nextjs-no-a-element",
   title: "Plain anchor reloads internal Next.js links",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-client-fetch-for-server-data.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-client-fetch-for-server-data.ts
index f918cafbd..a247ff20c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-client-fetch-for-server-data.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-client-fetch-for-server-data.ts
@@ -6,11 +6,10 @@ import { normalizeFilename } from "../../utils/normalize-filename.js";
 import { getEffectCallback } from "../../utils/get-effect-callback.js";
 import { hasDirective } from "../../utils/has-directive.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoClientFetchForServerData = defineRule<Rule>({
+export const nextjsNoClientFetchForServerData = defineRule({
   id: "nextjs-no-client-fetch-for-server-data",
   title: "Client fetch for server data",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-client-side-redirect.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-client-side-redirect.ts
index 482a67b6e..3b84c9bae 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-client-side-redirect.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-client-side-redirect.ts
@@ -4,7 +4,6 @@ import { getEffectCallback } from "../../utils/get-effect-callback.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -38,7 +37,7 @@ const describeClientSideNavigation = (node: EsTreeNode): string | null => {
   return null;
 };
 
-export const nextjsNoClientSideRedirect = defineRule<Rule>({
+export const nextjsNoClientSideRedirect = defineRule({
   id: "nextjs-no-client-side-redirect",
   title: "Client-side redirect for navigation",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-css-link.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-css-link.ts
index 95996b3c1..98f75170e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-css-link.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-css-link.ts
@@ -1,12 +1,11 @@
 import { GOOGLE_FONTS_PATTERN } from "../../constants/nextjs.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { findJsxAttribute } from "../../utils/find-jsx-attribute.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoCssLink = defineRule<Rule>({
+export const nextjsNoCssLink = defineRule({
   id: "nextjs-no-css-link",
   title: "Linked stylesheet bypasses Next.js CSS optimization",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-default-export-in-route-handler.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-default-export-in-route-handler.ts
index 615a182e2..99c3157b6 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-default-export-in-route-handler.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-default-export-in-route-handler.ts
@@ -5,7 +5,6 @@ import {
 } from "../../constants/nextjs.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -44,7 +43,7 @@ const programHasNamedHttpMethodExport = (programNode: EsTreeNodeOfType<"Program"
   return false;
 };
 
-export const nextjsNoDefaultExportInRouteHandler = defineRule<Rule>({
+export const nextjsNoDefaultExportInRouteHandler = defineRule({
   id: "nextjs-no-default-export-in-route-handler",
   title: "Default export in route handler",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-edge-og-runtime.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-edge-og-runtime.ts
index e1eb877c9..badaea287 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-edge-og-runtime.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-edge-og-runtime.ts
@@ -2,11 +2,10 @@ import { OG_IMAGE_FILE_PATTERN } from "../../constants/nextjs.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoEdgeOgRuntime = defineRule<Rule>({
+export const nextjsNoEdgeOgRuntime = defineRule({
   id: "nextjs-no-edge-og-runtime",
   title: "Edge runtime in OG image route",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-font-link.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-font-link.ts
index eed6e0227..ae3a5fa24 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-font-link.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-font-link.ts
@@ -1,12 +1,11 @@
 import { GOOGLE_FONTS_PATTERN } from "../../constants/nextjs.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { findJsxAttribute } from "../../utils/find-jsx-attribute.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoFontLink = defineRule<Rule>({
+export const nextjsNoFontLink = defineRule({
   id: "nextjs-no-font-link",
   title: "Google Fonts loaded via link",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-google-analytics-script.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-google-analytics-script.ts
index ffd121276..a2a55e443 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-google-analytics-script.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-google-analytics-script.ts
@@ -1,12 +1,11 @@
 import { GOOGLE_ANALYTICS_SCRIPT_PATTERN } from "../../constants/nextjs.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { findJsxAttribute } from "../../utils/find-jsx-attribute.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoGoogleAnalyticsScript = defineRule<Rule>({
+export const nextjsNoGoogleAnalyticsScript = defineRule({
   id: "nextjs-no-google-analytics-script",
   title: "Manual Google Analytics script blocks optimized loading",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-head-import.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-head-import.ts
index 972b46ed4..998c79883 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-head-import.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-head-import.ts
@@ -1,11 +1,10 @@
 import { APP_DIRECTORY_PATTERN } from "../../constants/nextjs.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoHeadImport = defineRule<Rule>({
+export const nextjsNoHeadImport = defineRule({
   id: "nextjs-no-head-import",
   title: "next/head in App Router",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-img-element.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-img-element.ts
index 7fa324d72..e9a3c8c07 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-img-element.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-img-element.ts
@@ -1,12 +1,11 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { isGeneratedImageRenderContext } from "../../utils/is-generated-image-render-context.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { RuleVisitors } from "../../utils/rule-visitors.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoImgElement = defineRule<Rule>({
+export const nextjsNoImgElement = defineRule({
   id: "nextjs-no-img-element",
   title: "Plain img ships unoptimized images",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-native-script.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-native-script.ts
index cb648cc6a..0a56420fa 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-native-script.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-native-script.ts
@@ -1,12 +1,11 @@
 import { EXECUTABLE_SCRIPT_TYPES } from "../../constants/dom.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { findJsxAttribute } from "../../utils/find-jsx-attribute.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoNativeScript = defineRule<Rule>({
+export const nextjsNoNativeScript = defineRule({
   id: "nextjs-no-native-script",
   title: "Plain script can block Next.js rendering",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-polyfill-script.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-polyfill-script.ts
index d443722d1..e7655321a 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-polyfill-script.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-polyfill-script.ts
@@ -1,12 +1,11 @@
 import { POLYFILL_SCRIPT_PATTERN } from "../../constants/nextjs.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { findJsxAttribute } from "../../utils/find-jsx-attribute.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoPolyfillScript = defineRule<Rule>({
+export const nextjsNoPolyfillScript = defineRule({
   id: "nextjs-no-polyfill-script",
   title: "Redundant polyfill script",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-redirect-in-try-catch.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-redirect-in-try-catch.ts
index a4c05228f..987d343e0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-redirect-in-try-catch.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-redirect-in-try-catch.ts
@@ -1,11 +1,10 @@
 import { NEXTJS_NAVIGATION_FUNCTIONS } from "../../constants/nextjs.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoRedirectInTryCatch = defineRule<Rule>({
+export const nextjsNoRedirectInTryCatch = defineRule({
   id: "nextjs-no-redirect-in-try-catch",
   title: "redirect() inside try-catch",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-script-in-head.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-script-in-head.ts
index 1ff3eb0ba..de3e84f39 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-script-in-head.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-script-in-head.ts
@@ -1,10 +1,9 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoScriptInHead = defineRule<Rule>({
+export const nextjsNoScriptInHead = defineRule({
   id: "nextjs-no-script-in-head",
   title: "next/script inside next/head",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-side-effect-in-get-handler.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-side-effect-in-get-handler.ts
index 6de91e017..22bcd9229 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-side-effect-in-get-handler.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-side-effect-in-get-handler.ts
@@ -13,7 +13,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 const extractMutatingRouteSegment = (rawFilename: string): string | null => {
@@ -190,7 +189,7 @@ const resolveGetHandlerBodies = (
   return [];
 };
 
-export const nextjsNoSideEffectInGetHandler = defineRule<Rule>({
+export const nextjsNoSideEffectInGetHandler = defineRule({
   id: "nextjs-no-side-effect-in-get-handler",
   title: "Side effect in GET handler",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-use-search-params-without-suspense.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-use-search-params-without-suspense.ts
index e1afd7cff..e2ceea68b 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-use-search-params-without-suspense.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-use-search-params-without-suspense.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { getImportedName } from "../../utils/get-imported-name.js";
@@ -113,7 +112,7 @@ const collectImportedComponents = (
   return entries;
 };
 
-export const nextjsNoUseSearchParamsWithoutSuspense = defineRule<Rule>({
+export const nextjsNoUseSearchParamsWithoutSuspense = defineRule({
   id: "nextjs-no-use-search-params-without-suspense",
   title: "useSearchParams without Suspense",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-vercel-og-import.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-vercel-og-import.ts
index 7e06989b6..dafc67fc1 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-vercel-og-import.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/nextjs/nextjs-no-vercel-og-import.ts
@@ -1,9 +1,8 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const nextjsNoVercelOgImport = defineRule<Rule>({
+export const nextjsNoVercelOgImport = defineRule({
   id: "nextjs-no-vercel-og-import",
   title: "@vercel/og import instead of next/og",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/async-defer-await.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/async-defer-await.ts
index 99540d6b0..36a2dbd21 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/async-defer-await.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/async-defer-await.ts
@@ -8,7 +8,6 @@ import { isBareAwaitExpressionStatement } from "../../utils/is-bare-await-expres
 import { isEarlyExitIfStatement } from "../../utils/is-early-exit-if-statement.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { walkAst } from "../../utils/walk-ast.js";
 
@@ -173,7 +172,7 @@ const collectAwaitWindow = (statements: EsTreeNode[], startIndex: number): Await
 // whose test references no identifiers bound by the preamble. Any
 // non-binding statement between the await and the if implies the awaited
 // value is being prepared for use, so we conservatively skip.
-export const asyncDeferAwait = defineRule<Rule>({
+export const asyncDeferAwait = defineRule({
   id: "async-defer-await",
   title: "await before an early-return guard",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-global-css-variable-animation.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-global-css-variable-animation.ts
index 4febad4a8..852123b72 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-global-css-variable-animation.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-global-css-variable-animation.ts
@@ -3,12 +3,11 @@ import { defineRule } from "../../utils/define-rule.js";
 import { isMemberProperty } from "../../utils/is-member-property.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noGlobalCssVariableAnimation = defineRule<Rule>({
+export const noGlobalCssVariableAnimation = defineRule({
   id: "no-global-css-variable-animation",
   title: "Animating a global CSS variable",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-inline-prop-on-memo-component.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-inline-prop-on-memo-component.ts
index fd4de35f6..4be68b553 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-inline-prop-on-memo-component.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-inline-prop-on-memo-component.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -37,7 +36,7 @@ const isInlineReference = (node: EsTreeNode): string | null => {
   return null;
 };
 
-export const noInlinePropOnMemoComponent = defineRule<Rule>({
+export const noInlinePropOnMemoComponent = defineRule({
   id: "no-inline-prop-on-memo-component",
   title: "Inline prop defeats memo()",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-large-animated-blur.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-large-animated-blur.ts
index 08b2664f5..43a3c3c4c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-large-animated-blur.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-large-animated-blur.ts
@@ -4,12 +4,11 @@ import {
   MOTION_ANIMATE_PROPS,
 } from "../../constants/style.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noLargeAnimatedBlur = defineRule<Rule>({
+export const noLargeAnimatedBlur = defineRule({
   id: "no-large-animated-blur",
   title: "Large animated blur",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-layout-property-animation.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-layout-property-animation.ts
index 04f964b8d..1c4b57e04 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-layout-property-animation.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-layout-property-animation.ts
@@ -1,7 +1,6 @@
 import { LAYOUT_PROPERTIES, MOTION_ANIMATE_PROPS } from "../../constants/style.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -24,7 +23,7 @@ const isMotionElement = (attributeNode: EsTreeNode): boolean => {
   return false;
 };
 
-export const noLayoutPropertyAnimation = defineRule<Rule>({
+export const noLayoutPropertyAnimation = defineRule({
   id: "no-layout-property-animation",
   title: "Animating a layout property",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-permanent-will-change.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-permanent-will-change.ts
index 320089b7d..513f5862b 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-permanent-will-change.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-permanent-will-change.ts
@@ -1,10 +1,9 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noPermanentWillChange = defineRule<Rule>({
+export const noPermanentWillChange = defineRule({
   id: "no-permanent-will-change",
   title: "Permanent will-change wastes GPU",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-scale-from-zero.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-scale-from-zero.ts
index 754680d95..c414cf154 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-scale-from-zero.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-scale-from-zero.ts
@@ -1,10 +1,9 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noScaleFromZero = defineRule<Rule>({
+export const noScaleFromZero = defineRule({
   id: "no-scale-from-zero",
   title: "Animating scale from zero",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-transition-all.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-transition-all.ts
index 8d7bdb684..746f68383 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-transition-all.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-transition-all.ts
@@ -1,10 +1,9 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noTransitionAll = defineRule<Rule>({
+export const noTransitionAll = defineRule({
   id: "no-transition-all",
   title: "transition: all animates everything",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-usememo-simple-expression.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-usememo-simple-expression.ts
index 3a32c0604..46bbf7ab5 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-usememo-simple-expression.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/no-usememo-simple-expression.ts
@@ -5,7 +5,6 @@ import { isImportedFromModule } from "../../utils/find-import-source-for-name.js
 import { isCanonicalReactNamespaceName } from "../../utils/is-canonical-react-namespace-name.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 const isSimpleExpression = (node: EsTreeNode | null): boolean => {
@@ -43,7 +42,7 @@ const isTriviallyCheapExpression = (node: EsTreeNode | null): boolean => {
   return true;
 };
 
-export const noUsememoSimpleExpression = defineRule<Rule>({
+export const noUsememoSimpleExpression = defineRule({
   id: "no-usememo-simple-expression",
   title: "useMemo on a cheap value",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/prefer-stable-empty-fallback.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/prefer-stable-empty-fallback.ts
index 92d4edd20..f9b5c2cd4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/prefer-stable-empty-fallback.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/prefer-stable-empty-fallback.ts
@@ -10,7 +10,6 @@ import { isInsideFunctionScope } from "../../utils/is-inside-function-scope.js";
 import { isJsxAttributeOnIntrinsicHtmlElement } from "../../utils/is-on-intrinsic-html-element.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 interface EmptyFallback {
@@ -93,7 +92,7 @@ const buildMessage = (emptyKind: "array" | "object"): string => {
 //   - Stable expr := identifier / non-computed member chain / `this`
 //   - Intrinsic HTML elements are skipped (not memoised)
 //   - Inside function scope only — module-level JSX is allocated once
-export const preferStableEmptyFallback = defineRule<Rule>({
+export const preferStableEmptyFallback = defineRule({
   id: "prefer-stable-empty-fallback",
   title: "Empty fallback rebuilt each render",
   tags: ["react-jsx-only", "test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-animate-svg-wrapper.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-animate-svg-wrapper.ts
index d1d7bae98..f4487a04f 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-animate-svg-wrapper.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-animate-svg-wrapper.ts
@@ -1,12 +1,11 @@
 import { MOTION_ANIMATE_PROPS } from "../../constants/style.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const renderingAnimateSvgWrapper = defineRule<Rule>({
+export const renderingAnimateSvgWrapper = defineRule({
   id: "rendering-animate-svg-wrapper",
   title: "Animating an SVG directly",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hoist-jsx.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hoist-jsx.ts
index 6106ee286..f6a25933b 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hoist-jsx.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hoist-jsx.ts
@@ -3,7 +3,6 @@ import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -29,7 +28,7 @@ const jsxReferencesLocalScope = (jsxNode: EsTreeNode): boolean => {
   return referencesScope;
 };
 
-export const renderingHoistJsx = defineRule<Rule>({
+export const renderingHoistJsx = defineRule({
   id: "rendering-hoist-jsx",
   title: "Constant JSX rebuilt each render",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hydration-mismatch-time.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hydration-mismatch-time.ts
index 4f0fc21ed..68581ba2f 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hydration-mismatch-time.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hydration-mismatch-time.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -93,7 +92,7 @@ const hasSuppressHydrationWarningAttribute = (openingElement: EsTreeNode | null)
 // to wrap in `useEffect` + `useState` (so the dynamic value renders
 // only client-side) or to add `suppressHydrationWarning` to the parent
 // element when the mismatch is intentional.
-export const renderingHydrationMismatchTime = defineRule<Rule>({
+export const renderingHydrationMismatchTime = defineRule({
   id: "rendering-hydration-mismatch-time",
   title: "Time or random value in JSX",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hydration-no-flicker.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hydration-no-flicker.ts
index 71e755e8c..9a66cd41a 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hydration-no-flicker.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-hydration-no-flicker.ts
@@ -4,12 +4,11 @@ import { getEffectCallback } from "../../utils/get-effect-callback.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { isSetterCall } from "../../utils/is-setter-call.js";
 import { isUseStateSetterInScope } from "../../utils/is-use-state-setter-in-scope.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const renderingHydrationNoFlicker = defineRule<Rule>({
+export const renderingHydrationNoFlicker = defineRule({
   id: "rendering-hydration-no-flicker",
   title: "useEffect setState flashes on mount",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-script-defer-async.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-script-defer-async.ts
index 042849856..d15b45ffc 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-script-defer-async.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-script-defer-async.ts
@@ -1,12 +1,11 @@
 import { EXECUTABLE_SCRIPT_TYPES, SCRIPT_LOADING_ATTRIBUTES } from "../../constants/dom.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const renderingScriptDeferAsync = defineRule<Rule>({
+export const renderingScriptDeferAsync = defineRule({
   id: "rendering-script-defer-async",
   title: "Script without defer or async",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-usetransition-loading.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-usetransition-loading.ts
index 6dc655a29..dbdb16b26 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-usetransition-loading.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rendering-usetransition-loading.ts
@@ -3,7 +3,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -128,7 +127,7 @@ const referencesAsyncDataApi = (body: EsTreeNode | null): boolean => {
   return found;
 };
 
-export const renderingUsetransitionLoading = defineRule<Rule>({
+export const renderingUsetransitionLoading = defineRule({
   id: "rendering-usetransition-loading",
   title: "Loading useState forces extra render",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-derived-state-from-hook.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-derived-state-from-hook.ts
index 1639f9e88..a3ca99809 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-derived-state-from-hook.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-derived-state-from-hook.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -73,7 +72,7 @@ const findThresholdDerivedBindings = (
   return out;
 };
 
-export const rerenderDerivedStateFromHook = defineRule<Rule>({
+export const rerenderDerivedStateFromHook = defineRule({
   id: "rerender-derived-state-from-hook",
   title: "Continuous hook value over-renders",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-memo-before-early-return.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-memo-before-early-return.ts
index 78558a670..c161e3fe6 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-memo-before-early-return.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-memo-before-early-return.ts
@@ -3,7 +3,6 @@ import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -47,7 +46,7 @@ const containsEarlyReturn = (ifStatement: EsTreeNode): boolean => {
 // component bails out (loading, gated, etc.). Better to extract the JSX
 // into a memoized child component so the parent's early return
 // short-circuits before the child renders.
-export const rerenderMemoBeforeEarlyReturn = defineRule<Rule>({
+export const rerenderMemoBeforeEarlyReturn = defineRule({
   id: "rerender-memo-before-early-return",
   title: "useMemo before an early return",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-memo-with-default-value.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-memo-with-default-value.ts
index 4906f1dd3..2b1b88e3c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-memo-with-default-value.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-memo-with-default-value.ts
@@ -2,12 +2,11 @@ import { defineRule } from "../../utils/define-rule.js";
 import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const rerenderMemoWithDefaultValue = defineRule<Rule>({
+export const rerenderMemoWithDefaultValue = defineRule({
   id: "rerender-memo-with-default-value",
   title: "Empty default prop breaks memo",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-transitions-scroll.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-transitions-scroll.ts
index 608b0e1e4..764d30964 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-transitions-scroll.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/performance/rerender-transitions-scroll.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { isUseStateSetterInScope } from "../../utils/is-use-state-setter-in-scope.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -54,7 +53,7 @@ const handlerCallsSetState = (handler: EsTreeNode): EsTreeNode | null => {
 // to mark the update as non-urgent (so the browser can interrupt it for
 // input), or stash the value in a ref + raf throttle, or use
 // `useDeferredValue`.
-export const rerenderTransitionsScroll = defineRule<Rule>({
+export const rerenderTransitionsScroll = defineRule({
   id: "rerender-transitions-scroll",
   title: "setState in a scroll handler",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-children-length.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-children-length.ts
index 7acbfc3a3..4a2fb45a9 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-children-length.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-children-length.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const ARRAY_READ_METHOD_NAMES = new Set([
   "length",
@@ -91,7 +90,7 @@ const isChildrenMemberExpression = (node: EsTreeNodeOfType<"MemberExpression">):
 // which normalises the value to a flat array regardless of how many children
 // exist. This rule flags direct array-method access on `props.children`,
 // `this.props.children`, and destructured `children`.
-export const preactNoChildrenLength = defineRule<Rule>({
+export const preactNoChildrenLength = defineRule({
   id: "preact-no-children-length",
   title: "Array methods on Preact children can crash",
   requires: ["preact"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-react-hooks-import.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-react-hooks-import.ts
index 72e2f605c..97424d5ff 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-react-hooks-import.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-react-hooks-import.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const REACT_HOOK_NAMES = new Set([
   "useCallback",
@@ -38,7 +37,7 @@ const buildMessage = (importedNames: ReadonlyArray<string>): string =>
 // using `preact/compat` aliasing, and importing from `react` is exactly how
 // compat is meant to be consumed — flagging it there would be a false
 // positive.
-export const preactNoReactHooksImport = defineRule<Rule>({
+export const preactNoReactHooksImport = defineRule({
   id: "preact-no-react-hooks-import",
   title: "React hook imports break pure Preact hook state",
   requires: ["pure-preact"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-render-arguments.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-render-arguments.ts
index e9e8199ac..916c45a37 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-render-arguments.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-no-render-arguments.ts
@@ -3,7 +3,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isEs6Component } from "../../utils/is-es6-component.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 // Preact code conventionally imports the namespace as `Preact` (e.g.
 // `import * as Preact from "preact"; class Foo extends Preact.Component`).
@@ -89,7 +88,7 @@ const stripThisParameter = (params: ReadonlyArray<EsTreeNode>): ReadonlyArray<Es
 // We only flag class components that extend `Component` / `PureComponent`
 // (or `React.Component` / `React.PureComponent`) — function components
 // and non-component classes are untouched.
-export const preactNoRenderArguments = defineRule<Rule>({
+export const preactNoRenderArguments = defineRule({
   id: "preact-no-render-arguments",
   title: "render() reads props from arguments",
   requires: ["preact"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-prefer-ondblclick.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-prefer-ondblclick.ts
index c4fd56c84..aa43b928e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-prefer-ondblclick.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-prefer-ondblclick.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { findJsxAttribute } from "../../utils/find-jsx-attribute.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Your users get no response from `onDoubleClick` in Preact core, where it never fires, so use `onDblClick` instead, which matches the DOM event name.";
@@ -24,7 +23,7 @@ const MESSAGE =
 // flagging it there would be a false positive. Pairs with the existing
 // `preact-prefer-oninput` rule (same naming convention, same intent for
 // the `onChange` → `onInput` divergence).
-export const preactPreferOndblclick = defineRule<Rule>({
+export const preactPreferOndblclick = defineRule({
   id: "preact-prefer-ondblclick",
   title: "onDoubleClick instead of onDblClick",
   requires: ["pure-preact"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-prefer-oninput.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-prefer-oninput.ts
index 147cfbb29..2b2999ecd 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-prefer-oninput.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/preact/preact-prefer-oninput.ts
@@ -3,7 +3,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { findJsxAttribute } from "../../utils/find-jsx-attribute.js";
 import { getJsxPropStringValue } from "../../utils/get-jsx-prop-string-value.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const PREFER_ONINPUT_MESSAGE =
   "Your users see no live updates because `onChange` on text inputs in Preact core only fires on blur, so use `onInput` instead. `preact/compat` handles this for you.";
@@ -43,7 +42,7 @@ const isTextLikeInput = (openingElement: EsTreeNodeOfType<"JSXOpeningElement">):
 // `pure-preact` is both simpler and correct: if `react` (the alias
 // entry point for compat) is present in deps, the rule sits out
 // entirely. Pairs with the sibling `preact-prefer-ondblclick` rule.
-export const preactPreferOninput = defineRule<Rule>({
+export const preactPreferOninput = defineRule({
   id: "preact-prefer-oninput",
   title: "onChange instead of onInput",
   requires: ["pure-preact"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/button-has-type.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/button-has-type.ts
index 1e9c862a0..d9d77e6a4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/button-has-type.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/button-has-type.ts
@@ -105,7 +105,7 @@ const reportInvalid = (context: Parameters<Rule["create"]>[0], reportNode: EsTre
 //   - `React.createElement("button", { type: "foo" })` equivalents.
 // Three settings (button/submit/reset, default true) toggle which
 // values are allowed.
-export const buttonHasType = defineRule<Rule>({
+export const buttonHasType = defineRule({
   id: "button-has-type",
   title: "Button missing explicit type",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/checked-requires-onchange-or-readonly.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/checked-requires-onchange-or-readonly.ts
index de1e4548c..bd861178a 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/checked-requires-onchange-or-readonly.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/checked-requires-onchange-or-readonly.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getJsxAttributeName } from "../../utils/get-jsx-attribute-name.js";
 import { isCreateElementCall } from "../../utils/is-create-element-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MISSING_MESSAGE = "Your users can't toggle this input because `checked` has no `onChange`.";
 const EXCLUSIVE_MESSAGE =
@@ -77,7 +76,7 @@ const collectFromObjectProperties = (
 // Reports `<input type="checkbox" checked>` (and createElement equivalent)
 // without `onChange` or `readOnly`, and reports `checked + defaultChecked`
 // used together. Settings let either check be silenced.
-export const checkedRequiresOnchangeOrReadonly = defineRule<Rule>({
+export const checkedRequiresOnchangeOrReadonly = defineRule({
   id: "checked-requires-onchange-or-readonly",
   title: "Checked input without onChange",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/display-name.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/display-name.ts
index e11da7a1f..ae2b8508d 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/display-name.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/display-name.ts
@@ -8,7 +8,6 @@ import { isEs5Component } from "../../utils/is-es5-component.js";
 import { isEs6Component } from "../../utils/is-es6-component.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactComponentName } from "../../utils/is-react-component-name.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "This component shows up as Anonymous in React DevTools because it has no `displayName`.";
@@ -367,7 +366,7 @@ const hasDisplayNameAssignmentForProperty = (
 // legacy factories that take a config object — those need a
 // `displayName` property in the config when the assigned binding
 // isn't PascalCase.
-export const displayName = defineRule<Rule>({
+export const displayName = defineRule({
   id: "display-name",
   title: "Component missing display name",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/exhaustive-deps.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/exhaustive-deps.ts
index fd2b3142f..6ba270210 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/exhaustive-deps.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/exhaustive-deps.ts
@@ -12,7 +12,6 @@ import { getStaticTemplateLiteralValue } from "../../utils/get-static-template-l
 import { isAstNode } from "../../utils/is-ast-node.js";
 import { isReactComponentOrHookName } from "../../utils/is-react-component-or-hook-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import { REACT_HOC_NAMES } from "../../constants/react.js";
 import {
   getHookName,
@@ -656,7 +655,7 @@ const addAggregatePropsDependency = (
   if (hasMemberCallForRoot(callback, "props")) captureKeys.add("props");
 };
 
-export const exhaustiveDeps = defineRule<Rule>({
+export const exhaustiveDeps = defineRule({
   id: "exhaustive-deps",
   title: "Missing effect dependencies",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-component-props.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-component-props.ts
index 9ad0f8ae6..bf604079d 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-component-props.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-component-props.ts
@@ -5,7 +5,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getJsxAttributeName } from "../../utils/get-jsx-attribute-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactComponentName } from "../../utils/is-react-component-name.js";
-import type { Rule } from "../../utils/rule.js";
 
 interface ForbidEntry {
   propName?: string;
@@ -114,7 +113,7 @@ const buildMessage = (propName: string, message: string | null): string =>
 // Port of `oxc_linter::rules::react::forbid_component_props`. Reports
 // configured props on user-defined (PascalCase / namespaced) JSX
 // components.
-export const forbidComponentProps = defineRule<Rule>({
+export const forbidComponentProps = defineRule({
   id: "forbid-component-props",
   title: "Blocked component prop bypasses API contract",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-dom-props.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-dom-props.ts
index c5312e548..e0ee44a44 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-dom-props.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-dom-props.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isReactComponentName } from "../../utils/is-react-component-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 interface ForbiddenPropDescriptor {
   propName: string;
@@ -54,7 +53,7 @@ const resolveSettings = (
 // Port of `oxc_linter::rules::react::forbid_dom_props`. Configurable
 // via `forbid` setting; matches each prop only on DOM-tag JSX elements
 // (lowercase tag names), respecting per-prop `disallowedFor` allow-lists.
-export const forbidDomProps = defineRule<Rule>({
+export const forbidDomProps = defineRule({
   id: "forbid-dom-props",
   title: "Blocked DOM prop bypasses project contract",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-elements.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-elements.ts
index 43647533b..e961e92f0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-elements.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forbid-elements.ts
@@ -4,7 +4,6 @@ import { flattenCalleeName } from "../../utils/flatten-callee-name.js";
 import { flattenJsxName } from "../../utils/flatten-jsx-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactFunctionCall } from "../../utils/is-react-function-call.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (element: string, customHelp?: string): string =>
   customHelp
@@ -44,7 +43,7 @@ const flattenMemberName = flattenCalleeName;
 // settings list — `forbid: ["button", { element: "Modal", message: "use
 // Button" }, ...]`. Each item matches against the JSX element name or
 // the first argument of `React.createElement(...)`.
-export const forbidElements = defineRule<Rule>({
+export const forbidElements = defineRule({
   id: "forbid-elements",
   title: "Blocked element bypasses approved UI primitives",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forward-ref-uses-ref.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forward-ref-uses-ref.ts
index 0dfdb857e..4f65e6e31 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forward-ref-uses-ref.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/forward-ref-uses-ref.ts
@@ -3,7 +3,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getCalleeName } from "../../utils/get-callee-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "The parent can't reach this component's node because the `forwardRef` wrapper ignores `ref`.";
@@ -12,7 +11,7 @@ const MESSAGE =
 // `forwardRef((props) => …)` and `React.forwardRef((props) => …)` —
 // when the inner function's arity is exactly 1 (no `ref` parameter),
 // `forwardRef` is a no-op wrapper.
-export const forwardRefUsesRef = defineRule<Rule>({
+export const forwardRefUsesRef = defineRule({
   id: "forward-ref-uses-ref",
   title: "forwardRef without ref parameter",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/hook-use-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/hook-use-state.ts
index f5ea7ad1e..e81e64c73 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/hook-use-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/hook-use-state.ts
@@ -3,7 +3,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactFunctionCall } from "../../utils/is-react-function-call.js";
-import type { Rule } from "../../utils/rule.js";
 
 const REQUIRE_DESTRUCTURE_MESSAGE =
   "`useState` should be destructured as `[value, setValue]` so readers can see the state value and setter together.";
@@ -62,7 +61,7 @@ const expectedSetterNames = (prefix: string, suffix: string): ReadonlyArray<stri
 // Names that don't start with a lowercase letter (`RGB`) are flagged
 // because no `set<X>` convention can be derived (mirrors OXC's
 // `split_leading_lowercase` early-return).
-export const hookUseState = defineRule<Rule>({
+export const hookUseState = defineRule({
   id: "hook-use-state",
   title: "useState not destructured",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/iframe-missing-sandbox.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/iframe-missing-sandbox.ts
index e254a5815..e2f527629 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/iframe-missing-sandbox.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/iframe-missing-sandbox.ts
@@ -64,7 +64,7 @@ const validateSandboxValue = (
 //  - `React.createElement("iframe", …)` equivalents of all three.
 // `document.createElement("iframe", …)` is intentionally NOT flagged
 // (DOM API, sandbox can't be set there).
-export const iframeMissingSandbox = defineRule<Rule>({
+export const iframeMissingSandbox = defineRule({
   id: "iframe-missing-sandbox",
   title: "iframe missing sandbox attribute",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-boolean-value.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-boolean-value.ts
index a3653b328..5770799dc 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-boolean-value.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-boolean-value.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const NEVER_MESSAGE = (): string =>
   "This boolean prop style disagrees with the project setting, so equivalent true props are harder to scan consistently.";
@@ -39,7 +38,7 @@ const resolveSettings = (
 //     Per-attribute exceptions allowed via the `always` list.
 //   - "always": `<C foo />` should be `<C foo={true} />`. Per-attribute
 //     exceptions via the `never` list.
-export const jsxBooleanValue = defineRule<Rule>({
+export const jsxBooleanValue = defineRule({
   id: "jsx-boolean-value",
   title: "Inconsistent boolean prop notation",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-curly-brace-presence.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-curly-brace-presence.ts
index c1d1e1d4a..01e1c011a 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-curly-brace-presence.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-curly-brace-presence.ts
@@ -173,7 +173,7 @@ const isScriptElement = (openingElement: EsTreeNodeOfType<"JSXOpeningElement">):
   (openingElement.name as EsTreeNodeOfType<"JSXIdentifier">).name === "script";
 
 // Port of `oxc_linter::rules::react::jsx_curly_brace_presence`.
-export const jsxCurlyBracePresence = defineRule<Rule>({
+export const jsxCurlyBracePresence = defineRule({
   id: "jsx-curly-brace-presence",
   title: "Unnecessary curly braces in JSX",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-filename-extension.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-filename-extension.ts
index 604c187c7..17e206513 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-filename-extension.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-filename-extension.ts
@@ -4,7 +4,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const JSX_NOT_ALLOWED = (extension: string): string =>
   `This file contains JSX but uses a \`${extension}\` name, so the filename no longer signals JSX to readers or tooling conventions.`;
@@ -44,7 +43,7 @@ const normalizeExtensions = (raw: ReadonlyArray<string>): Set<string> => {
 //     `jsx`, `tsx`),
 //   - in `as-needed` mode, allowed-extension files that contain NO
 //     JSX content (the file claims to be JSX but isn't).
-export const jsxFilenameExtension = defineRule<Rule>({
+export const jsxFilenameExtension = defineRule({
   id: "jsx-filename-extension",
   title: "JSX in disallowed file extension",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-fragments.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-fragments.ts
index 755c115d1..a1dce0256 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-fragments.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-fragments.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isJsxFragmentElement } from "../../utils/is-jsx-fragment-element.js";
-import type { Rule } from "../../utils/rule.js";
 
 const SYNTAX_MESSAGE =
   "`<React.Fragment>` is used where shorthand fragments are configured, so similar wrappers look different across the codebase.";
@@ -28,7 +27,7 @@ const resolveSettings = (
 //   - "syntax" (default): prefer `<></>`. Flags `<React.Fragment>...</>`
 //     and `<Fragment>...</>` with NO attributes.
 //   - "element": prefer `<React.Fragment>`. Flags `<></>` shorthand.
-export const jsxFragments = defineRule<Rule>({
+export const jsxFragments = defineRule({
   id: "jsx-fragments",
   title: "Inconsistent fragment syntax",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-handler-names.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-handler-names.ts
index dd93d97e5..ebe16780d 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-handler-names.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-handler-names.ts
@@ -4,7 +4,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getJsxAttributeName } from "../../utils/get-jsx-attribute-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildHandlerNameMessage = (handlerName: string, propKey: string): string =>
   `The handler "${handlerName}" does not match the "${propKey}" event prop convention, so readers cannot trace event flow quickly.`;
@@ -163,7 +162,7 @@ const isMemberExpressionCallee = (
 };
 
 // Port of `oxc_linter::rules::react::jsx_handler_names`.
-export const jsxHandlerNames = defineRule<Rule>({
+export const jsxHandlerNames = defineRule({
   id: "jsx-handler-names",
   title: "Inconsistent event handler names",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-key.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-key.ts
index 79645b938..f5d511c84 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-key.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-key.ts
@@ -261,7 +261,7 @@ const getKeyAttributeValueString = (
 //   - warnOnDuplicates (default false): duplicate `key` values among siblings
 // Skips elements wrapped by `Children.toArray(...)` since React's runtime
 // assigns synthetic keys for those.
-export const jsxKey = defineRule<Rule>({
+export const jsxKey = defineRule({
   id: "jsx-key",
   title: "Missing key in list",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-max-depth.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-max-depth.ts
index 57d8a048f..6ea73b5bf 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-max-depth.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-max-depth.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { findVariableInitializer } from "../../utils/find-variable-initializer.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (depth: number, max: number): string =>
   `This JSX is hard to read at ${depth} levels deep, past the limit of ${max}.`;
@@ -97,7 +96,7 @@ const computeChildrenDepth = (
 // `{<jsxSubtree/>}` children — recursing through bindings via our
 // initializer-tracker. Cycles in binding references (`x → y → x`) are
 // broken by name.
-export const jsxMaxDepth = defineRule<Rule>({
+export const jsxMaxDepth = defineRule({
   id: "jsx-max-depth",
   title: "JSX nested too deeply",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-comment-textnodes.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-comment-textnodes.ts
index f31e38686..da0dc0c6e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-comment-textnodes.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-comment-textnodes.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Your users see this comment as text on the page because `//` & `/*` aren't hidden in JSX.";
@@ -41,7 +40,7 @@ const isInsideLiteralTextTag = (node: EsTreeNode): boolean => {
 // comments, they're rendered as literal text. Skips text inside
 // `<code>`, `<pre>`, `<kbd>`, `<samp>`, `<tt>` — those tags exist to
 // render literal text including code-comment-like prefixes.
-export const jsxNoCommentTextnodes = defineRule<Rule>({
+export const jsxNoCommentTextnodes = defineRule({
   id: "jsx-no-comment-textnodes",
   title: "Comment rendered as JSX text",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-constructed-context-values.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-constructed-context-values.ts
index 2a41d11e6..2e37ce22e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-constructed-context-values.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-constructed-context-values.ts
@@ -9,7 +9,6 @@ import { isInsideFunctionScope } from "../../utils/is-inside-function-scope.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isTestlikeFilename } from "../../utils/is-testlike-filename.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Every reader of this context redraws on each render because you build its `value` inline.";
@@ -132,7 +131,7 @@ const isCreateContextBindingJsxName = (
 // checking whether the JSX opening name is one of those bindings.
 // Covers createContext imported from `react`, `use-context-selector`,
 // and `react-tracked`.
-export const jsxNoConstructedContextValues = defineRule<Rule>({
+export const jsxNoConstructedContextValues = defineRule({
   id: "jsx-no-constructed-context-values",
   title: "Unstable context provider value",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-duplicate-props.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-duplicate-props.ts
index 9c1599eb4..e87543694 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-duplicate-props.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-duplicate-props.ts
@@ -1,14 +1,13 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 // Port of `oxc_linter::rules::react::jsx_no_duplicate_props`. Walks each
 // JSXOpeningElement's attribute list and reports any `JSXAttribute` whose
 // identifier name has already been seen in the same opening tag. Spread
 // attributes (`{...props}`) are skipped — they don't carry a static name.
 // OXC's port intentionally skips `ignoreCase` (cases differ → distinct).
-export const jsxNoDuplicateProps = defineRule<Rule>({
+export const jsxNoDuplicateProps = defineRule({
   id: "jsx-no-duplicate-props",
   title: "Duplicate props on element",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-jsx-as-prop.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-jsx-as-prop.ts
index 92db1a223..6649c04f5 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-jsx-as-prop.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-jsx-as-prop.ts
@@ -12,7 +12,6 @@ import { isJsxAttributeOnIntrinsicHtmlElement } from "../../utils/is-on-intrinsi
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isTestlikeFilename } from "../../utils/is-testlike-filename.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE = "This child redraws every render because the prop gets brand new JSX each time.";
 
@@ -306,7 +305,7 @@ const followsRenderLocalJsxBinding = (
 // function scope. Also follows render-local identifier bindings
 // (`const tree = <X />; return <C jsx={tree} />`) via
 // `followsRenderLocalJsxBinding` — hoisted JSX (module scope) is exempt.
-export const jsxNoJsxAsProp = defineRule<Rule>({
+export const jsxNoJsxAsProp = defineRule({
   id: "jsx-no-jsx-as-prop",
   title: "JSX element passed as a prop",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-array-as-prop.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-array-as-prop.ts
index 3567450fe..f301334eb 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-array-as-prop.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-array-as-prop.ts
@@ -12,7 +12,6 @@ import { isJsxAttributeOnIntrinsicHtmlElement } from "../../utils/is-on-intrinsi
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isTestlikeFilename } from "../../utils/is-testlike-filename.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import {
   DATA_ARRAY_PROP_NAMES,
   DATA_ARRAY_PROP_SUFFIXES,
@@ -134,7 +133,7 @@ const followsRenderLocalArrayBinding = (
 // IS flagged when the binding's scope owner is the render function.
 // Hoisted bindings (module-level) are exempt because they aren't
 // allocated per render.
-export const jsxNoNewArrayAsProp = defineRule<Rule>({
+export const jsxNoNewArrayAsProp = defineRule({
   id: "jsx-no-new-array-as-prop",
   title: "New array passed as a prop",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-function-as-prop.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-function-as-prop.ts
index dac4c226d..c209a105b 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-function-as-prop.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-function-as-prop.ts
@@ -12,7 +12,6 @@ import {
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isTestlikeFilename } from "../../utils/is-testlike-filename.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import {
   ACCESSOR_PREDICATE_PREFIXES,
   ONE_SHOT_HANDLER_SUFFIXES,
@@ -496,7 +495,7 @@ const isParameterBindingWrapper = (expression: EsTreeNode): boolean => {
 // is declared in the render function's scope. Hoisted bindings
 // (module scope) are exempt — the allocation only happens once.
 // See `followsRenderLocalFunctionBinding` for the resolution details.
-export const jsxNoNewFunctionAsProp = defineRule<Rule>({
+export const jsxNoNewFunctionAsProp = defineRule({
   id: "jsx-no-new-function-as-prop",
   title: "New function passed as a prop",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-object-as-prop.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-object-as-prop.ts
index 0d2c7f3f3..ce9e47057 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-object-as-prop.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-new-object-as-prop.ts
@@ -12,7 +12,6 @@ import { isJsxAttributeOnIntrinsicHtmlElement } from "../../utils/is-on-intrinsi
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isTestlikeFilename } from "../../utils/is-testlike-filename.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import {
   ALWAYS_FRESH_OBJECT_PROPS,
   CONFIG_OBJECT_PROP_NAMES,
@@ -125,7 +124,7 @@ const followsRenderLocalObjectBinding = (
 // identifier-binding case (`const x = {}; <C prop={x} />`) is covered
 // via the same `findVariableInitializer` lookup used by the sister
 // rules.
-export const jsxNoNewObjectAsProp = defineRule<Rule>({
+export const jsxNoNewObjectAsProp = defineRule({
   id: "jsx-no-new-object-as-prop",
   title: "New object passed as a prop",
   tags: ["react-jsx-only"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-script-url.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-script-url.ts
index bd95d9d20..411b2bb9f 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-script-url.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-script-url.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE = "A `javascript:` URL is an XSS hole that runs injected input as code.";
 
@@ -51,7 +50,7 @@ const isLinkPropForElement = (
 // `javascript:` regex. By default only `<a href="...">` is checked; the
 // `components` map lets callers extend to custom Link components, and
 // `includeFromSettings` opts in to the `linkComponents` settings hash.
-export const jsxNoScriptUrl = defineRule<Rule>({
+export const jsxNoScriptUrl = defineRule({
   id: "jsx-no-script-url",
   title: "javascript: URL in JSX",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-undef.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-undef.ts
index b245d4d9d..c9ac9dac4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-undef.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-undef.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { findProgramRoot } from "../../utils/find-program-root.js";
 import { findVariableInitializer } from "../../utils/find-variable-initializer.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (name: string): string =>
   `\`${name}\` crashes at runtime because it isn't defined here.`;
@@ -55,7 +54,7 @@ const getRootIdentifier = (elementName: EsTreeNode): string | null => {
 //     diagnostic. `interface` and `type` alias declarations do NOT
 //     — those are erased at runtime and JSX usage of them is an
 //     error we want to surface.
-export const jsxNoUndef = defineRule<Rule>({
+export const jsxNoUndef = defineRule({
   id: "jsx-no-undef",
   title: "Undefined JSX component",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-useless-fragment.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-useless-fragment.ts
index d819b07ed..95fb9e77e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-useless-fragment.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-no-useless-fragment.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { hasJsxKeyAttribute } from "../../utils/has-jsx-key-attribute.js";
 import { isJsxFragmentElement } from "../../utils/is-jsx-fragment-element.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const NEEDS_MORE_CHILDREN = "This fragment wraps a single child & does nothing.";
 const CHILD_OF_HTML_ELEMENT =
@@ -97,7 +96,7 @@ const isFragmentWithOnlyTextAndNotJsxChild = (
 //   - `<><X /></>` directly inside an HTML element (HTML can hold the
 //     child directly).
 // Honors `allowExpressions: true` to permit `<>{expr}</>`.
-export const jsxNoUselessFragment = defineRule<Rule>({
+export const jsxNoUselessFragment = defineRule({
   id: "jsx-no-useless-fragment",
   title: "Unnecessary React fragment",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-pascal-case.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-pascal-case.ts
index 8f5950af3..2728a5f1c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-pascal-case.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-pascal-case.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (componentName: string, allowAllCaps: boolean): string =>
   allowAllCaps
@@ -148,7 +147,7 @@ const matchesIgnoreGlob = (
 // user-defined JSX components whose name isn't PascalCase. Supports
 // allowAllCaps / allowNamespace / allowLeadingUnderscore / ignore glob
 // settings. HTML tags (lowercase first letter) are skipped.
-export const jsxPascalCase = defineRule<Rule>({
+export const jsxPascalCase = defineRule({
   id: "jsx-pascal-case",
   title: "Component name not PascalCase",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-props-no-spread-multi.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-props-no-spread-multi.ts
index 4f1d166bd..7e1114d5c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-props-no-spread-multi.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-props-no-spread-multi.ts
@@ -3,7 +3,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildIdentifierMessage = (name: string): string =>
   `The later spread of \`${name}\` silently overrides the earlier one.`;
@@ -34,7 +33,7 @@ const flattenMemberExpressionName = (node: EsTreeNode): string | null => {
 // when the same identifier or member expression is spread more than once
 // in a single JSX element (`<C {...props} {...props} />` or
 // `<C {...this.props} {...this.props} />`).
-export const jsxPropsNoSpreadMulti = defineRule<Rule>({
+export const jsxPropsNoSpreadMulti = defineRule({
   id: "jsx-props-no-spread-multi",
   title: "Same prop spread multiple times",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-props-no-spreading.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-props-no-spreading.ts
index c25fb49ef..78c76ff21 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-props-no-spreading.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/jsx-props-no-spreading.ts
@@ -5,7 +5,6 @@ import { flattenJsxName } from "../../utils/flatten-jsx-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactComponentName } from "../../utils/is-react-component-name.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE = "You can't tell what props reach this element when you spread them.";
 
@@ -38,7 +37,7 @@ const resolveSettings = (
 // JSX names). Settings let either tag class be disabled, plus an
 // exception list and an `explicitSpread: "ignore"` mode that allows
 // spreads of object literals (`<C {...{ foo: 1 }} />`).
-export const jsxPropsNoSpreading = defineRule<Rule>({
+export const jsxPropsNoSpreading = defineRule({
   id: "jsx-props-no-spreading",
   title: "Props spread onto element",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-array-index-key.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-array-index-key.ts
index f665e63b7..11de19e5b 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-array-index-key.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-array-index-key.ts
@@ -9,7 +9,6 @@ import {
   PURE_SVG_PRIMITIVE_TAGS,
   STATELESS_HTML_LEAF_TAGS,
 } from "../../utils/jsx-stateless-leaf.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE = "Your users can see & submit the wrong data when this list reorders.";
 
@@ -357,7 +356,7 @@ const isFragmentJsxName = (jsxOpeningName: EsTreeNode): boolean => {
 };
 
 // Port of `oxc_linter::rules::react::no_array_index_key`.
-export const noArrayIndexKey = defineRule<Rule>({
+export const noArrayIndexKey = defineRule({
   id: "no-array-index-key",
   title: "Array index used as a key",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-children-prop.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-children-prop.ts
index 2aa587170..2c56426b3 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-children-prop.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-children-prop.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isCreateElementCall } from "../../utils/is-create-element-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "A `children` prop can override or hide nested children, so the component may render different content than the JSX shows.";
@@ -12,7 +11,7 @@ const MESSAGE =
 //   1. A `JSXAttribute` whose name is the identifier `children`.
 //   2. A `React.createElement(type, { children: ... })` call where the
 //      props bag (the second argument) contains a static `children` key.
-export const noChildrenProp = defineRule<Rule>({
+export const noChildrenProp = defineRule({
   id: "no-children-prop",
   title: "Children passed as a prop",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-clone-element.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-clone-element.ts
index 98e63166c..e5b364063 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-clone-element.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-clone-element.ts
@@ -3,7 +3,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isImportedFromModule } from "../../utils/find-import-source-for-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "`React.cloneElement` couples the parent to the child's prop shape, so child prop changes can silently break injected behavior.";
@@ -13,7 +12,7 @@ const MESSAGE =
 // (or `<NS>` for the namespace form) was imported from `"react"`.
 // Helpers like `import { cloneElement } from 'something-else'` or local
 // `const cloneElement = ...` aren't flagged.
-export const noCloneElement = defineRule<Rule>({
+export const noCloneElement = defineRule({
   id: "no-clone-element",
   title: "cloneElement makes child props fragile",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-danger-with-children.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-danger-with-children.ts
index c0165d645..261ad2101 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-danger-with-children.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-danger-with-children.ts
@@ -5,7 +5,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { hasJsxPropIgnoreCase } from "../../utils/has-jsx-prop-ignore-case.js";
 import { isCreateElementCall } from "../../utils/is-create-element-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE = "React throws an error when you set both children & `dangerouslySetInnerHTML`.";
 
@@ -82,7 +81,7 @@ const resolveJsxSpreadPropsShape = (
 // Port of `oxc_linter::rules::react::no_danger_with_children`. Reports
 // when the same JSX element / createElement call has BOTH a `children`
 // prop / nested children AND `dangerouslySetInnerHTML`.
-export const noDangerWithChildren = defineRule<Rule>({
+export const noDangerWithChildren = defineRule({
   id: "no-danger-with-children",
   title: "dangerouslySetInnerHTML with children",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-danger.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-danger.ts
index 252e19c6e..cdae0fab7 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-danger.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-danger.ts
@@ -3,7 +3,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { hasJsxProp } from "../../utils/has-jsx-prop.js";
 import { isCreateElementCall } from "../../utils/is-create-element-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "`dangerouslySetInnerHTML` is an XSS hole that runs attacker-controlled HTML in your users' browsers.";
@@ -11,7 +10,7 @@ const MESSAGE =
 // Port of `oxc_linter::rules::react::no_danger`. Flags any
 // `dangerouslySetInnerHTML` prop, both as a JSXAttribute on a JSX element
 // and as a property in the props object passed to `React.createElement`.
-export const noDanger = defineRule<Rule>({
+export const noDanger = defineRule({
   id: "no-danger",
   title: "Raw HTML injection can run unsafe markup",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-did-mount-set-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-did-mount-set-state.ts
index f0143c294..0245a4ec8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-did-mount-set-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-did-mount-set-state.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isSetStateCallInLifecycle } from "../../utils/is-set-state-in-lifecycle.js";
-import type { Rule } from "../../utils/rule.js";
 
 const LIFECYCLE_NAMES = new Set(["componentDidMount"]);
 const MESSAGE =
@@ -28,7 +27,7 @@ const resolveSettings = (
 // `this.setState(...)` directly inside a `componentDidMount` lifecycle
 // (default), or inside any nested function within `componentDidMount`
 // when `mode: "disallow-in-func"`.
-export const noDidMountSetState = defineRule<Rule>({
+export const noDidMountSetState = defineRule({
   id: "no-did-mount-set-state",
   title: "setState in componentDidMount",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-did-update-set-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-did-update-set-state.ts
index 77c70c774..4729116ce 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-did-update-set-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-did-update-set-state.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isSetStateCallInLifecycle } from "../../utils/is-set-state-in-lifecycle.js";
-import type { Rule } from "../../utils/rule.js";
 
 const LIFECYCLE_NAMES = new Set(["componentDidUpdate"]);
 const MESSAGE =
@@ -26,7 +25,7 @@ const resolveSettings = (
 // Port of `oxc_linter::rules::react::no_did_update_set_state`. Flags
 // `this.setState(...)` inside `componentDidUpdate`. With
 // `mode: "disallow-in-func"`, also flags nested-function call sites.
-export const noDidUpdateSetState = defineRule<Rule>({
+export const noDidUpdateSetState = defineRule({
   id: "no-did-update-set-state",
   title: "setState in componentDidUpdate",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-direct-mutation-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-direct-mutation-state.ts
index 61501fc29..591f169e2 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-direct-mutation-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-direct-mutation-state.ts
@@ -57,7 +57,7 @@ const reportIfStateMutation = (
 // Port of `oxc_linter::rules::react::no_direct_mutation_state`. Flags
 // direct assignment / update to `this.state.*` outside the constructor of
 // a React component (class component or createReactClass factory).
-export const noDirectMutationState = defineRule<Rule>({
+export const noDirectMutationState = defineRule({
   id: "no-direct-mutation-state",
   title: "Direct mutation of this.state",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-find-dom-node.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-find-dom-node.ts
index dbafcdba1..f0a40e566 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-find-dom-node.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-find-dom-node.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const ALLOWED_NAMESPACES = new Set(["React", "ReactDOM", "ReactDom"]);
 const MESSAGE = "`findDOMNode` crashes your app in React 19 because it was removed.";
@@ -9,7 +8,7 @@ const MESSAGE = "`findDOMNode` crashes your app in React 19 because it was remov
 // Port of `oxc_linter::rules::react::no_find_dom_node`. Flags
 // `findDOMNode(...)` and `<NS>.findDOMNode(...)` where `<NS>` is one of
 // `React`, `ReactDOM`, `ReactDom`.
-export const noFindDomNode = defineRule<Rule>({
+export const noFindDomNode = defineRule({
   id: "no-find-dom-node",
   title: "findDOMNode breaks component encapsulation",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-is-mounted.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-is-mounted.ts
index 79b86d589..d01eb0422 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-is-mounted.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-is-mounted.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 // Port of `oxc_linter::rules::react::no_is_mounted`. Mirrors the Rust
 // rule's behavior: flags a `this.isMounted()` call only when it sits
@@ -9,7 +8,7 @@ import type { Rule } from "../../utils/rule.js";
 // callback (TSESTree `Property` value), since those are the React
 // component shapes the rule cares about. A bare `this.isMounted()` at
 // module scope is left alone.
-export const noIsMounted = defineRule<Rule>({
+export const noIsMounted = defineRule({
   id: "no-is-mounted",
   title: "isMounted lets async callbacks update after unmount",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-multi-comp.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-multi-comp.ts
index 2f363c6af..554ef040a 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-multi-comp.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-multi-comp.ts
@@ -7,7 +7,6 @@ import { isEs6Component } from "../../utils/is-es6-component.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactComponentName } from "../../utils/is-react-component-name.js";
 import { isTestlikeFilename } from "../../utils/is-testlike-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import type { ScopeAnalysis, SymbolDescriptor } from "../../semantic/scope-analysis.js";
 import { flattenCalleeName } from "../../utils/flatten-callee-name.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
@@ -567,7 +566,7 @@ const walkComponentSearch = (node: EsTreeNode, context: VisitContext): void => {
 //
 // Component nesting is tracked: components defined INSIDE another
 // component aren't double-counted.
-export const noMultiComp = defineRule<Rule>({
+export const noMultiComp = defineRule({
   id: "no-multi-comp",
   title: "Multiple components in one file",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-namespace.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-namespace.ts
index 913ccbe6c..61eb46215 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-namespace.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-namespace.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isCreateElementCall } from "../../utils/is-create-element-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (componentName: string): string =>
   `React can't render namespaced names like \`${componentName}\`.`;
@@ -10,7 +9,7 @@ const buildMessage = (componentName: string): string =>
 // Port of `oxc_linter::rules::react::no_namespace`. Flags JSX namespaced
 // names (`<ns:Foo />`) and string-literal element types passed to
 // `React.createElement` that contain a colon.
-export const noNamespace = defineRule<Rule>({
+export const noNamespace = defineRule({
   id: "no-namespace",
   title: "Namespaced JSX element",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-react-children.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-react-children.ts
index c1b3e0821..0daeedc89 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-react-children.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-react-children.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isImportedFromModule } from "../../utils/find-import-source-for-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "`React.Children` traversal depends on the runtime child shape, so wrapping or unwrapping a child can silently change what gets visited.";
@@ -28,7 +27,7 @@ const isReactNamespaceMember = (node: EsTreeNode, contextNode: EsTreeNode): bool
 // and `React.Children.<method>(...)` (when `React` is the local name of
 // any React import). Local `Children` declarations and unrelated imports
 // aren't flagged.
-export const noReactChildren = defineRule<Rule>({
+export const noReactChildren = defineRule({
   id: "no-react-children",
   title: "React.Children is fragile when child shape changes",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-redundant-should-component-update.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-redundant-should-component-update.ts
index 921740d4f..950f63021 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-redundant-should-component-update.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-redundant-should-component-update.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (className: string): string =>
   `\`shouldComponentUpdate\` fights PureComponent's built-in check in \`${className}\` & can skip needed updates.`;
@@ -40,7 +39,7 @@ const findShouldComponentUpdate = (classBody: EsTreeNodeOfType<"ClassBody">): Es
 // Reports `shouldComponentUpdate` defined on a `class extends
 // React.PureComponent` (or bare `extends PureComponent`) — PureComponent
 // already implements shallow-equal SCU, so the override is redundant.
-export const noRedundantShouldComponentUpdate = defineRule<Rule>({
+export const noRedundantShouldComponentUpdate = defineRule({
   id: "no-redundant-should-component-update",
   title: "Redundant shouldComponentUpdate",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-render-return-value.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-render-return-value.ts
index 105919772..b01331953 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-render-return-value.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-render-return-value.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE = "Your app breaks in React 19 because `ReactDOM.render` returns nothing there.";
 
@@ -39,7 +38,7 @@ const isUsedAsReturnValue = (parent: EsTreeNode | null | undefined): boolean =>
 // the return value of `ReactDOM.render(...)` is captured into a variable,
 // returned from a function, assigned, used as an object-property value,
 // or implicitly returned from an expression-bodied arrow.
-export const noRenderReturnValue = defineRule<Rule>({
+export const noRenderReturnValue = defineRule({
   id: "no-render-return-value",
   title: "Using ReactDOM.render return value",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-set-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-set-state.ts
index 0ea6e224f..4ba14d8ec 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-set-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-set-state.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getParentComponent } from "../../utils/get-parent-component.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "`this.setState` keeps local class state in a project that forbids it, so state ownership becomes harder to reason about.";
@@ -10,7 +9,7 @@ const MESSAGE =
 // Port of `oxc_linter::rules::react::no_set_state`. Style rule for
 // architectures (Flux-like) that forbid local component state — flags
 // `this.setState(...)` only when inside an es5/es6 React component.
-export const noSetState = defineRule<Rule>({
+export const noSetState = defineRule({
   id: "no-set-state",
   title: "Local class state forbidden",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-string-refs.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-string-refs.ts
index 632e50494..6d4b3ac55 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-string-refs.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-string-refs.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getParentComponent } from "../../utils/get-parent-component.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isTestlikeFilename } from "../../utils/is-testlike-filename.js";
-import type { Rule } from "../../utils/rule.js";
 
 const STRING_IN_REF_MESSAGE =
   "Your component can't reach this node because string refs don't work in modern React.";
@@ -55,7 +54,7 @@ const resolveSettings = (
 //      With `noTemplateLiterals: true` setting, also reports template
 //      literals (`<x ref={\`...\`} />`).
 //   2. `this.refs.foo` — when used inside a React component's body.
-export const noStringRefs = defineRule<Rule>({
+export const noStringRefs = defineRule({
   id: "no-string-refs",
   title: "String refs are legacy and fragile",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-this-in-sfc.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-this-in-sfc.ts
index 31a9d45cc..d13997fc0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-this-in-sfc.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-this-in-sfc.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isEs5Component } from "../../utils/is-es5-component.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactComponentName } from "../../utils/is-react-component-name.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE = "This value is `undefined` because function components have no `this`.";
 
@@ -122,7 +121,7 @@ const looksLikeFunctionComponent = (
 // or calls React.createElement; we approximate by relying on the
 // PascalCase naming convention. Class components are excluded by the
 // ancestor walk.
-export const noThisInSfc = defineRule<Rule>({
+export const noThisInSfc = defineRule({
   id: "no-this-in-sfc",
   title: "this used in function component",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unescaped-entities.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unescaped-entities.ts
index b0f0fb05b..8cee6c178 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unescaped-entities.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unescaped-entities.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const ESCAPED_VERSIONS: Record<string, string> = {
   '"': "`&quot;` / `&ldquo;` / `&#34;` / `&rdquo;`",
@@ -16,7 +15,7 @@ const buildMessage = (character: string): string =>
 // text nodes and reports each `'`, `"`, `>`, and `}` character as an
 // unescaped entity. Matches `eslint-plugin-react`'s default surface
 // (OXC's narrower port covered only quotes).
-export const noUnescapedEntities = defineRule<Rule>({
+export const noUnescapedEntities = defineRule({
   id: "no-unescaped-entities",
   title: "Unescaped entities in JSX",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unknown-property.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unknown-property.ts
index 179cbbd44..7e77170d2 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unknown-property.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unknown-property.ts
@@ -12,7 +12,6 @@ import { getJsxAttributeName } from "../../utils/get-jsx-attribute-name.js";
 import { isGeneratedImageRenderContext } from "../../utils/is-generated-image-render-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { fileImportsNonReactJsxDialect } from "../../utils/non-react-jsx-dialect.js";
-import type { Rule } from "../../utils/rule.js";
 
 interface NoUnknownPropertySettings {
   ignore?: ReadonlyArray<string>;
@@ -79,7 +78,7 @@ const UNKNOWN_PROP_GENERIC = "React ignores this prop because it doesn't recogni
 // `utils/non-react-jsx-dialect.ts` for the canonical package list +
 // the import / attribute markers we recognise.
 
-export const noUnknownProperty = defineRule<Rule>({
+export const noUnknownProperty = defineRule({
   id: "no-unknown-property",
   title: "Unknown DOM property",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unsafe.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unsafe.ts
index 7da0e5a44..469666e06 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unsafe.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unsafe.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getParentComponent } from "../../utils/get-parent-component.js";
 import { isEs5Component } from "../../utils/is-es5-component.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const UNSAFE_PREFIXED = new Set([
   "UNSAFE_componentWillMount",
@@ -74,7 +73,7 @@ const getStaticKeyName = (key: EsTreeNode): string | null => {
 // aliases when `checkAliases: true`. Does NOT gate on React version
 // (OXC's port does — we always assume modern React, where the prefixes
 // are valid).
-export const noUnsafe = defineRule<Rule>({
+export const noUnsafe = defineRule({
   id: "no-unsafe",
   title: "Unsafe legacy lifecycle method",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unstable-nested-components.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unstable-nested-components.ts
index d9b5ce846..11d70991e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unstable-nested-components.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-unstable-nested-components.ts
@@ -7,7 +7,6 @@ import { isCreateElementCall } from "../../utils/is-create-element-call.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactComponentName } from "../../utils/is-react-component-name.js";
-import type { Rule } from "../../utils/rule.js";
 
 const buildMessage = (parentName: string | null): string => {
   let message =
@@ -326,7 +325,7 @@ const isReturnOfMapCallback = (node: EsTreeNode): boolean => {
 };
 
 // Port of `oxc_linter::rules::react::no_unstable_nested_components`.
-export const noUnstableNestedComponents = defineRule<Rule>({
+export const noUnstableNestedComponents = defineRule({
   id: "no-unstable-nested-components",
   title: "Component defined inside a component",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-will-update-set-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-will-update-set-state.ts
index 39fb3c1b9..ba6ca57cb 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-will-update-set-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/no-will-update-set-state.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isSetStateCallInLifecycle } from "../../utils/is-set-state-in-lifecycle.js";
-import type { Rule } from "../../utils/rule.js";
 
 const LIFECYCLE_NAMES = new Set(["componentWillUpdate", "UNSAFE_componentWillUpdate"]);
 const MESSAGE =
@@ -44,7 +43,7 @@ const isReactBelow16_3 = (settings: Readonly<Record<string, unknown>> | undefine
 // Port of `oxc_linter::rules::react::no_will_update_set_state`. Flags
 // `this.setState(...)` inside `componentWillUpdate` (or its
 // `UNSAFE_componentWillUpdate` form), where it would loop indefinitely.
-export const noWillUpdateSetState = defineRule<Rule>({
+export const noWillUpdateSetState = defineRule({
   id: "no-will-update-set-state",
   title: "setState in componentWillUpdate",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/only-export-components.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/only-export-components.ts
index a9430e57d..cd99dbea0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/only-export-components.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/only-export-components.ts
@@ -5,7 +5,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isAstNode } from "../../utils/is-ast-node.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactComponentName } from "../../utils/is-react-component-name.js";
-import type { Rule } from "../../utils/rule.js";
 import {
   ENTRY_POINT_BASENAMES,
   NON_FAST_REFRESH_PATH_SEGMENTS,
@@ -406,7 +405,7 @@ const isFileNameAllowed = (filename: string | undefined, checkJS: boolean): bool
 // when `checkJS` is on) — pure `.ts` files don't participate in HMR
 // and can't break it. `allowConstantExport: true` by default because
 // stable constants alongside components don't break Fast Refresh.
-export const onlyExportComponents = defineRule<Rule>({
+export const onlyExportComponents = defineRule({
   id: "only-export-components",
   title: "Non-component export in component file",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/prefer-es6-class.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/prefer-es6-class.ts
index cf585d88c..b06131ec0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/prefer-es6-class.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/prefer-es6-class.ts
@@ -3,7 +3,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isEs5Component } from "../../utils/is-es5-component.js";
 import { isEs6Component } from "../../utils/is-es6-component.js";
-import type { Rule } from "../../utils/rule.js";
 
 const ALWAYS_MESSAGE =
   "`createReactClass` is legacy and adds a dependency, so this component diverges from modern React class syntax.";
@@ -25,7 +24,7 @@ const resolveSettings = (
 // Port of `oxc_linter::rules::react::prefer_es6_class`. By default
 // (mode = "always") flags `createReactClass({...})` calls. With
 // mode = "never" flips: flags `class X extends React.Component`.
-export const preferEs6Class = defineRule<Rule>({
+export const preferEs6Class = defineRule({
   id: "prefer-es6-class",
   title: "createClass instead of ES6 class",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/prefer-function-component.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/prefer-function-component.ts
index 3cbd16a98..1fc6878ac 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/prefer-function-component.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/prefer-function-component.ts
@@ -4,7 +4,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isEs6Component } from "../../utils/is-es6-component.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "This class component keeps behavior in lifecycle methods, so state and effects are harder to follow than in a hook-based function component.";
@@ -60,7 +59,7 @@ const isErrorBoundaryClass = (classNode: EsTreeNode): boolean => {
 //     extend Component) are NOT flagged by default — matching the
 //     conservative behaviour. Enable OXC-parity flagging with
 //     `allowJsxUtilityClass: true`.
-export const preferFunctionComponent = defineRule<Rule>({
+export const preferFunctionComponent = defineRule({
   id: "prefer-function-component",
   title: "Class component instead of function",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/react-in-jsx-scope.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/react-in-jsx-scope.ts
index e3ee2e419..e962b0151 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/react-in-jsx-scope.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/react-in-jsx-scope.ts
@@ -15,7 +15,7 @@ const MESSAGE = "This JSX crashes because `React` isn't in scope.";
 // longer silences JSX in an unrelated function. The common shape
 // (module-level `import React from 'react'`) is still detected
 // because module-scope bindings are visible from every nested site.
-export const reactInJsxScope = defineRule<Rule>({
+export const reactInJsxScope = defineRule({
   id: "react-in-jsx-scope",
   title: "React not in scope for JSX",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/require-render-return.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/require-render-return.ts
index c8b3295cd..d4af3c93e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/require-render-return.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/require-render-return.ts
@@ -5,7 +5,6 @@ import { functionBodyHasReturnWithValue } from "../../utils/function-body-has-re
 import { isEs5Component } from "../../utils/is-es5-component.js";
 import { isEs6Component } from "../../utils/is-es6-component.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const RENDER_METHOD_NAME = "render";
 const MESSAGE = "Your users see nothing because this `render` method returns nothing.";
@@ -72,7 +71,7 @@ const isInsideEs6Component = (renderHost: EsTreeNode): boolean => {
 // `return X` statement (with a non-undefined argument). Without a CFG we
 // approximate by walking the body and skipping nested function scopes —
 // good enough for every OXC test fixture.
-export const requireRenderReturn = defineRule<Rule>({
+export const requireRenderReturn = defineRule({
   id: "require-render-return",
   title: "Render method does not return",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/rules-of-hooks.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/rules-of-hooks.ts
index d88249e48..3d2dc943d 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/rules-of-hooks.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/rules-of-hooks.ts
@@ -623,7 +623,7 @@ const isUseEffectEventInitializer = (node: EsTreeNodeOfType<"CallExpression">):
 // actually React hooks — flagging them as Rules-of-Hooks violations is
 // unactionable noise. Real misuse will surface at runtime inside the
 // test/story.
-export const rulesOfHooks = defineRule<Rule>({
+export const rulesOfHooks = defineRule({
   id: "rules-of-hooks",
   title: "Hook called conditionally",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/self-closing-comp.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/self-closing-comp.ts
index 8ab6b4306..32f7fa9ce 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/self-closing-comp.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/self-closing-comp.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE = "This tag has no children, so the closing tag adds noise without changing output.";
 
@@ -35,7 +34,7 @@ const isLowercaseIdentifier = (name: EsTreeNode): boolean => {
 // `<X></X>` and `<X> </X>` (multi-line whitespace) where `<X />` would
 // suffice. Settings let callers disable for HTML tags or for custom
 // components independently.
-export const selfClosingComp = defineRule<Rule>({
+export const selfClosingComp = defineRule({
   id: "self-closing-comp",
   title: "Element not self-closing",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/state-in-constructor.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/state-in-constructor.ts
index a9f4dcc86..a17ce58d8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/state-in-constructor.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/state-in-constructor.ts
@@ -3,7 +3,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isEs6Component } from "../../utils/is-es6-component.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const ALWAYS_MESSAGE =
   "This class uses a state field instead of the configured constructor pattern, so state setup is inconsistent across the codebase.";
@@ -68,7 +67,7 @@ const isInConstructor = (node: EsTreeNode): boolean => {
 //     class component (state should be set in `constructor`).
 //   - "never": flags `this.state = {…}` inside a constructor of a
 //     React class component (state should be a class field instead).
-export const stateInConstructor = defineRule<Rule>({
+export const stateInConstructor = defineRule({
   id: "state-in-constructor",
   title: "State initialized in constructor",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/style-prop-object.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/style-prop-object.ts
index 20fba3894..977e2c03e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/style-prop-object.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/style-prop-object.ts
@@ -5,7 +5,6 @@ import { findVariableInitializer } from "../../utils/find-variable-initializer.j
 import { isCreateElementCall } from "../../utils/is-create-element-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 
 const MESSAGE =
   "Your styles don't render because you passed the `style` prop a string instead of an object.";
@@ -136,7 +135,7 @@ const getJsxOpeningElementName = (node: EsTreeNodeOfType<"JSXOpeningElement">):
 // `style={true}` / `style={42}` / `style={"x"}` etc. Also flags
 // `React.createElement("div", { style: "..." })`. The `allow` setting
 // list lets specific component names skip the check.
-export const stylePropObject = defineRule<Rule>({
+export const stylePropObject = defineRule({
   id: "style-prop-object",
   title: "Style prop is not an object",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/void-dom-elements-no-children.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/void-dom-elements-no-children.ts
index d3612346a..fbd5b3305 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/void-dom-elements-no-children.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-builtins/void-dom-elements-no-children.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isCreateElementCall } from "../../utils/is-create-element-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 const VOID_DOM_ELEMENTS = new Set([
   "area",
@@ -42,7 +41,7 @@ const findChildrenLikePropName = (
 // Port of `oxc_linter::rules::react::void_dom_elements_no_children`.
 // Reports `<img>Children</img>`, `<br children="…" />`, void elements
 // passing dangerouslySetInnerHTML, and the `React.createElement` analogues.
-export const voidDomElementsNoChildren = defineRule<Rule>({
+export const voidDomElementsNoChildren = defineRule({
   id: "void-dom-elements-no-children",
   title: "Children on a void element",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/expo-no-non-inlined-env.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/expo-no-non-inlined-env.ts
index 3aac63355..e91730896 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/expo-no-non-inlined-env.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/expo-no-non-inlined-env.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
@@ -47,7 +46,7 @@ const isProcessEnv = (node: EsTreeNode | null | undefined): boolean =>
 // (`const { NAME } = process.env`) defeat that static match, so the value
 // ends up `undefined` in the bundled app. Ports eslint-config-expo's
 // `no-dynamic-env-var` + `no-env-var-destructuring` (both errors there).
-export const expoNoNonInlinedEnv = defineRule<Rule>({
+export const expoNoNonInlinedEnv = defineRule({
   id: "expo-no-non-inlined-env",
   title: "Non-inlinable process.env access (Expo)",
   requires: ["expo"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-animation-reaction-as-derived.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-animation-reaction-as-derived.ts
index 812fce49d..6a83f1702 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-animation-reaction-as-derived.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-animation-reaction-as-derived.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -11,7 +10,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // proper Reanimated dependency tracking, and avoids the side-effect
 // gloss that useAnimatedReaction implies (it's meant for cross-thread
 // reactions like calling runOnJS, not value derivation).
-export const rnAnimationReactionAsDerived = defineRule<Rule>({
+export const rnAnimationReactionAsDerived = defineRule({
   id: "rn-animation-reaction-as-derived",
   title: "useAnimatedReaction just copies a value",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-bottom-sheet-prefer-native.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-bottom-sheet-prefer-native.ts
index 65005478e..918f9adef 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-bottom-sheet-prefer-native.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-bottom-sheet-prefer-native.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
@@ -13,7 +12,7 @@ const JS_BOTTOM_SHEET_PACKAGES = new Set([
   "@discord/bottom-sheet",
 ]);
 
-export const rnBottomSheetPreferNative = defineRule<Rule>({
+export const rnBottomSheetPreferNative = defineRule({
   id: "rn-bottom-sheet-prefer-native",
   title: "JS bottom sheet misses native sheet behavior",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-detox-missing-await.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-detox-missing-await.ts
index 34d4327f8..60f4123d6 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-detox-missing-await.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-detox-missing-await.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
@@ -96,7 +95,7 @@ const getTerminalMethodName = (
 // `element(...)` passed as a multiline ARGUMENT to another call are all
 // naturally excluded — the corpus showed those argument lines are the main
 // false-positive trap for a text-based detector.
-export const rnDetoxMissingAwait = defineRule<Rule>({
+export const rnDetoxMissingAwait = defineRule({
   id: "rn-detox-missing-await",
   title: "Un-awaited Detox action",
   requires: ["react-native"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-callback-per-row.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-callback-per-row.ts
index 5d02f93d7..e9d930d88 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-callback-per-row.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-callback-per-row.ts
@@ -2,7 +2,6 @@ import { RENDER_ITEM_PROP_NAMES } from "../../constants/react-native.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 
@@ -58,7 +57,7 @@ const isRenderItemFunction = (node: EsTreeNode): boolean => {
 // rerender even when the row data didn't change. Hoist the handler at
 // list scope (`const handlePress = useCallback((id) => ..., [])`) and
 // pass the row's id as a primitive prop.
-export const rnListCallbackPerRow = defineRule<Rule>({
+export const rnListCallbackPerRow = defineRule({
   id: "rn-list-callback-per-row",
   title: "Inline handler in list renderItem",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-data-mapped.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-data-mapped.ts
index 06480a6ec..f3f01c857 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-data-mapped.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-data-mapped.ts
@@ -1,7 +1,6 @@
 import { REACT_NATIVE_LIST_COMPONENTS } from "../../constants/react-native.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -54,7 +53,7 @@ const isFreshArrayExpression = (node: EsTreeNode): string | null => {
 // .flat, .flatMap, [...spread]) allocates a fresh array on every parent
 // render, busting the memo cache for every row. Hoist the transform into
 // a useMemo or do the projection earlier.
-export const rnListDataMapped = defineRule<Rule>({
+export const rnListDataMapped = defineRule({
   id: "rn-list-data-mapped",
   title: "List data rebuilt every render",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-missing-estimated-item-size.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-missing-estimated-item-size.ts
index 2d54339da..abe8ffebd 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-missing-estimated-item-size.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-missing-estimated-item-size.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { getImportedNameFromModule } from "../../utils/find-import-source-for-name.js";
 import { getReactDoctorNumberSetting } from "../../utils/get-react-doctor-setting.js";
 import { FLASH_LIST_V2_MAJOR } from "../../constants/react-native.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -44,7 +43,7 @@ const isEmptyArrayLiteral = (node: EsTreeNodeOfType<"JSXAttribute">): boolean =>
   return isNodeOfType(expression, "ArrayExpression") && (expression.elements?.length ?? 0) === 0;
 };
 
-export const rnListMissingEstimatedItemSize = defineRule<Rule>({
+export const rnListMissingEstimatedItemSize = defineRule({
   id: "rn-list-missing-estimated-item-size",
   title: "List missing estimatedItemSize",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-recyclable-without-types.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-recyclable-without-types.ts
index ecc6468a1..fe2e48b71 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-recyclable-without-types.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-list-recyclable-without-types.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -18,7 +17,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // value) or `recycleItems={true}` counts as enabled.
 const RECYCLABLE_LIST_NAMES = new Set(["FlashList", "LegendList"]);
 
-export const rnListRecyclableWithoutTypes = defineRule<Rule>({
+export const rnListRecyclableWithoutTypes = defineRule({
   id: "rn-list-recyclable-without-types",
   title: "Recyclable list missing getItemType",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-deep-imports.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-deep-imports.ts
index 4becd8b28..75e7db05c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-deep-imports.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-deep-imports.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
@@ -131,7 +130,7 @@ const isEverySpecifierInlineType = (
   );
 };
 
-export const rnNoDeepImports = defineRule<Rule>({
+export const rnNoDeepImports = defineRule({
   id: "rn-no-deep-imports",
   title: "Deep import into react-native internals",
   requires: ["react-native"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-deprecated-modules.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-deprecated-modules.ts
index f8c718c2d..83d8aa5e7 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-deprecated-modules.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-deprecated-modules.ts
@@ -1,12 +1,11 @@
 import { DEPRECATED_RN_MODULE_REPLACEMENTS } from "../../constants/react-native.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { getImportedName } from "../../utils/get-imported-name.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const rnNoDeprecatedModules = defineRule<Rule>({
+export const rnNoDeprecatedModules = defineRule({
   id: "rn-no-deprecated-modules",
   title: "Module removed from react-native core",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-dimensions-get.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-dimensions-get.ts
index 8839ef5bc..d4402a440 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-dimensions-get.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-dimensions-get.ts
@@ -1,11 +1,10 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { isMemberProperty } from "../../utils/is-member-property.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const rnNoDimensionsGet = defineRule<Rule>({
+export const rnNoDimensionsGet = defineRule({
   id: "rn-no-dimensions-get",
   title: "Dimensions.get over useWindowDimensions",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-falsy-and-render.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-falsy-and-render.ts
index 2a50b8ad5..949ae7a80 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-falsy-and-render.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-falsy-and-render.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { hasDirective } from "../../utils/has-directive.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -106,7 +105,7 @@ const isLikelyNumericExpression = (node: EsTreeNode): boolean => {
 // boolean state/props/constants that never produce `0`. We only
 // flag identifiers/expressions with numeric-sounding names or
 // `.length` access.
-export const rnNoFalsyAndRender = defineRule<Rule>({
+export const rnNoFalsyAndRender = defineRule({
   id: "rn-no-falsy-and-render",
   title: "Numeric && renders bare zero",
   requires: ["react-native"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-image-children.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-image-children.ts
index 53dc9eb1c..40e193151 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-image-children.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-image-children.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { getImportedNameFromModule } from "../../utils/find-import-source-for-name.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -37,7 +36,7 @@ const isMeaningfulImageChild = (child: EsTreeNode): boolean => {
 // different component) and any same-named local/custom `Image` never trip
 // the rule — the OSS corpus showed `next/image` and Skia's `<Image>` are
 // the dominant same-name false positives.
-export const rnNoImageChildren = defineRule<Rule>({
+export const rnNoImageChildren = defineRule({
   id: "rn-no-image-children",
   title: "Children inside react-native <Image>",
   requires: ["react-native"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-inline-flatlist-renderitem.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-inline-flatlist-renderitem.ts
index 7c4c0b4f8..9165dbf54 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-inline-flatlist-renderitem.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-inline-flatlist-renderitem.ts
@@ -1,12 +1,11 @@
 import { REACT_NATIVE_LIST_COMPONENTS } from "../../constants/react-native.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const rnNoInlineFlatlistRenderitem = defineRule<Rule>({
+export const rnNoInlineFlatlistRenderitem = defineRule({
   id: "rn-no-inline-flatlist-renderitem",
   title: "Inline renderItem on list",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-inline-object-in-list-item.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-inline-object-in-list-item.ts
index ca1df2039..504190585 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-inline-object-in-list-item.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-inline-object-in-list-item.ts
@@ -1,7 +1,6 @@
 import { RENDER_ITEM_PROP_NAMES } from "../../constants/react-native.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -12,7 +11,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // shallow-compare for that prop and rerenders even when the underlying
 // data didn't change. Hoist the object outside renderItem (StyleSheet,
 // constant, useMemo at list scope) or pass primitives into the row.
-export const rnNoInlineObjectInListItem = defineRule<Rule>({
+export const rnNoInlineObjectInListItem = defineRule({
   id: "rn-no-inline-object-in-list-item",
   title: "Inline object in list renderItem",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-legacy-expo-packages.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-legacy-expo-packages.ts
index e08130192..51091e559 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-legacy-expo-packages.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-legacy-expo-packages.ts
@@ -1,10 +1,9 @@
 import { LEGACY_EXPO_PACKAGE_REPLACEMENTS } from "../../constants/react-native.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const rnNoLegacyExpoPackages = defineRule<Rule>({
+export const rnNoLegacyExpoPackages = defineRule({
   id: "rn-no-legacy-expo-packages",
   title: "Unmaintained legacy Expo package",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-legacy-shadow-styles.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-legacy-shadow-styles.ts
index ecdb3d1e3..908411926 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-legacy-shadow-styles.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-legacy-shadow-styles.ts
@@ -1,7 +1,6 @@
 import { LEGACY_SHADOW_STYLE_PROPERTIES } from "../../constants/react-native.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { isMemberProperty } from "../../utils/is-member-property.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -29,7 +28,7 @@ const reportLegacyShadowProperties = (
   });
 };
 
-export const rnNoLegacyShadowStyles = defineRule<Rule>({
+export const rnNoLegacyShadowStyles = defineRule({
   id: "rn-no-legacy-shadow-styles",
   title: "Legacy platform-specific shadow styles",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-non-native-navigator.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-non-native-navigator.ts
index 77c09f803..78f71a1f5 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-non-native-navigator.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-non-native-navigator.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
@@ -19,7 +18,7 @@ const NON_NATIVE_NAVIGATOR_PACKAGES = new Map<string, string>([
 // imperfect native gesture/feel. native-stack (and native-tabs in v7+)
 // uses platform-native UINavigationController / Fragment, giving real
 // iOS/Android transitions, swipe-back, and large titles for free.
-export const rnNoNonNativeNavigator = defineRule<Rule>({
+export const rnNoNonNativeNavigator = defineRule({
   id: "rn-no-non-native-navigator",
   title: "Non-native JS navigator",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-panresponder.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-panresponder.ts
index f4902b3ce..46ec8f56e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-panresponder.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-panresponder.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { getImportedName } from "../../utils/get-imported-name.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -13,7 +12,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // is busy. We key off the named import from `react-native` (resolving
 // aliases) so a same-named local symbol or a re-export from another
 // package never trips the rule.
-export const rnNoPanresponder = defineRule<Rule>({
+export const rnNoPanresponder = defineRule({
   id: "rn-no-panresponder",
   title: "PanResponder over react-native-gesture-handler",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-raw-text.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-raw-text.ts
index 80c9f5449..51bfd3da4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-raw-text.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-raw-text.ts
@@ -8,7 +8,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { hasDirective } from "../../utils/has-directive.js";
 import { isInsidePlatformOsWebBranch } from "../../utils/is-inside-platform-os-web-branch.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
 import { collectTextWrapperComponents } from "./utils/collect-text-wrapper-components.js";
@@ -91,7 +90,7 @@ const isInsideTextHandlingComponent = (node: EsTreeNodeOfType<"JSXElement">): bo
   return false;
 };
 
-export const rnNoRawText = defineRule<Rule>({
+export const rnNoRawText = defineRule({
   id: "rn-no-raw-text",
   title: "Raw text outside a Text component",
   requires: ["react-native"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-renderitem-key.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-renderitem-key.ts
index 335ca465a..063fa6319 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-renderitem-key.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-renderitem-key.ts
@@ -9,7 +9,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { hasJsxKeyAttribute } from "../../utils/has-jsx-key-attribute.js";
 import { isAstNode } from "../../utils/is-ast-node.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
@@ -75,7 +74,7 @@ const collectReturnedJsxElements = (expression: EsTreeNode): EsTreeNodeOfType<"J
   return elements;
 };
 
-export const rnNoRenderitemKey = defineRule<Rule>({
+export const rnNoRenderitemKey = defineRule({
   id: "rn-no-renderitem-key",
   title: "renderItem key is ignored by React Native lists",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-scroll-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-scroll-state.ts
index 1850f75b1..6c8cc8281 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-scroll-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-scroll-state.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { isUseStateSetterInScope } from "../../utils/is-use-state-setter-in-scope.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -29,7 +28,7 @@ const findSetStateInBody = (body: EsTreeNode): EsTreeNode | null => {
 // at scroll-event frequency (60-120Hz). Use a Reanimated shared value
 // (useSharedValue + useAnimatedScrollHandler) or a ref + raf throttle so
 // the JS thread isn't pegged.
-export const rnNoScrollState = defineRule<Rule>({
+export const rnNoScrollState = defineRule({
   id: "rn-no-scroll-state",
   title: "setState in onScroll handler",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-scrollview-mapped-list.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-scrollview-mapped-list.ts
index 49fb0c602..e6d6714d5 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-scrollview-mapped-list.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-scrollview-mapped-list.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
 import { isExpoUiComponentElement } from "./utils/is-expo-ui-component-element.js";
@@ -34,7 +33,7 @@ const isArrayIterationExpression = (node: EsTreeNode): boolean => {
 // memory — for any list longer than ~10 items this destroys scroll
 // performance on lower-end devices. FlashList / LegendList / FlatList
 // recycle row components and only mount the visible window.
-export const rnNoScrollviewMappedList = defineRule<Rule>({
+export const rnNoScrollviewMappedList = defineRule({
   id: "rn-no-scrollview-mapped-list",
   title: "Non-virtualized mapped list in ScrollView",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-set-native-props.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-set-native-props.ts
index ccdf9cd10..4741e50e9 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-set-native-props.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-set-native-props.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
@@ -21,7 +20,7 @@ const isStaticMemberNamed = (node: EsTreeNode, name: string): boolean =>
 // `*.current(?.)setNativeProps(...)` ref shape so we only flag the React
 // ref escape hatch (host-component refs), not an unrelated object that
 // happens to expose a `setNativeProps` method.
-export const rnNoSetNativeProps = defineRule<Rule>({
+export const rnNoSetNativeProps = defineRule({
   id: "rn-no-set-native-props",
   title: "Imperative setNativeProps (no-op under Fabric)",
   requires: ["react-native"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-single-element-style-array.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-single-element-style-array.ts
index 9464d1bf2..029cb8299 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-single-element-style-array.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-no-single-element-style-array.ts
@@ -1,10 +1,9 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const rnNoSingleElementStyleArray = defineRule<Rule>({
+export const rnNoSingleElementStyleArray = defineRule({
   id: "rn-no-single-element-style-array",
   title: "Single-element style array adds wasted allocation",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-expo-image.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-expo-image.ts
index 0d3117c6b..1cc2afa23 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-expo-image.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-expo-image.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { RuleVisitors } from "../../utils/rule-visitors.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -14,7 +13,7 @@ const EMPTY_VISITORS: RuleVisitors = {};
 // replacement (same prop API plus more) with disk + memory caching, blur
 // placeholders, and crossfades — a major perceived-perf win for any list
 // or hero image.
-export const rnPreferExpoImage = defineRule<Rule>({
+export const rnPreferExpoImage = defineRule({
   id: "rn-prefer-expo-image",
   title: "react-native Image instead of expo-image",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-pressable-over-gesture-detector.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-pressable-over-gesture-detector.ts
index 4956dfe8e..72174ee77 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-pressable-over-gesture-detector.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-pressable-over-gesture-detector.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { findVariableInitializer } from "../../utils/find-variable-initializer.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
 import { isImportedFromModule } from "../../utils/find-import-source-for-name.js";
@@ -98,7 +97,7 @@ const isTapChainEligibleForPressable = (chain: GestureChainInfo): boolean => {
   return true;
 };
 
-export const rnPreferPressableOverGestureDetector = defineRule<Rule>({
+export const rnPreferPressableOverGestureDetector = defineRule({
   id: "rn-prefer-pressable-over-gesture-detector",
   title: "GestureDetector for a plain tap",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-pressable.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-pressable.ts
index 17e59bea0..22eb36f0d 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-pressable.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-pressable.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { getImportedName } from "../../utils/get-imported-name.js";
@@ -18,7 +17,7 @@ const TOUCHABLE_SOURCES = new Set(["react-native", "react-native-gesture-handler
 // TouchableNativeFeedback are legacy and feature-frozen. Pressable is the
 // modern, more configurable, more accessible replacement that works the
 // same on iOS, Android, and Fabric.
-export const rnPreferPressable = defineRule<Rule>({
+export const rnPreferPressable = defineRule({
   id: "rn-prefer-pressable",
   title: "Touchable components instead of Pressable",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-reanimated.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-reanimated.ts
index 4b46ec8d6..eb0e74530 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-reanimated.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-prefer-reanimated.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { getImportedName } from "../../utils/get-imported-name.js";
@@ -7,7 +6,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
 const JS_THREAD_ANIMATION_IMPORTS = new Set(["Animated", "LayoutAnimation"]);
 
-export const rnPreferReanimated = defineRule<Rule>({
+export const rnPreferReanimated = defineRule({
   id: "rn-prefer-reanimated",
   title: "JS-thread animation instead of Reanimated",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-pressable-shared-value-mutation.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-pressable-shared-value-mutation.ts
index 5f0d53c23..3cfd3edef 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-pressable-shared-value-mutation.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-pressable-shared-value-mutation.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -62,7 +61,7 @@ const handlerMutatesIdentifier = (
 // on the UI thread for native-feeling press feedback. We only flag when
 // the receiver is actually a `useSharedValue` binding to avoid
 // false-positives on `Map.prototype.set` / `ref.current.value =` etc.
-export const rnPressableSharedValueMutation = defineRule<Rule>({
+export const rnPressableSharedValueMutation = defineRule({
   id: "rn-pressable-shared-value-mutation",
   title: "Pressable animates on the JS thread",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-scrollview-dynamic-padding.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-scrollview-dynamic-padding.ts
index 710510dc9..3cbab91e2 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-scrollview-dynamic-padding.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-scrollview-dynamic-padding.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
 import { SCROLLVIEW_NAMES } from "./utils/scrollview_names.js";
@@ -12,7 +11,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // any sticky headers re-pin. The native equivalent is `contentInset`,
 // which the platform applies as an OS-level offset without re-laying out
 // the content.
-export const rnScrollviewDynamicPadding = defineRule<Rule>({
+export const rnScrollviewDynamicPadding = defineRule({
   id: "rn-scrollview-dynamic-padding",
   title: "Dynamic padding on contentContainerStyle",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-scrollview-flex-in-content-container.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-scrollview-flex-in-content-container.ts
index 4ffc35d51..2f228b87e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-scrollview-flex-in-content-container.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-scrollview-flex-in-content-container.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { findVariableInitializer } from "../../utils/find-variable-initializer.js";
 import { getRootIdentifierName } from "../../utils/get-root-identifier-name.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { resolveJsxElementName } from "./utils/resolve-jsx-element-name.js";
 import { SCROLLVIEW_NAMES } from "./utils/scrollview_names.js";
@@ -136,7 +135,7 @@ const findFlexShorthandProperty = (
   return null;
 };
 
-export const rnScrollviewFlexInContentContainer = defineRule<Rule>({
+export const rnScrollviewFlexInContentContainer = defineRule({
   id: "rn-scrollview-flex-in-content-container",
   title: "flex on contentContainerStyle collapses container",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-style-prefer-box-shadow.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-style-prefer-box-shadow.ts
index 6cdb753e1..1402f5ddd 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-style-prefer-box-shadow.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-native/rn-style-prefer-box-shadow.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -32,7 +31,7 @@ const findLegacyShadowProperty = (
 // `shadowRadius` keys only work on iOS, and `elevation` is Android-only,
 // so cross-platform code historically had to declare both — `boxShadow`
 // collapses that into one key.
-export const rnStylePreferBoxShadow = defineRule<Rule>({
+export const rnStylePreferBoxShadow = defineRule({
   id: "rn-style-prefer-boxshadow",
   title: "Platform-specific shadow keys over boxShadow",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-em-dash-in-jsx-text.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-em-dash-in-jsx-text.ts
index 6515e815f..0f2e49de0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-em-dash-in-jsx-text.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-em-dash-in-jsx-text.ts
@@ -1,12 +1,11 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isInsideExcludedTypographyAncestor } from "./utils/is-inside-excluded-typography-ancestor.js";
 
 const EM_DASH = "—";
 
-export const noEmDashInJsxText = defineRule<Rule>({
+export const noEmDashInJsxText = defineRule({
   id: "design-no-em-dash-in-jsx-text",
   title: "Em dash in JSX text",
   tags: ["design", "test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-redundant-padding-axes.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-redundant-padding-axes.ts
index 5eddc690c..c7054323c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-redundant-padding-axes.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-redundant-padding-axes.ts
@@ -3,7 +3,6 @@ import {
   PADDING_VERTICAL_AXIS_PATTERN,
 } from "../../constants/design.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getClassNameLiteral } from "./utils/get-class-name-literal.js";
 import { collectAxisShorthandPairs } from "./utils/collect-axis-shorthand-pairs.js";
@@ -11,7 +10,7 @@ import { hasResponsivePrefix } from "./utils/has-responsive-prefix.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noRedundantPaddingAxes = defineRule<Rule>({
+export const noRedundantPaddingAxes = defineRule({
   id: "design-no-redundant-padding-axes",
   title: "Redundant padding axes",
   tags: ["design", "test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-redundant-size-axes.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-redundant-size-axes.ts
index 6fb364065..0b089a090 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-redundant-size-axes.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-redundant-size-axes.ts
@@ -1,6 +1,5 @@
 import { SIZE_HEIGHT_AXIS_PATTERN, SIZE_WIDTH_AXIS_PATTERN } from "../../constants/design.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getClassNameLiteral } from "./utils/get-class-name-literal.js";
 import { collectAxisShorthandPairs } from "./utils/collect-axis-shorthand-pairs.js";
@@ -8,7 +7,7 @@ import { hasResponsivePrefix } from "./utils/has-responsive-prefix.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noRedundantSizeAxes = defineRule<Rule>({
+export const noRedundantSizeAxes = defineRule({
   id: "design-no-redundant-size-axes",
   title: "Redundant width and height axes",
   requires: ["tailwind:3.4"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-space-on-flex-children.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-space-on-flex-children.ts
index 519799483..02f5225b4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-space-on-flex-children.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-space-on-flex-children.ts
@@ -1,6 +1,5 @@
 import { FLEX_OR_GRID_DISPLAY_TOKENS, SPACE_AXIS_PATTERN } from "../../constants/design.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getClassNameLiteral } from "./utils/get-class-name-literal.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -9,7 +8,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 const tokenizeClassName = (classNameValue: string): string[] =>
   classNameValue.split(/\s+/).filter(Boolean);
 
-export const noSpaceOnFlexChildren = defineRule<Rule>({
+export const noSpaceOnFlexChildren = defineRule({
   id: "design-no-space-on-flex-children",
   title: "space-* utility on flex children",
   tags: ["design", "test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-three-period-ellipsis.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-three-period-ellipsis.ts
index 82e17fa04..2f49ebb1c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-three-period-ellipsis.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-three-period-ellipsis.ts
@@ -1,11 +1,10 @@
 import { TRAILING_THREE_PERIOD_ELLIPSIS_PATTERN } from "../../constants/design.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isInsideExcludedTypographyAncestor } from "./utils/is-inside-excluded-typography-ancestor.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noThreePeriodEllipsis = defineRule<Rule>({
+export const noThreePeriodEllipsis = defineRule({
   id: "design-no-three-period-ellipsis",
   title: "Three dots instead of ellipsis",
   tags: ["design", "test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-vague-button-label.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-vague-button-label.ts
index 41cf077cc..2d78d3417 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-vague-button-label.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/react-ui/no-vague-button-label.ts
@@ -2,7 +2,6 @@ import { VAGUE_BUTTON_LABELS } from "../../constants/design.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import { getStaticTemplateLiteralValue } from "../../utils/get-static-template-literal-value.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getOpeningElementTagName } from "./utils/get-opening-element-tag-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -56,7 +55,7 @@ const collectJsxLabelText = (jsxElementNode: EsTreeNode): string | null => {
   return collectedFragments.join("").trim();
 };
 
-export const noVagueButtonLabel = defineRule<Rule>({
+export const noVagueButtonLabel = defineRule({
   id: "design-no-vague-button-label",
   title: "Vague button label",
   tags: ["design", "test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/active-static-asset.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/active-static-asset.regressions.test.ts
new file mode 100644
index 000000000..42d1eca3b
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/active-static-asset.regressions.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { activeStaticAsset } from "./active-static-asset.js";
+
+describe("security-scan/active-static-asset — regressions", () => {
+  it("escalates an active SVG in public assets via per-finding severity/title overrides", () => {
+    const findings = runScanRule(activeStaticAsset, {
+      relativePath: "public/logo.svg",
+      content: `<svg xmlns="http://www.w3.org/2000/svg">\n  <script>alert(1)</script>\n</svg>\n`,
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.message).toBe(
+      "A browser-reachable SVG contains script or event-handler code.",
+    );
+    expect(findings[0]?.severity).toBe("error");
+    expect(findings[0]?.title).toBe("Active SVG in public assets");
+    expect(findings[0]?.help).toBe(
+      "Serve untrusted SVG as downloads, sanitize it, or isolate it on a cookieless asset origin with a restrictive CSP.",
+    );
+    expect(findings[0]?.line).toBe(2);
+    expect(findings[0]?.column).toBe(3);
+  });
+
+  it("stays silent on an inert SVG in public assets", () => {
+    const findings = runScanRule(activeStaticAsset, {
+      relativePath: "public/logo.svg",
+      content: `<svg xmlns="http://www.w3.org/2000/svg"><circle r="4" /></svg>\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags dangerouslyAllowSVG in config at the rule's default metadata (no overrides)", () => {
+    const findings = runScanRule(activeStaticAsset, {
+      relativePath: "next.config.ts",
+      content: `const config = { images: { dangerouslyAllowSVG: true } };\nexport default config;\n`,
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.message).toBe(
+      "The app enables or embeds SVG in an executable browser context.",
+    );
+    // Inherits the rule's "warn" / "Executable SVG exposure" metadata.
+    expect(findings[0]?.severity).toBeUndefined();
+    expect(findings[0]?.title).toBeUndefined();
+    expect(activeStaticAsset.severity).toBe("warn");
+    expect(activeStaticAsset.title).toBe("Executable SVG exposure");
+  });
+
+  it("flags an executable SVG embed in production source", () => {
+    const findings = runScanRule(activeStaticAsset, {
+      relativePath: "src/components/diagram.tsx",
+      content: `export const Diagram = () => <object data="/uploads/diagram.svg" type="image/svg+xml" />;\n`,
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.severity).toBeUndefined();
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/active-static-asset.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/active-static-asset.ts
new file mode 100644
index 000000000..73c9571bb
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/active-static-asset.ts
@@ -0,0 +1,62 @@
+import { defineRule } from "../../utils/define-rule.js";
+import type { ScanFinding } from "../../utils/file-scan.js";
+import { getMatchLocation } from "./utils/get-match-location.js";
+import { isBrowserArtifactPath } from "./utils/is-browser-artifact-path.js";
+import { isConfigOrCiPath } from "./utils/is-config-or-ci-path.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+
+const SVG_ACTIVE_PATTERN = /<script\b|on(?:load|error|click|mouseover)\s*=/i;
+
+const DANGEROUS_ALLOW_SVG_PATTERN = /dangerouslyAllowSVG\s*:\s*true/i;
+
+const EXECUTABLE_SVG_EMBED_PATTERN =
+  /<(?:object|embed|iframe)\b[^>]+(?:data|src)=["'][^"']+\.svg(?:\?[^"']*)?["']/i;
+
+export const activeStaticAsset = defineRule({
+  id: "active-static-asset",
+  title: "Executable SVG exposure",
+  severity: "warn",
+  recommendation:
+    "Prefer `<img>` for SVG images; if SVG must be served directly, use attachment disposition and a CSP that blocks scripts and objects.",
+  scan: (file) => {
+    const findings: ScanFinding[] = [];
+
+    if (
+      file.relativePath.endsWith(".svg") &&
+      isBrowserArtifactPath(file.relativePath, file.isGeneratedBundle)
+    ) {
+      if (SVG_ACTIVE_PATTERN.test(file.content)) {
+        const location = getMatchLocation(file.content, SVG_ACTIVE_PATTERN);
+        // The active-SVG variant escalates past the rule's default metadata;
+        // splitting it into its own rule id is a tracked follow-up.
+        findings.push({
+          message: "A browser-reachable SVG contains script or event-handler code.",
+          line: location.line,
+          column: location.column,
+          severity: "error",
+          title: "Active SVG in public assets",
+          help: "Serve untrusted SVG as downloads, sanitize it, or isolate it on a cookieless asset origin with a restrictive CSP.",
+        });
+      }
+      return findings;
+    }
+
+    if (!isProductionSourcePath(file.relativePath) && !isConfigOrCiPath(file.relativePath)) {
+      return findings;
+    }
+
+    const pattern = [DANGEROUS_ALLOW_SVG_PATTERN, EXECUTABLE_SVG_EMBED_PATTERN].find((candidate) =>
+      candidate.test(file.content),
+    );
+    if (pattern !== undefined) {
+      const location = getMatchLocation(file.content, pattern);
+      findings.push({
+        message: "The app enables or embeds SVG in an executable browser context.",
+        line: location.line,
+        column: location.column,
+      });
+    }
+
+    return findings;
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/agent-tool-capability-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/agent-tool-capability-risk.ts
new file mode 100644
index 000000000..0fbb18d09
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/agent-tool-capability-risk.ts
@@ -0,0 +1,27 @@
+import { AGENT_TOOL_DANGEROUS_CAPABILITY_PATTERN } from "../../constants/security-scan.js";
+import { defineRule } from "../../utils/define-rule.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+const AGENT_TOOL_DEFINITION_PATTERN =
+  /\b(?:tool\s*\(\s*\{|createTool\s*\(|defineTool\s*\(|new\s+(?:DynamicTool|StructuredTool)\s*\()/;
+
+const AGENT_TOOL_CONTEXT_PATH_PATTERN =
+  /(?:^|\/)(?:agents?|tools?|mcp)(?:\/|$)|(?:agent|tool|mcp)[^/]*\.[cm]?[jt]sx?$/i;
+
+export const agentToolCapabilityRisk = defineRule({
+  id: "agent-tool-capability-risk",
+  title: "Agent tool exposes dangerous capability",
+  severity: "warn",
+  recommendation:
+    "Treat tool inputs as prompt-injection controlled. Validate arguments, scope permissions per call, and avoid exposing shell/file/network primitives directly to agents.",
+  scan: scanByPattern({
+    shouldScan: (file) =>
+      isProductionSourcePath(file.relativePath) &&
+      AGENT_TOOL_CONTEXT_PATH_PATTERN.test(file.relativePath),
+    pattern: AGENT_TOOL_DEFINITION_PATTERN,
+    requireAll: [AGENT_TOOL_DANGEROUS_CAPABILITY_PATTERN],
+    message:
+      "An agent-callable tool appears to expose network, filesystem, shell, or code-execution capability.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-baas-authority-surface.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-baas-authority-surface.ts
new file mode 100644
index 000000000..99f1b1770
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-baas-authority-surface.ts
@@ -0,0 +1,26 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isBrowserArtifactPath } from "./utils/is-browser-artifact-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+const BAAS_CLIENT_CONFIG_PATTERN =
+  /\b(?:initializeApp|firebase|firestore|getFirestore|createClient)\b[\s\S]{0,700}\b(?:apiKey|authDomain|projectId|databaseURL|storageBucket|supabase|SUPABASE_URL)\b|\b(?:apiKey|authDomain|projectId|databaseURL|storageBucket)\b[\s\S]{0,700}\b(?:firebase|firestore|getFirestore|initializeApp)\b/i;
+
+// TODO(follow-up): de-overfit — the `boosts` / `candidateJobs` / `ghostOrg`
+// collection literals mirror specific regression fixtures.
+const BAAS_AUTHORITY_SURFACE_PATTERN =
+  /\b(?:collection\s*\(\s*["'](?:boosts|sessions|sessions_admin|users|orgs|candidateJobs|conversations|documents|profiles)|from\s*\(\s*["'](?:users|profiles|documents|organizations|memberships)|creatorID|creatorId|providerId|ghostOrg|ownerId|orgId|tenantId|workspaceId|role|roles|isAdmin|SuperAdmin)\b/i;
+
+export const artifactBaasAuthoritySurface = defineRule({
+  id: "artifact-baas-authority-surface",
+  title: "BaaS authority map shipped in browser artifact",
+  severity: "warn",
+  recommendation:
+    "Client BaaS config is often public, but shipped collection names plus owner, role, tenant, or admin fields give attackers a precise authorization map. Verify rules/RLS enforce every boundary server-side.",
+  scan: scanByPattern({
+    shouldScan: (file) => isBrowserArtifactPath(file.relativePath, file.isGeneratedBundle),
+    pattern: BAAS_AUTHORITY_SURFACE_PATTERN,
+    requireAll: [BAAS_CLIENT_CONFIG_PATTERN],
+    message:
+      "A browser artifact exposes Firebase/Supabase config together with sensitive collections or authorization fields.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-env-leak.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-env-leak.regressions.test.ts
new file mode 100644
index 000000000..fc68e7f0f
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-env-leak.regressions.test.ts
@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { artifactEnvLeak } from "./artifact-env-leak.js";
+
+describe("security-scan/artifact-env-leak — regressions", () => {
+  it("flags secret env names inside a browser artifact", () => {
+    const findings = runScanRule(artifactEnvLeak, {
+      relativePath: "dist/assets/index-abc123.js",
+      content: `const config = { key: "NEXT_PUBLIC_SERVICE_ROLE_SECRET" };`,
+      isGeneratedBundle: true,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on generated API-reference markdown (medusa TypeList shape)", () => {
+    const findings = runScanRule(artifactEnvLeak, {
+      relativePath: "www/apps/resources/references/types/CommonTypes/page.mdx",
+      content: `<TypeList types={[{"name":"NEXT_PUBLIC_SERVICE_ROLE_SECRET","type":"string","description":"..."}]} />`,
+      isGeneratedBundle: true,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-env-leak.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-env-leak.ts
new file mode 100644
index 000000000..34b05b95d
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-env-leak.ts
@@ -0,0 +1,21 @@
+import { FULL_ENV_LEAK_SECRET_NAME_PATTERN } from "../../constants/security.js";
+import { defineRule } from "../../utils/define-rule.js";
+import { findSuspiciousPublicEnvSecretNamePattern } from "./utils/find-suspicious-public-env-secret-name.js";
+import { hasFullEnvLeakShape } from "./utils/has-full-env-leak-shape.js";
+import { scanArtifactLeak } from "./utils/scan-artifact-leak.js";
+
+export const artifactEnvLeak = defineRule({
+  id: "artifact-env-leak",
+  title: "Server env leaked to browser artifact",
+  severity: "error",
+  recommendation:
+    "Treat public env prefixes as publication, not secrecy; keep secret env vars server-only and rebuild after rotating leaked keys.",
+  scan: (file) =>
+    scanArtifactLeak(
+      file,
+      (content) =>
+        findSuspiciousPublicEnvSecretNamePattern(content) ??
+        (hasFullEnvLeakShape(content) ? FULL_ENV_LEAK_SECRET_NAME_PATTERN : undefined),
+      "A browser artifact contains server-secret environment names or a full environment dump shape.",
+    ),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-secret-leak.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-secret-leak.ts
new file mode 100644
index 000000000..007f55e2b
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/artifact-secret-leak.ts
@@ -0,0 +1,17 @@
+import { SECRET_VALUE_PATTERNS } from "../../constants/security.js";
+import { defineRule } from "../../utils/define-rule.js";
+import { scanArtifactLeak } from "./utils/scan-artifact-leak.js";
+
+export const artifactSecretLeak = defineRule({
+  id: "artifact-secret-leak",
+  title: "Secret shipped in browser artifact",
+  severity: "error",
+  recommendation:
+    "Remove the secret from client bundles/static assets, rotate it, and route privileged service calls through server-only code.",
+  scan: (file) =>
+    scanArtifactLeak(
+      file,
+      (content) => SECRET_VALUE_PATTERNS.find((pattern) => pattern.test(content)),
+      "A browser-delivered artifact contains a secret-looking credential value.",
+    ),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/build-pipeline-secret-boundary.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/build-pipeline-secret-boundary.ts
new file mode 100644
index 000000000..9232e629f
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/build-pipeline-secret-boundary.ts
@@ -0,0 +1,23 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isConfigOrCiPath } from "./utils/is-config-or-ci-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+const CI_INSTALL_NEAR_SECRET_PATTERN =
+  /(?:npm|pnpm|yarn|bun)\s+(?:install|ci)\b(?:(?!--ignore-scripts)[\s\S]){0,700}\bsecrets\.[A-Z0-9_]+|\bsecrets\.[A-Z0-9_]+(?:(?!--ignore-scripts)[\s\S]){0,700}(?:npm|pnpm|yarn|bun)\s+(?:install|ci)\b/i;
+
+export const buildPipelineSecretBoundary = defineRule({
+  id: "build-pipeline-secret-boundary",
+  title: "Build pipeline runs code near secrets",
+  severity: "warn",
+  recommendation:
+    "Run dependency installs with scripts disabled before exposing secrets, isolate untrusted build code, and move signing/deploy authority into a narrow privileged step.",
+  scan: scanByPattern({
+    // The CI-install pattern only describes workflow files; package.json
+    // (also a config path) never matches its shape.
+    shouldScan: (file) =>
+      isConfigOrCiPath(file.relativePath) && !file.relativePath.endsWith("package.json"),
+    pattern: CI_INSTALL_NEAR_SECRET_PATTERN,
+    message:
+      "The build or install pipeline can execute package lifecycle code while CI secrets may be present.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/clickjacking-redirect-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/clickjacking-redirect-risk.regressions.test.ts
new file mode 100644
index 000000000..72e23f86d
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/clickjacking-redirect-risk.regressions.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { clickjackingRedirectRisk } from "./clickjacking-redirect-risk.js";
+
+describe("security-scan/clickjacking-redirect-risk — regressions", () => {
+  it("stays silent when redirect keywords only appear inside string literals", () => {
+    const findings = runScanRule(clickjackingRedirectRisk, {
+      relativePath: "app/login/page.tsx",
+      content: `return redirect('/login?message=Check email to continue sign in process');\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent when the redirect target passes through a safe-redirect helper", () => {
+    const findings = runScanRule(clickjackingRedirectRisk, {
+      relativePath: "packages/app-store/zoomvideo/api/callback.ts",
+      content: `res.redirect(\n  getSafeRedirectUrl(state?.returnTo) ?? getInstalledAppPath({ variant: "conferencing" })\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent when iframe-adjacent comments mention redirects", () => {
+    const findings = runScanRule(clickjackingRedirectRisk, {
+      relativePath: "src/scenes/sites/Site.tsx",
+      content: `return (\n  <iframe\n    className="Site"\n    title="Site preview"\n    src={launchUrl(decodedUrl)}\n    // allow-same-origin is important here, because otherwise redirect_to_site cannot work\n    sandbox="allow-scripts allow-same-origin"\n  />\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags redirects fed directly from search params", () => {
+    const findings = runScanRule(clickjackingRedirectRisk, {
+      relativePath: "src/redirect.ts",
+      content: `export const GET = (request) => redirect(request.nextUrl.searchParams.get("next"));\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("flags redirects of a bare next identifier", () => {
+    const findings = runScanRule(clickjackingRedirectRisk, {
+      relativePath: "app/auth/confirm/route.ts",
+      content: `const next = searchParams.get('next') ?? '/';\nredirect(next);\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("flags wildcard frame-ancestors policies", () => {
+    const findings = runScanRule(clickjackingRedirectRisk, {
+      relativePath: "next.config.mjs",
+      content: `const csp = "frame-ancestors *";\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/clickjacking-redirect-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/clickjacking-redirect-risk.ts
new file mode 100644
index 000000000..44e3cf7f6
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/clickjacking-redirect-risk.ts
@@ -0,0 +1,27 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isConfigOrCiPath } from "./utils/is-config-or-ci-path.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+export const clickjackingRedirectRisk = defineRule({
+  id: "clickjacking-redirect-risk",
+  title: "Redirect or frame boundary risk",
+  severity: "warn",
+  recommendation:
+    "Allowlist redirect origins/paths, set `frame-ancestors` for privileged pages, and avoid URL-prefilled privileged dialogs.",
+  // `[^)'"\n]*` keeps redirect keywords inside string literals
+  // (`redirect('/login?message=...continue...')`) from counting — only a bare
+  // identifier/property between `redirect(` and the keyword is caller input.
+  // `(?!\s*(?:await\s+)?[\w$]*(?:safe|valid|sanitiz|allowlist|whitelist)`
+  // skips targets already passed through a safe-redirect helper.
+  // The iframe branch requires URL-param shapes (`redirect=`), not the bare
+  // word `redirect`, which JSX comments inside the tag commonly mention.
+  scan: scanByPattern({
+    shouldScan: (file) =>
+      isProductionSourcePath(file.relativePath) || isConfigOrCiPath(file.relativePath),
+    pattern:
+      /\bredirect\s*\((?!\s*(?:await\s+)?[\w$]*(?:safe|valid|sanitiz|allowlist|whitelist)[\w$]*\s*\()[^)'"`\n]*\b(?:searchParams\.get|nextUrl\.searchParams|returnTo|callbackUrl|continue|next)\b|<iframe\b[\s\S]{0,700}\b(?:next=|continue=|redirect=|redirect_uri|userstoinvite|sharingaction|role=|\.\.)|frame-ancestors\s+(?:\*|'self'\s+\*)|X-Frame-Options["']?\s*:\s*["']?ALLOW/i,
+    message:
+      "Redirect or framing configuration may let attacker-controlled URLs chain into privileged UI or clickjacking.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/command-execution-input-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/command-execution-input-risk.regressions.test.ts
new file mode 100644
index 000000000..2094e0da1
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/command-execution-input-risk.regressions.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { commandExecutionInputRisk } from "./command-execution-input-risk.js";
+
+describe("security-scan/command-execution-input-risk — regressions", () => {
+  it("stays silent on .exec() method calls (tldraw store.query.exec shape)", () => {
+    const findings = runScanRule(commandExecutionInputRisk, {
+      relativePath: "src/lib/store-queries.ts",
+      content: `const currentInStockBooks = store.query.exec("book", { inStock: { eq: true } });\nconst match = pattern.exec(request.body.title);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent in python test files", () => {
+    const findings = runScanRule(commandExecutionInputRisk, {
+      relativePath: "backend/services/test_docker_sandbox.py",
+      content: `result = subprocess.run(["docker", "images", "-q", f"snapshot:{snapshot_id}"], capture_output=True)\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags shell execution of request input", () => {
+    const findings = runScanRule(commandExecutionInputRisk, {
+      relativePath: "src/server/convert.ts",
+      content: `import { exec } from "node:child_process";\n\napp.post("/convert", (req, res) => {\n  exec("convert " + req.body.filename, handleResult);\n});\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent when logging f-strings follow a static subprocess call", () => {
+    const findings = runScanRule(commandExecutionInputRisk, {
+      relativePath: "backend/services/docker_sandbox.py",
+      content: `def _run(args, check=False, timeout=None):\n    result = subprocess.run(args, capture_output=True, text=True, check=check, timeout=timeout)\n    if result.stdout:\n        logger.debug(f"stdout: {result.stdout[:500]}")\n    return result\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("still flags f-string interpolation inside the subprocess call itself", () => {
+    const findings = runScanRule(commandExecutionInputRisk, {
+      relativePath: "backend/report.py",
+      content: `import os\ndef run(request):\n    os.system(f"wkhtmltopdf {request.args['url']} /tmp/report.pdf")\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent in repo tooling fed by argv (sentry bump_version shape)", () => {
+    const findings = runScanRule(commandExecutionInputRisk, {
+      relativePath: "tools/bump_version.py",
+      content: `def main(args):\n    return subprocess.call(("uv", "add", "--dev", f"{args.package}>={args.version}"))\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent in django management commands", () => {
+    const findings = runScanRule(commandExecutionInputRisk, {
+      relativePath: "backend/management/commands/seed_dummy_runs.py",
+      content: `def seed(shell=True):\n    result = subprocess.run(f"createdb {options['name']}", shell=True)\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/command-execution-input-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/command-execution-input-risk.ts
new file mode 100644
index 000000000..4c840c024
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/command-execution-input-risk.ts
@@ -0,0 +1,26 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isDevToolingPath } from "./utils/is-dev-tooling-path.js";
+import { isProductionScriptSourcePath } from "./utils/is-production-script-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+// `(?<![.\w$])` keeps method calls like `regex.exec(...)` / `store.query.exec(...)`
+// from triggering; known process modules are allowed explicitly. `[^)]`
+// keeps the taint window inside the call's own argument list — `[\s\S]`
+// bled into neighboring statements (logging f-strings after the call).
+const COMMAND_EXECUTION_INPUT_RISK_PATTERN =
+  /(?:(?<![.\w$])(?:exec(?:Sync)?|spawn(?:Sync)?|system|passthru|proc_open|shell_exec)|\b(?:os\.system|subprocess\.(?:run|Popen|call)|(?:child_process|childProcess|cp)\.(?:exec|spawn)\w*))\s*\([^)]{0,220}(?:req\.|request\.|params\.|query\.|body\.|searchParams|\$_(?:GET|POST|REQUEST)|shell\s*=\s*true|f['"`][^'"`]*\{)/i;
+
+export const commandExecutionInputRisk = defineRule({
+  id: "command-execution-input-risk",
+  title: "Command execution uses caller-shaped input",
+  severity: "error",
+  recommendation:
+    "Avoid shell execution for caller-controlled values. Use fixed commands, argument arrays, strict allowlists, and no shell interpolation.",
+  scan: scanByPattern({
+    shouldScan: (file) =>
+      isProductionScriptSourcePath(file.relativePath) && !isDevToolingPath(file.relativePath),
+    pattern: COMMAND_EXECUTION_INPUT_RISK_PATTERN,
+    message:
+      "Command execution appears to include request, query, body, or shell-interpolated input.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/cors-cookie-trust-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/cors-cookie-trust-risk.ts
new file mode 100644
index 000000000..69a895f9c
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/cors-cookie-trust-risk.ts
@@ -0,0 +1,20 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isConfigOrCiPath } from "./utils/is-config-or-ci-path.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+export const corsCookieTrustRisk = defineRule({
+  id: "cors-cookie-trust-risk",
+  title: "Broad cookie or credentialed CORS trust",
+  severity: "warn",
+  recommendation:
+    "Keep auth cookies host-only and HttpOnly, avoid credentialed CORS for less-trusted docs/vendor origins, and isolate documentation domains from app sessions.",
+  scan: scanByPattern({
+    shouldScan: (file) =>
+      isProductionSourcePath(file.relativePath) || isConfigOrCiPath(file.relativePath),
+    pattern:
+      /Access-Control-Allow-Credentials["']?\s*[:,]\s*["']?true[\s\S]{0,700}Access-Control-Allow-Origin["']?\s*[:,]\s*["']?(?:\*|https:\/\/docs\.|https:\/\/.*mintlify)|\b(?:session|auth|token|jwt)[^=\n]{0,80}\bDomain=\./i,
+    message:
+      "Credentialed CORS or broad auth-cookie scope can make a docs/custom-domain XSS become account compromise.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/dangerous-html-sink.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/dangerous-html-sink.regressions.test.ts
new file mode 100644
index 000000000..f5fb9b544
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/dangerous-html-sink.regressions.test.ts
@@ -0,0 +1,211 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { dangerousHtmlSink } from "./dangerous-html-sink.js";
+
+describe("security-scan/dangerous-html-sink — regressions", () => {
+  it("stays silent on an empty-string innerHTML clear", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/components/tooltip.ts",
+      content: `const resetTooltip = () => {\n  tooltipElement.innerHTML = "";\n};\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent when the value is sanitized at the sink", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/components/rich-text.tsx",
+      content: `export const RichText = ({ html }: { html: string }) => (\n  <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }} />\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on i18n-sourced HTML", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/components/terms.tsx",
+      content: `export const Terms = () => (\n  <p dangerouslySetInnerHTML={{ __html: t("terms.content_html") }} />\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on a module-constant HTML value", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/components/logo.tsx",
+      content: `export const Logo = () => (\n  <span dangerouslySetInnerHTML={{ __html: LOGO_SVG_MARKUP }} />\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent when only the surrounding window looks dynamic", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/components/divider.tsx",
+      content: `const description = props.text;\nconst Divider = () => (\n  <hr data-content={description} dangerouslySetInnerHTML={{ __html: NBSP_MARKUP }} />\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on DOM-to-DOM serialization (excalidraw svg.outerHTML shape)", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/hooks/use-library-item-svg.ts",
+      content: `if (svg) {\n  node.innerHTML = svg.outerHTML;\n}\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on sanitized-by-convention names (cal.com markdownToSafeHTML shape)", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/components/event-description.tsx",
+      content: `export const EventDescription = ({ description }: Props) => (\n  <div dangerouslySetInnerHTML={{ __html: markdownToSafeHTML(description) }} />\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on deploy-time env config snippets", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/components/gtm.tsx",
+      content: `export const GtmNoscript = () => (\n  <noscript dangerouslySetInnerHTML={{ __html: \`<iframe src="https://www.googletagmanager.com/ns.html?id=\${process.env.NEXT_PUBLIC_GTM_ID}"></iframe>\` }} />\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags unsanitized values even when named unsafeHtml", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/components/raw.tsx",
+      content: `export const Raw = ({ unsafeHtml }: Props) => (\n  <div dangerouslySetInnerHTML={{ __html: unsafeHtml }} />\n);\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("flags HTML injected from props", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/components/preview.tsx",
+      content: `export const Preview = (props: { content: string }) => (\n  <div dangerouslySetInnerHTML={{ __html: props.content }} />\n);\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("flags innerHTML assigned from fetched data", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/widgets/banner.ts",
+      content: `const response = await fetch(bannerUrl);\nconst payload = await response.json();\nbannerElement.innerHTML = payload.data.bannerHtml;\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on innerHTML assigned from an escaping serializer call", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/managers/interaction-manager.ts",
+      content: `const temporaryContainer = document.createElement("div");\ntemporaryContainer.innerHTML = toHtml(createGutterUtilityElement());\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on KaTeX-rendered html identifiers", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/katex/katex-block.tsx",
+      content: `const html = useMemo(() => katex.renderToString(code, { displayMode: true }), [code]);\nreturn <div role="math" dangerouslySetInnerHTML={{ __html: html }} />;\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on style tags injecting generated CSS text", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/render/file-tree-view.tsx",
+      content: `return (\n  <style\n    data-file-tree-guide-style="true"\n    dangerouslySetInnerHTML={{ __html: guideStyleText }}\n  />\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on long static template scripts without interpolation", () => {
+    const themeScriptLines = [
+      "return (",
+      "  <script",
+      "    dangerouslySetInnerHTML={{",
+      "      __html: `",
+      "        try {",
+      "          if (localStorage.theme === 'dark' || window.matchMedia('(prefers-color-scheme: dark)').matches) {",
+      "            document.querySelector('meta[name=theme-color]').setAttribute('content', '#000');",
+      "          }",
+      "        } catch (_) {}",
+      "      `,",
+      "    }}",
+      "  />",
+      ");",
+    ];
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "app/layout.tsx",
+      content: themeScriptLines.join("\n"),
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("still flags script tags interpolating dynamic values", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "app/layout.tsx",
+      content:
+        "return <script dangerouslySetInnerHTML={{ __html: `window.config = ${serializedRequestConfig};` }} />;\n",
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("judges template taint on interpolations, not static script text (payload InitTheme shape)", () => {
+    const themeScriptLines = [
+      "return (",
+      "  <Script",
+      "    dangerouslySetInnerHTML={{",
+      "      __html: `",
+      "        var mediaQuery = '(prefers-color-scheme: dark)'",
+      "        var preference = window.localStorage.getItem('${themeLocalStorageKey}')",
+      "        document.documentElement.setAttribute('data-theme', '${defaultTheme}')",
+      "      `,",
+      "    }}",
+      "  />",
+      ");",
+    ];
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/providers/Theme/InitTheme/index.tsx",
+      content: themeScriptLines.join("\n"),
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags templates whose interpolations carry tainted values", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/widgets/meeting-card.ts",
+      content:
+        'card.innerHTML = `\n  <div class="meeting-title">${meeting.title}</div>\n  ${subtitleHtml}\n`;\n',
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on inert template-element parsing (mastodon hashtag_bar shape)", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/components/hashtag-bar.tsx",
+      content: `const template = document.createElement('template');\ntemplate.innerHTML = statusContent.trim();\nconst lastChild = template.content.lastChild;\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on the detached parse-to-text idiom (mastodon unescapeHTML shape)", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/utils/html.ts",
+      content: `export const unescapeHTML = (html: string) => {\n  const wrapper = document.createElement('div');\n  wrapper.innerHTML = html.replace(/<[^>]*>/g, '');\n  return wrapper.textContent;\n};\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("still flags detached wrappers whose parsed HTML reaches the document", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "src/render/slot-host.ts",
+      content: `const nextContent = document.createElement('div');\nnextContent.innerHTML = props.normalizedHtml;\ndocument.body.appendChild(nextContent);\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on HTML email templates (outline comment-email shape)", () => {
+    const findings = runScanRule(dangerousHtmlSink, {
+      relativePath: "server/emails/templates/CommentCreatedEmail.tsx",
+      content: `export const CommentBody = ({ body }: Props) => (\n  <div dangerouslySetInnerHTML={{ __html: body }} />\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/dangerous-html-sink.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/dangerous-html-sink.ts
new file mode 100644
index 000000000..497254741
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/dangerous-html-sink.ts
@@ -0,0 +1,176 @@
+import { defineRule } from "../../utils/define-rule.js";
+import type { ScanFinding } from "../../utils/file-scan.js";
+import { escapeRegExp } from "./utils/escape-reg-exp.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+
+const DANGEROUS_HTML_PATTERN = /dangerouslySetInnerHTML|\.innerHTML\s*[+]?=(?!=)/;
+
+const HTML_VALUE_START_PATTERN = /(?:__html\s*:|\.innerHTML\s*[+]?=(?!=))\s*([\s\S]*)/;
+
+const HTML_TAINT_PATTERN =
+  /searchParams|query|params|request|req\.|response\.|result\.|data\.|await|fetch|props\.|children|content|html|body|text|message/i;
+
+const STRING_LITERAL_VALUE_PATTERN = /^(?:["'][^"']*["']|`[^`$]*`)\s*(?:[;,})\n]|$)/;
+
+const MODULE_CONSTANT_VALUE_PATTERN = /^[A-Z][A-Z0-9_]*\s*(?:[;,})\n]|$)/;
+
+// `node.innerHTML = element.outerHTML` serializes a live DOM node back into
+// HTML — the value never left the DOM, so it is not an injection boundary.
+const DOM_SERIALIZATION_VALUE_PATTERN = /^[\w$.]+\.outerHTML\s*(?:[;,})\n]|$)/;
+
+// `(?<!un)safe` catches sanitized-by-convention names (markdownToSafeHTML,
+// descriptionAsSafeHtml) without matching `unsafeHtml`.
+const SANITIZER_PATTERN =
+  /\b(?:DOMPurify|sanitize\w*|purify|escape[A-Z]\w*|insane|xss)\b|(?<!un)safe/i;
+
+// Values interpolating only deploy-time config (analytics snippets built
+// from NEXT_PUBLIC_* ids) are developer-controlled, not user input.
+const ENV_CONFIG_VALUE_PATTERN = /process\.env/;
+
+const I18N_VALUE_PATTERN = /\b(?:t|i18n|translate|formatMessage|intl)\s*[.(]/;
+
+// Output of escaping serializers (hast `toHtml`, KaTeX, Shiki, React's
+// renderToStaticMarkup) is markup the library generated, not user HTML.
+const ESCAPING_SERIALIZER_CALL_PATTERN =
+  /^(?:[\w$.]+\.)?(?:toHtml|renderToString|renderToStaticMarkup|codeToHtml|codeToHast)\s*\(/;
+
+const ESCAPING_SERIALIZER_LIBRARY_PATTERN =
+  /\bkatex\b|\bshiki\b|codeToHtml\s*\(|renderToStaticMarkup\s*\(|\bhast-util-to-html\b/i;
+
+const BARE_IDENTIFIER_VALUE_PATTERN = /^[\w$]+\s*(?:[;,})\n]|$)/;
+
+// `<style dangerouslySetInnerHTML={{ __html: ... }}>` injects CSS text, not
+// executable markup — the critical-CSS idiom, and at worst CSS injection.
+const STYLE_TAG_BEFORE_SINK_PATTERN = /<style\b[^<>]*$/;
+
+const STYLE_TAG_LOOKBEHIND_LINES = 5;
+
+// HTML email bodies are rendered by mail clients, which strip script and
+// event handlers — the browser-XSS model this rule encodes does not apply.
+const EMAIL_TEMPLATE_PATH_PATTERN = /(?:^|\/)emails?\/|email[-_.]templates?\//i;
+
+const INNERHTML_TARGET_PATTERN = /(?:^|[^\w$.])([\w$]+(?:\.[\w$]+)*)\.innerHTML\s*[+]?=(?!=)/;
+
+const PARSE_IDIOM_LOOKBEHIND_LINES = 8;
+const PARSE_IDIOM_LOOKAHEAD_LINES = 8;
+
+const VALUE_LOOKAHEAD_LINES = 4;
+const VALUE_EXPRESSION_MAX_CHARS = 300;
+
+// Inline theme-init <script> templates routinely span dozens of lines.
+const STATIC_TEMPLATE_LOOKAHEAD_LINES = 60;
+const STATIC_TEMPLATE_MAX_CHARS = 5000;
+
+// The static text of a template literal cannot be injection; only the
+// `${...}` interpolations carry data. Judging the whole body flags inline
+// theme-init scripts because their static code mentions `query` or `text`.
+// Returns null when the value is not a template that closes in the window.
+const getTemplateInterpolations = (valueTail: string): string | null => {
+  if (!valueTail.startsWith("`")) return null;
+  const closingBacktickIndex = valueTail.indexOf("`", 1);
+  if (closingBacktickIndex < 0 || closingBacktickIndex > STATIC_TEMPLATE_MAX_CHARS) return null;
+  const templateBody = valueTail.slice(1, closingBacktickIndex);
+  const interpolations = templateBody.match(/\$\{[^}]*\}/g);
+  return interpolations === null ? "" : interpolations.join(" ");
+};
+
+// `<template>` element content is inert by spec (never rendered, scripts do
+// not run), and a detached createElement wrapper whose textContent is read
+// straight back is the parse-to-text idiom — neither reaches a live document.
+const isInertParseTarget = (
+  target: string,
+  lines: readonly string[],
+  sinkLineIndex: number,
+  fileContent: string,
+): boolean => {
+  const escapedTarget = escapeRegExp(target);
+  const templateElementPattern = new RegExp(
+    `${escapedTarget}\\s*=\\s*document\\.createElement\\(\\s*["'\`]template["'\`]`,
+  );
+  if (templateElementPattern.test(fileContent)) return true;
+  const createElementPattern = new RegExp(`${escapedTarget}\\s*=\\s*document\\.createElement\\(`);
+  const lookbehindWindow = lines
+    .slice(Math.max(0, sinkLineIndex - PARSE_IDIOM_LOOKBEHIND_LINES), sinkLineIndex + 1)
+    .join("\n");
+  if (!createElementPattern.test(lookbehindWindow)) return false;
+  const textReadPattern = new RegExp(`${escapedTarget}\\.(?:textContent|innerText)\\b`);
+  const lookaheadWindow = lines
+    .slice(sinkLineIndex, sinkLineIndex + 1 + PARSE_IDIOM_LOOKAHEAD_LINES)
+    .join("\n");
+  return textReadPattern.test(lookaheadWindow);
+};
+
+export const dangerousHtmlSink = defineRule({
+  id: "dangerous-html-sink",
+  title: "HTML injection sink with dynamic content",
+  severity: "warn",
+  recommendation:
+    "Prefer rendering structured React nodes. If HTML is required, sanitize with a well-reviewed sanitizer and keep the trust boundary close to the sink.",
+  scan: (file) => {
+    if (!isProductionSourcePath(file.relativePath)) return [];
+    if (EMAIL_TEMPLATE_PATH_PATTERN.test(file.relativePath)) return [];
+    if (!DANGEROUS_HTML_PATTERN.test(file.content)) return [];
+
+    const findings: ScanFinding[] = [];
+    const lines = file.content.split("\n");
+    for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+      const line = lines[lineIndex] ?? "";
+      if (!DANGEROUS_HTML_PATTERN.test(line)) continue;
+
+      // Judge only the value expression handed to the sink — judging the
+      // surrounding window flags any component that mentions text/content/data.
+      const sinkWindow = lines.slice(lineIndex, lineIndex + 1 + VALUE_LOOKAHEAD_LINES).join("\n");
+      const valueMatch = HTML_VALUE_START_PATTERN.exec(sinkWindow);
+      if (valueMatch === null) continue;
+      const fullValueTail = (valueMatch[1] ?? "").trimStart();
+      const valueTail = fullValueTail.slice(0, VALUE_EXPRESSION_MAX_CHARS);
+      // Stop at the statement/prop boundary so code after the sink is not judged.
+      const terminatorIndex = valueTail.search(/[;}]/);
+      const valueExpression =
+        terminatorIndex >= 0 ? valueTail.slice(0, terminatorIndex + 1) : valueTail;
+
+      if (STRING_LITERAL_VALUE_PATTERN.test(valueExpression)) continue;
+      if (MODULE_CONSTANT_VALUE_PATTERN.test(valueExpression)) continue;
+      if (DOM_SERIALIZATION_VALUE_PATTERN.test(valueExpression)) continue;
+
+      const longValueTail = HTML_VALUE_START_PATTERN.exec(
+        lines.slice(lineIndex, lineIndex + 1 + STATIC_TEMPLATE_LOOKAHEAD_LINES).join("\n"),
+      )?.[1]?.trimStart();
+      const templateInterpolations = getTemplateInterpolations(longValueTail ?? fullValueTail);
+      if (templateInterpolations === "") continue;
+      const judgedExpression = templateInterpolations ?? valueExpression;
+
+      if (SANITIZER_PATTERN.test(judgedExpression)) continue;
+      if (ENV_CONFIG_VALUE_PATTERN.test(judgedExpression)) continue;
+      if (I18N_VALUE_PATTERN.test(judgedExpression)) continue;
+      if (!HTML_TAINT_PATTERN.test(judgedExpression)) continue;
+      if (ESCAPING_SERIALIZER_CALL_PATTERN.test(valueExpression)) continue;
+      if (
+        BARE_IDENTIFIER_VALUE_PATTERN.test(valueExpression) &&
+        ESCAPING_SERIALIZER_LIBRARY_PATTERN.test(file.content)
+      ) {
+        continue;
+      }
+      const sinkTargetMatch = INNERHTML_TARGET_PATTERN.exec(line);
+      if (
+        sinkTargetMatch?.[1] !== undefined &&
+        isInertParseTarget(sinkTargetMatch[1], lines, lineIndex, file.content)
+      ) {
+        continue;
+      }
+      const textBeforeSink = lines
+        .slice(Math.max(0, lineIndex - STYLE_TAG_LOOKBEHIND_LINES), lineIndex + 1)
+        .join("\n")
+        .slice(0, -line.length + line.search(DANGEROUS_HTML_PATTERN));
+      if (STYLE_TAG_BEFORE_SINK_PATTERN.test(textBeforeSink)) continue;
+
+      findings.push({
+        message:
+          "HTML is injected from a dynamic-looking source, which can become XSS if the value is user-controlled or unsanitized.",
+        line: lineIndex + 1,
+        column: line.search(/\S/) + 1,
+      });
+    }
+    return findings;
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-client-owned-authz-field.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-client-owned-authz-field.regressions.test.ts
new file mode 100644
index 000000000..62b935e83
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-client-owned-authz-field.regressions.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { firebaseClientOwnedAuthzField } from "./firebase-client-owned-authz-field.js";
+
+describe("security-scan/firebase-client-owned-authz-field — regressions", () => {
+  it("flags client firestore writes carrying ownership fields", () => {
+    const findings = runScanRule(firebaseClientOwnedAuthzField, {
+      relativePath: "src/features/projects/create-project.ts",
+      content: `import { addDoc, collection } from "firebase/firestore";\nexport const createProject = (name: string, userId: string) =>\n  addDoc(collection(db, "projects"), { name, ownerId: userId, role: "admin" });\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on in-house writers that merely share firestore method names (affine updateDoc shape)", () => {
+    const findings = runScanRule(firebaseClientOwnedAuthzField, {
+      relativePath: "src/plugins/copilot/mcp/provider.ts",
+      content: `export class DocProvider {\n  async apply(workspaceId: string, docId: string, content: string, userId: string) {\n    await this.writer.updateDoc(workspaceId, docId, content, userId);\n  }\n}\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-client-owned-authz-field.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-client-owned-authz-field.ts
new file mode 100644
index 000000000..ecc2fea0e
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-client-owned-authz-field.ts
@@ -0,0 +1,27 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isClientSourcePath } from "./utils/is-client-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+// `updateDoc`/`.collection(...).update(...)` are common method names on
+// in-house data writers too; the file must show client-database evidence
+// (in its path or content) before its writes count as client-owned authz
+// fields. `setDoc`/`addDoc` are firestore-specific; bare `updateDoc` is not.
+const CLIENT_DATABASE_EVIDENCE_PATTERN = /firebase|firestore|supabase|\b(?:setDoc|addDoc)\s*\(/i;
+
+export const firebaseClientOwnedAuthzField = defineRule({
+  id: "firebase-client-owned-authz-field",
+  title: "Client writes authorization field",
+  severity: "error",
+  recommendation:
+    "Derive authority fields on the server or enforce them in Firebase/Supabase rules; never trust client-provided owner, org, or role values.",
+  scan: scanByPattern({
+    shouldScan: (file) =>
+      isClientSourcePath(file.relativePath) &&
+      (CLIENT_DATABASE_EVIDENCE_PATTERN.test(file.content) ||
+        CLIENT_DATABASE_EVIDENCE_PATTERN.test(file.relativePath)),
+    pattern:
+      /(?:\b(?:setDoc|updateDoc|addDoc)\s*\(|(?:\b(?:firebase|firestore|getFirestore)\b|\bcollection\s*\(|\.collection\s*\()[\s\S]{0,500}\.(?:set|update|add)\s*\()[\s\S]{0,700}\b(?:ownerId|ownerID|creatorId|creatorID|providerId|providerID|orgId|orgID|tenantId|tenantID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin)\b/i,
+    message:
+      "Client code writes an ownership, tenant, or role field that should be server-owned and immutable.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-permissive-rules.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-permissive-rules.ts
new file mode 100644
index 000000000..43f4dfb2f
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-permissive-rules.ts
@@ -0,0 +1,18 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isFirebaseRulesPath } from "./utils/is-firebase-rules-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+export const firebasePermissiveRules = defineRule({
+  id: "firebase-permissive-rules",
+  title: "Permissive Firebase security rule",
+  severity: "error",
+  recommendation:
+    "Bind every read/write to `request.auth.uid`, immutable ownership, and tenant membership instead of treating sign-in as authorization.",
+  scan: scanByPattern({
+    shouldScan: (file) => isFirebaseRulesPath(file.relativePath),
+    pattern:
+      /allow\s+(?:read|write|create|update|delete|list|get|read,\s*write)\s*:\s*if\s+(?:true|request\.auth\s*!=\s*null)\s*;?/i,
+    message:
+      "Firebase rules grant broad access to everyone or to any signed-in user, which is the Chattr/Firewreck failure mode.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-query-filter-as-auth.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-query-filter-as-auth.ts
new file mode 100644
index 000000000..5d8964a9f
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/firebase-query-filter-as-auth.ts
@@ -0,0 +1,18 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isClientSourcePath } from "./utils/is-client-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+export const firebaseQueryFilterAsAuth = defineRule({
+  id: "firebase-query-filter-as-auth",
+  title: "Firestore query filter used as authorization",
+  severity: "warn",
+  recommendation:
+    "Make sure Firestore rules compare the requested document against `request.auth.uid` and trusted membership data.",
+  scan: scanByPattern({
+    shouldScan: (file) => isClientSourcePath(file.relativePath),
+    pattern:
+      /\.where\s*\(\s*["'](?:uid|userId|userID|ownerId|ownerID|orgId|orgID|tenantId|tenantID|role)["']\s*,\s*["']==["']/i,
+    message:
+      "Firestore query code filters by an auth-shaped field; filtering is not authorization unless rules enforce the same boundary.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/git-provider-url-injection-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/git-provider-url-injection-risk.regressions.test.ts
new file mode 100644
index 000000000..9c0ce2a60
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/git-provider-url-injection-risk.regressions.test.ts
@@ -0,0 +1,47 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { gitProviderUrlInjectionRisk } from "./git-provider-url-injection-risk.js";
+
+describe("security-scan/git-provider-url-injection-risk — regressions", () => {
+  it("stays silent on commit links built from internal constants (excalidraw/cal.com shape)", () => {
+    const findings = runScanRule(gitProviderUrlInjectionRisk, {
+      relativePath: "src/components/credits.tsx",
+      content: `const commitUrl = \`https://github.com/calcom/cal.com/commit/\${COMMIT_SHA}\`;\nconst issueUrl = \`https://github.com/excalidraw/excalidraw/issues/new?body=\${encodeURIComponent(errorStack)}\`;\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags provider URLs interpolating request-sourced values", () => {
+    const findings = runScanRule(gitProviderUrlInjectionRisk, {
+      relativePath: "src/server/repos.ts",
+      content: `const apiUrl = \`https://api.github.com/repos/\${req.query.owner}/\${req.query.repo}\`;\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on bare owner/repo parameters without a request source", () => {
+    const findings = runScanRule(gitProviderUrlInjectionRisk, {
+      relativePath: "src/repo-browser/github-client.ts",
+      content:
+        "const branchResponse = await fetch(`https://api.github.com/repos/${owner}/${repo}/branches/${branch}`);\n",
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on config-sourced app slugs in provider URLs", () => {
+    const findings = runScanRule(gitProviderUrlInjectionRisk, {
+      relativePath: "src/github-app-connect.ts",
+      content: "const baseUrl = `https://github.com/apps/${this.config.slug}/installations/new`;\n",
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent in test-data directories (conductor diagramTests shape)", () => {
+    const findings = runScanRule(gitProviderUrlInjectionRisk, {
+      relativePath: "src/testData/diagramTests.js",
+      content:
+        'const task = { uri: "https://api.github.com/repos/${workflow.input.gh_account}/${workflow.input.gh_repo}" };\n',
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/git-provider-url-injection-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/git-provider-url-injection-risk.ts
new file mode 100644
index 000000000..37078d0e5
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/git-provider-url-injection-risk.ts
@@ -0,0 +1,60 @@
+import { defineRule } from "../../utils/define-rule.js";
+import type { ScanFinding } from "../../utils/file-scan.js";
+import { getLocationAtIndex } from "./utils/get-location-at-index.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+
+const GIT_PROVIDER_HOST_PATTERN = /api\.github\.com|github\.com|gitlab\.com|bitbucket\.org/gi;
+
+const TEMPLATE_INTERPOLATION_PATTERN = /\$\{([^}]*)\}/g;
+
+// Interpolating internal constants (commit SHAs, version strings, issue
+// links) into provider URLs is how everyone builds changelog/report-bug
+// links — only flag when the interpolated value visibly reads external
+// input. Bare identifiers named owner/repo/slug/branch are overwhelmingly
+// internal config or function parameters, so the marker must be a
+// request-shaped property access or an explicit untrusted/decode marker.
+const EXTERNAL_INPUT_PATTERN =
+  /\b(?:params|searchParams|query|req|request|input|payload)\s*[.[]|\buntrusted|\bdecodeURI\w*/;
+
+const ENCODED_INTERPOLATION_PATTERN = /encodeURIComponent\s*\(/;
+
+const INTERPOLATION_LOOKAHEAD_CHARS = 200;
+
+export const gitProviderUrlInjectionRisk = defineRule({
+  id: "git-provider-url-injection-risk",
+  title: "Git provider URL built from interpolation",
+  severity: "warn",
+  recommendation:
+    "Validate owner, repo, org, and branch identifiers against strict slugs and build URLs with URL/path encoders instead of raw interpolation.",
+  scan: (file) => {
+    if (!isProductionSourcePath(file.relativePath)) return [];
+
+    const findings: ScanFinding[] = [];
+    for (const hostMatch of file.content.matchAll(GIT_PROVIDER_HOST_PATTERN)) {
+      const rawTail = file.content.slice(
+        hostMatch.index,
+        hostMatch.index + INTERPOLATION_LOOKAHEAD_CHARS,
+      );
+      const templateEndIndex = rawTail.indexOf("`");
+      const urlTail = templateEndIndex >= 0 ? rawTail.slice(0, templateEndIndex) : rawTail;
+      const hasTaintedInterpolation = Array.from(
+        urlTail.matchAll(TEMPLATE_INTERPOLATION_PATTERN),
+      ).some(
+        (interpolation) =>
+          EXTERNAL_INPUT_PATTERN.test(interpolation[1] ?? "") &&
+          !ENCODED_INTERPOLATION_PATTERN.test(interpolation[1] ?? ""),
+      );
+      if (!hasTaintedInterpolation) continue;
+
+      const location = getLocationAtIndex(file.content, hostMatch.index);
+      findings.push({
+        message:
+          "GitHub/GitLab/Bitbucket URL construction interpolates path components that may be attacker-controlled.",
+        line: location.line,
+        column: location.column,
+      });
+      break;
+    }
+    return findings;
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/import-metadata-execution-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/import-metadata-execution-risk.regressions.test.ts
new file mode 100644
index 000000000..d7475ae44
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/import-metadata-execution-risk.regressions.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { importMetadataExecutionRisk } from "./import-metadata-execution-risk.js";
+
+describe("security-scan/import-metadata-execution-risk — regressions", () => {
+  it("stays silent on a child_process import followed by other imports (cal.com auto-migrations shape)", () => {
+    const findings = runScanRule(importMetadataExecutionRisk, {
+      relativePath: "packages/prisma/auto-migrations.ts",
+      content: `import { exec as execCb } from "node:child_process";\nimport { promisify } from "node:util";\n\nimport { getSchema } from "./schema";\n\nconst exec = promisify(execCb);\nawait exec("yarn prisma migrate deploy");\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags executing an uploaded archive inside the call statement", () => {
+    const findings = runScanRule(importMetadataExecutionRisk, {
+      relativePath: "src/server/import.ts",
+      content: `import { exec } from "node:child_process";\n\nexport const importArchive = (uploadPath: string) => {\n  exec(\`unzip \${uploadPath} -d /tmp/import\`);\n};\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent when taint words only appear in quoted static arguments", () => {
+    const findings = runScanRule(importMetadataExecutionRisk, {
+      relativePath: "src/utils/cli-plugin.ts",
+      content: `import { spawnSync } from "node:child_process";\n\nexport const installSkills = () =>\n  spawnSync("claude", ["plugin", "marketplace", "add", "acme/agent-skills"], { stdio: "inherit" });\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent when execution keywords only appear in comments", () => {
+    const findings = runScanRule(importMetadataExecutionRisk, {
+      relativePath: "src/sdk/connection.ts",
+      content: `// Ajv compiles schemas via \`new Function(...)\`, which throws when the\n// MCP plugin runs inside a sandboxed worker.\nconst createClient = () => new Client(validatorOptions);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on SCREAMING constants containing taint words (medusa PLUGIN_ID shape)", () => {
+    const findings = runScanRule(importMetadataExecutionRisk, {
+      relativePath: "src/utils/claude-code-plugin.ts",
+      content: `import { spawnSync } from "node:child_process";\nconst install = spawnSync("claude", ["plugin", "install", PLUGIN_ID], { stdio: "inherit" });\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on state-machine spawn without a process module (conductor xstate shape)", () => {
+    const findings = runScanRule(importMetadataExecutionRisk, {
+      relativePath: "src/pages/definition/WorkflowMetadata/state/actions.ts",
+      content: `return context.editableFields.map((field) =>\n  spawn(\n    machineInstance.withContext({\n      value: _get(context.metadataChanges, field),\n      fieldName: field,\n    }),\n    \`\${field}-field\`,\n  ),\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("still flags bare spawn of metadata when a process module is present", () => {
+    const findings = runScanRule(importMetadataExecutionRisk, {
+      relativePath: "src/import/exif-import.ts",
+      content: `import { spawn } from "node:child_process";\nexport const extract = (upload) => spawn("exiftool", [upload.metadataPath]);\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/import-metadata-execution-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/import-metadata-execution-risk.ts
new file mode 100644
index 000000000..4114dd52c
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/import-metadata-execution-risk.ts
@@ -0,0 +1,51 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+// Bare `spawn(`/`exec(` is also the xstate/redux-saga effect API; only count
+// it when the file shows an actual process module.
+const PROCESS_MODULE_EVIDENCE_PATTERN = /child_process|childProcess|execa|subprocess|Deno\.run/;
+
+const EXECUTION_WITH_BARE_CALLS_PATTERN =
+  /(?:\b(?:eval|new\s+Function|vm\.runIn\w*)|(?<![.\w$])(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)|\b(?:child_process|childProcess|cp)\.(?:exec|spawn)\w*)\s*\([^;]{0,200}(?<!["'])\b(?:exif|metadata|manifest|preset|plugin|upload|drop(?:ped|s)?\b|archive|zip|unzip|untar)(?!\w*["'])/;
+
+const EXECUTION_WITHOUT_BARE_CALLS_PATTERN =
+  /(?:\b(?:eval|new\s+Function|vm\.runIn\w*)|\b(?:child_process|childProcess|cp)\.(?:exec|spawn)\w*)\s*\([^;]{0,200}(?<!["'])\b(?:exif|metadata|manifest|preset|plugin|upload|drop(?:ped|s)?\b|archive|zip|unzip|untar)(?!\w*["'])/;
+
+const EXECUTION_RISK_MESSAGE =
+  "Imported metadata, uploads, or plugin manifests appear to reach code execution.";
+
+const scanWithBareCalls = scanByPattern({
+  shouldScan: () => true,
+  pattern: EXECUTION_WITH_BARE_CALLS_PATTERN,
+  message: EXECUTION_RISK_MESSAGE,
+});
+
+const scanWithoutBareCalls = scanByPattern({
+  shouldScan: () => true,
+  pattern: EXECUTION_WITHOUT_BARE_CALLS_PATTERN,
+  message: EXECUTION_RISK_MESSAGE,
+});
+
+export const importMetadataExecutionRisk = defineRule({
+  id: "import-metadata-execution-risk",
+  title: "Imported metadata reaches code execution",
+  severity: "error",
+  recommendation:
+    "Parse imported metadata as data with strict schemas; do not evaluate EXIF, manifests, presets, dropped files, or archives.",
+  // The taint word must sit inside the execution call's own statement —
+  // a window that crosses statements self-flags on unrelated `import` lines
+  // (e.g. `import { exec } from "node:child_process"` followed by any import).
+  // `(?<!["'])...(?!["'])` keeps quote-wrapped static arguments
+  // (`spawnSync("claude", ["plugin", ...])`) from counting as taint — a
+  // literal word is an argument value the attacker does not control.
+  // Case-sensitive on purpose: the execution APIs are exact-case, and a
+  // case-insensitive taint word matches SCREAMING constants (`PLUGIN_ID`)
+  // and camelCase type names (`WorkflowMetadata`) that are not data.
+  scan: (file) => {
+    if (!isProductionSourcePath(file.relativePath)) return [];
+    return PROCESS_MODULE_EVIDENCE_PATTERN.test(file.content)
+      ? scanWithBareCalls(file)
+      : scanWithoutBareCalls(file);
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/insecure-crypto-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/insecure-crypto-risk.regressions.test.ts
new file mode 100644
index 000000000..c77f91c1a
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/insecure-crypto-risk.regressions.test.ts
@@ -0,0 +1,142 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { insecureCryptoRisk } from "./insecure-crypto-risk.js";
+
+describe("security-scan/insecure-crypto-risk — regressions", () => {
+  it("stays silent on the French word 'des' in locale strings", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/locales/fr/accessibility.ts",
+      content: `export const accessibility = {\n  open_favorites_menu: "Ouvrir le menu des favoris",\n};\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on md5 used for non-security file fingerprinting", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/build/fingerprint.ts",
+      content: `import { createHash } from "node:crypto";\n\nexport const fingerprintFile = (fileContents: Buffer) =>\n  createHash("md5").update(fileContents).digest("hex");\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on signature comparison in a file that uses timingSafeEqual", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/server/webhook.ts",
+      content: `const isValid = crypto.timingSafeEqual(expected, received);\nif (signatureHeader !== undefined && isValid) process(payload);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on Math.random retry jitter in a file that mentions tokens elsewhere", () => {
+    const tokenMention = "const accessToken = await refreshAccessToken(credential);";
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/services/calendar-service.ts",
+      content: `${tokenMention}\n${"// padding\n".repeat(40)}const jitterSeconds = Number(Math.random().toFixed(3));\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags md5 hashing of password material", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/server/auth.ts",
+      content: `import { createHash } from "node:crypto";\n\nexport const hashPassword = (password: string) =>\n  createHash("md5").update(password).digest("hex");\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("flags a weak cipher algorithm passed to createCipheriv", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/server/encrypt.ts",
+      content: `const cipher = crypto.createCipheriv("des-ede3", key, iv);\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on Gravatar md5 hashes", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/graphics/account/gravatar.tsx",
+      content: `import { useAuth } from "../providers/Auth";\n\nexport const GravatarAccountIcon = () => {\n  const { user } = useAuth();\n  const hash = md5(user.email.trim().toLowerCase());\n  return <img src={\`https://www.gravatar.com/avatar/\${hash}\`} alt="" />;\n};\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on signature comparisons against enum members", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/types/plugin-signature.ts",
+      content: `export function isUnsignedPluginSignature(signature?: PluginSignatureStatus) {\n  return signature && signature !== PluginSignatureStatus.valid && signature !== PluginSignatureStatus.internal;\n}\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on Math.random jitter near unrelated token loops", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/streams/simulate.ts",
+      content: `for (const token of initialTokens) {\n  await setTimeout(Math.random() * 10 + 5);\n  yield token;\n}\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags Math.random feeding a token on the same statement", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/session-token.ts",
+      content: `export const sessionToken = () => Math.random().toString(36).slice(2);\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on vendored version-pinned libraries", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "public/libraries/jsonwebtoken@8.5.1.js",
+      content: `const cipherTable = { "des-cbc": CBC.instantiate(DES), "des-ecb": DES };\nconst cipher = crypto.createCipheriv("des-ede3", key, iv);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on vendored version-pinned directories", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "public/js/monaco-editor.0.45.0/vs/editor/editor.main.js",
+      content: `const sessionTokenHash = md5(value);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on node-forge's namespaced createCipher", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/account/crypt.ts",
+      content: `const cipher = forge.cipher.createCipher('AES-GCM', key);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags node:crypto's deprecated createCipher", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/account/crypt.ts",
+      content: `const cipher = crypto.createCipher('aes-256-cbc', password);\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on signature-method comparisons against module constants", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/network/o-auth-1/get-token.ts",
+      content: `if (authentication.signatureMethod === SIGNATURE_METHOD_RSA_SHA1) {\n  return signRsaSha1(payload);\n}\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on protocol-mandated md5 in HTTP digest auth", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/lib/axios/digest-auth.ts",
+      content: `const ha1 = crypto.hashing().md5(\`\${username}:\${realm}:\${password}\`, DigestType.Hex);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on sha1-derived deterministic ids", () => {
+    const findings = runScanRule(insecureCryptoRisk, {
+      relativePath: "src/services/cookie-jar.ts",
+      content: `const jar = {\n  _id: \`\${prefix}_\${crypto.createHash('sha1').update(parentId).digest('hex')}\`,\n  cookies: cookieJar.cookies,\n};\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/insecure-crypto-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/insecure-crypto-risk.ts
new file mode 100644
index 000000000..dc6ad70e4
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/insecure-crypto-risk.ts
@@ -0,0 +1,168 @@
+import { DEMO_CONTEXT_PATTERN } from "../../constants/security-scan.js";
+import { defineRule } from "../../utils/define-rule.js";
+import type { ScanFinding } from "../../utils/file-scan.js";
+import { getLocationAtIndex } from "./utils/get-location-at-index.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+
+const WEAK_HASH_PATTERN = /createHash\s*\(\s*["'](?:md5|sha1)["']|\bmd5\s*\(/gi;
+
+const SECURITY_CONTEXT_PATTERN =
+  /\b(?:password|token|secret|signature|signing|auth|credential|session|cookie|csrf|api.?key)\b/i;
+
+// `(?<!cipher\.)` keeps node-forge's `forge.cipher.createCipher("AES-GCM")`
+// out — only node:crypto's top-level createCipher/createDecipher is deprecated.
+const DEPRECATED_CIPHER_API_PATTERN = /(?<!cipher\.)\bcreate(?:Cipher|Decipher)\s*\(/;
+
+const WEAK_CIPHER_ALGORITHM_PATTERN =
+  /\bcreate(?:Cipher|Decipher)iv\s*\(\s*["'](?:des|des3|des-?ede3?|rc4|rc2|bf|blowfish)\b/i;
+
+// Case-sensitive on purpose: the case-insensitive form matches the French
+// word "des" and similar prose in string literals and comments.
+const WEAK_CIPHER_NAME_PATTERN = /\b(?:DES|RC4|Blowfish)\b/;
+
+const CIPHER_CONTEXT_PATTERN = /\b(?:cipher|decipher|encrypt|decrypt|crypto)\b/i;
+
+const UNSAFE_SIGNATURE_COMPARISON_PATTERN =
+  /[A-Za-z_$][\w$.]*signature[\w$]*(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]*(?:\([^)]*\))?|[A-Za-z_$][\w$.]*(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]*signature[\w$]*(?:\([^)]*\))?/i;
+
+// `signature !== PluginSignatureStatus.valid` compares enum/status members and
+// `signatureMethod === SIGNATURE_METHOD_RSA_SHA1` compares against a module
+// constant — neither side is a digest value.
+const ENUM_MEMBER_COMPARAND_PATTERN =
+  /(?:===?|!==?)\s*[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))|^[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))[\w$.]*(?:\([^)]*\))?\s*(?:===?|!==?)/;
+
+// `signatureMethod`/`signatureType` name which algorithm is in use, not a
+// computed signature value.
+const SIGNATURE_METADATA_IDENTIFIER_PATTERN =
+  /signature(?:Method|Type|Status|Algorithm|Kind|Mode|Version)\b/i;
+
+// `typedSignatureEnabled === false` / `isSignatureValid === false` compare a
+// boolean flag, not a digest.
+const BOOLEAN_COMPARAND_PATTERN = /(?:===?|!==?)\s*(?:true|false|null|undefined)\b/;
+
+// Timing-unsafe comparison is a server-side oracle; a comparison inside a
+// rendered component runs on the attacker's own machine.
+const CLIENT_COMPONENT_FILE_PATTERN = /\.[cm]?[jt]sx$/i;
+
+const TIMING_SAFE_COMPARISON_PATTERN = /timingSafeEqual|timing.?safe/i;
+
+// Gravatar, HTTP Digest auth (RFC 7616), and OAuth 1.0 mandate md5/sha1 by
+// protocol, and `_id`/etag/cache-key derivation hashes for uniqueness, not
+// secrecy; flagging those teaches users to ignore the rule.
+const PROTOCOL_MANDATED_HASH_CONTEXT_PATTERN =
+  /gravatar|digest[-_ ]?auth|oauth[-_ ]?1|\b_id\b|\betag\b|checksum|cache[-_ ]?key|fingerprint/i;
+
+// No bare `key` (React key props) or `hash` (location.hash, hash maps) —
+// both turn every component file with Math.random into a hit. No word
+// boundaries: the context word usually sits inside a camelCase identifier
+// (`sessionToken`), and the same-line requirement bounds the blast radius.
+const SECURITY_RANDOM_CONTEXT_PATTERN = /token|secret|password|nonce|salt|csrf|credential|otp/i;
+
+// `focusNonce: Math.random()` is a UI re-render trigger, not auth material.
+const UI_NONCE_CONTEXT_PATTERN =
+  /(?:focus|render|refresh|remount|redraw|animation|layout|cache|update)[-_]?nonce/i;
+
+const MATH_RANDOM_CALL_PATTERN = /Math\.random\s*\(/g;
+
+const SECURITY_CONTEXT_WINDOW_CHARS = 250;
+
+// File-level co-occurrence is a trap: any OAuth service mentions `token`
+// somewhere, so the context word must sit near the flagged call itself.
+const findMatchIndexNearContext = (
+  content: string,
+  pattern: RegExp,
+  contextPattern: RegExp,
+  excludeContextPattern?: RegExp,
+): number => {
+  for (const callMatch of content.matchAll(pattern)) {
+    const surroundingText = content.slice(
+      Math.max(0, callMatch.index - SECURITY_CONTEXT_WINDOW_CHARS),
+      callMatch.index + SECURITY_CONTEXT_WINDOW_CHARS,
+    );
+    if (!contextPattern.test(surroundingText)) continue;
+    if (excludeContextPattern?.test(surroundingText)) continue;
+    return callMatch.index;
+  }
+  return -1;
+};
+
+// A 250-char window around Math.random still bleeds across statements (LLM
+// "tokens" streamed with jittered delays); the security word must share the
+// statement that consumes the random value.
+const findRandomCallIndexWithSameLineContext = (
+  content: string,
+  pattern: RegExp,
+  contextPattern: RegExp,
+  excludeContextPattern: RegExp,
+): number => {
+  for (const callMatch of content.matchAll(pattern)) {
+    const lineStartIndex = content.lastIndexOf("\n", callMatch.index) + 1;
+    const lineEndCandidate = content.indexOf("\n", callMatch.index);
+    const lineEndIndex = lineEndCandidate < 0 ? content.length : lineEndCandidate;
+    const lineText = content.slice(lineStartIndex, lineEndIndex);
+    if (excludeContextPattern.test(lineText)) continue;
+    if (contextPattern.test(lineText)) return callMatch.index;
+  }
+  return -1;
+};
+
+export const insecureCryptoRisk = defineRule({
+  id: "insecure-crypto-risk",
+  title: "Weak cryptography in security context",
+  severity: "warn",
+  recommendation:
+    "Use modern primitives, `crypto.randomBytes` / Web Crypto randomness, and timing-safe comparisons for signatures, digests, tokens, and auth material.",
+  scan: (file) => {
+    if (!isProductionSourcePath(file.relativePath)) return [];
+    if (DEMO_CONTEXT_PATTERN.test(file.relativePath)) return [];
+
+    // The protocol marker often lives in the file name (`digest-auth.ts`),
+    // not within the 250-char window around the hash call.
+    if (PROTOCOL_MANDATED_HASH_CONTEXT_PATTERN.test(file.relativePath)) return [];
+
+    let matchIndex = findMatchIndexNearContext(
+      file.content,
+      WEAK_HASH_PATTERN,
+      SECURITY_CONTEXT_PATTERN,
+      PROTOCOL_MANDATED_HASH_CONTEXT_PATTERN,
+    );
+    if (matchIndex < 0) matchIndex = file.content.search(WEAK_CIPHER_ALGORITHM_PATTERN);
+    if (matchIndex < 0) matchIndex = file.content.search(DEPRECATED_CIPHER_API_PATTERN);
+    if (matchIndex < 0 && CIPHER_CONTEXT_PATTERN.test(file.content)) {
+      matchIndex = file.content.search(WEAK_CIPHER_NAME_PATTERN);
+    }
+    if (
+      matchIndex < 0 &&
+      !TIMING_SAFE_COMPARISON_PATTERN.test(file.content) &&
+      !CLIENT_COMPONENT_FILE_PATTERN.test(file.relativePath)
+    ) {
+      const comparisonMatch = UNSAFE_SIGNATURE_COMPARISON_PATTERN.exec(file.content);
+      if (
+        comparisonMatch !== null &&
+        !ENUM_MEMBER_COMPARAND_PATTERN.test(comparisonMatch[0]) &&
+        !SIGNATURE_METADATA_IDENTIFIER_PATTERN.test(comparisonMatch[0]) &&
+        !BOOLEAN_COMPARAND_PATTERN.test(comparisonMatch[0])
+      ) {
+        matchIndex = comparisonMatch.index;
+      }
+    }
+    if (matchIndex < 0) {
+      matchIndex = findRandomCallIndexWithSameLineContext(
+        file.content,
+        MATH_RANDOM_CALL_PATTERN,
+        SECURITY_RANDOM_CONTEXT_PATTERN,
+        UI_NONCE_CONTEXT_PATTERN,
+      );
+    }
+    if (matchIndex < 0) return [];
+
+    const location = getLocationAtIndex(file.content, matchIndex);
+    const finding: ScanFinding = {
+      message:
+        "Code uses weak hashes, deprecated ciphers, timing-unsafe comparisons, or Math.random in a security-shaped context.",
+      line: location.line,
+      column: location.column,
+    };
+    return [finding];
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/key-lifecycle-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/key-lifecycle-risk.regressions.test.ts
new file mode 100644
index 000000000..ccde4e44c
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/key-lifecycle-risk.regressions.test.ts
@@ -0,0 +1,78 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { keyLifecycleRisk } from "./key-lifecycle-risk.js";
+
+describe("security-scan/key-lifecycle-risk — regressions", () => {
+  it("stays silent when CI references a key name from the secret store", () => {
+    const findings = runScanRule(keyLifecycleRisk, {
+      relativePath: ".github/workflows/deploy.yml",
+      content: `steps:\n  - uses: webfactory/ssh-agent@v0.9.0\n    with:\n      ssh-private-key: \${{ secrets.SSH_PRIVATE_KEY }}\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on PEM placeholder templates in help text", () => {
+    const findings = runScanRule(keyLifecycleRisk, {
+      relativePath: "backend/management/commands/setup-agents.py",
+      content: `self.stdout.write('GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\\\\n...\\\\n-----END RSA PRIVATE KEY-----"')\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags PEM private key material", () => {
+    const findings = runScanRule(keyLifecycleRisk, {
+      relativePath: "config/deploy.pem",
+      content: `-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA7c1QpDK0N77BSO0FbGCPzcgMCS8ssCXd2eicCRb45fJsbiCe\nahGd0WOZHCSpwHcwgvT5ml0zXmkSO0Iqcm8m3aIp7DJBkLAA1MuYjvVLPyEDqGtR\n-----END RSA PRIVATE KEY-----\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("flags a key name assigned an inline literal", () => {
+    const findings = runScanRule(keyLifecycleRisk, {
+      relativePath: "src/config.ts",
+      content: `const DEPLOY_KEY = "9f8e7d6c5b4a39281706f5e4d3c2b1a0";\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on PEM placeholders truncated with an ellipsis", () => {
+    const findings = runScanRule(keyLifecycleRisk, {
+      relativePath: "docs/configuration.md",
+      content: `JWT_SECRET_KEY="-----BEGIN RSA PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC...\n-----END RSA PRIVATE KEY-----"\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on PEM headers in input placeholders (grafana TLS form shape)", () => {
+    const findings = runScanRule(keyLifecycleRisk, {
+      relativePath: "src/components/TLSSecretsConfig.tsx",
+      content: `<TextArea placeholder="-----BEGIN RSA PRIVATE KEY-----" rows={7} onChange={onKeyChange} />\nconst privateKeyBeginsWith = '-----BEGIN RSA PRIVATE KEY-----';\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on PEM headers wrapped around interpolated key variables", () => {
+    const findings = runScanRule(keyLifecycleRisk, {
+      relativePath: "src/services/chef-connection-fns.ts",
+      content:
+        "formattedKey = `-----BEGIN RSA PRIVATE KEY-----\\n${formattedKey}\\n-----END RSA PRIVATE KEY-----`;\n",
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on throwaway keys bound to placeholder constants (insomnia shape)", () => {
+    const findings = runScanRule(keyLifecycleRisk, {
+      relativePath: "src/components/auth-private-key-row.tsx",
+      content: `const PRIVATE_KEY_PLACEHOLDER = \`\n-----BEGIN RSA PRIVATE KEY-----\nMIIEpQIBAAKCAQEA39k9udklHnmkU0GtTLpnYtKk1l5txYmUD/cGI0bFd3HHOOLG\nmI0av55vMFEhxL7yrFrcL8pRKp0+pnOVStMDmbwsPE/pu9pf3uxD+m9/Flv89bUk\n-----END RSA PRIVATE KEY-----\`;\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on sample keys inside documentation", () => {
+    const findings = runScanRule(keyLifecycleRisk, {
+      relativePath: "docs/versioned_docs/version-3.5.0-LTS/data-sources/bigquery.md",
+      content: `  "private_key": "-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRGgDmfwYcKp4q\\n3ce4DkrKv0vTn"\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/key-lifecycle-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/key-lifecycle-risk.ts
new file mode 100644
index 000000000..1a7cbc57f
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/key-lifecycle-risk.ts
@@ -0,0 +1,29 @@
+import {
+  DOCUMENTATION_CONTEXT_PATTERN,
+  TEST_CONTEXT_PATTERN,
+} from "../../constants/security-scan.js";
+import { defineRule } from "../../utils/define-rule.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+export const keyLifecycleRisk = defineRule({
+  id: "key-lifecycle-risk",
+  title: "Long-lived key material in repository",
+  severity: "error",
+  recommendation:
+    "Remove private keys from source, rotate exposed credentials, prefer short-lived deploy credentials, and document revocation/expiry for release keys.",
+  // A key-shaped env NAME is how CI correctly references a secret store —
+  // only flag actual PEM material or a name assigned an inline literal value.
+  // The PEM header must be followed by a base64 body: UI placeholders, header
+  // constants, and `${...}`-wrapped headers are key-shaped text, not keys, and
+  // a `...` ellipsis early in the body marks a truncated docs placeholder.
+  // A placeholder/example/sample name binding right before the header marks a
+  // throwaway key committed as UI filler, not live key material.
+  scan: scanByPattern({
+    shouldScan: (file) =>
+      !TEST_CONTEXT_PATTERN.test(file.relativePath) &&
+      !DOCUMENTATION_CONTEXT_PATTERN.test(file.relativePath),
+    pattern:
+      /(?<!(?:placeholder|example|sample|dummy|fake)[\s\S]{0,40})-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----(?:\s|\\r|\\n)*[A-Za-z0-9+/=][A-Za-z0-9+/=\s]{38,}(?![^-]{0,160}\.\.\.)|\b(?:SSH_PRIVATE_KEY|GPG_PRIVATE_KEY|DEPLOY_KEY|SIGNING_KEY)\b\s*[:=]\s*["'][^"'\n]{16,}["']/i,
+    message: "Private or long-lived release key material appears in the repository.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/local-rpc-native-bridge-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/local-rpc-native-bridge-risk.regressions.test.ts
new file mode 100644
index 000000000..c9969629a
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/local-rpc-native-bridge-risk.regressions.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { localRpcNativeBridgeRisk } from "./local-rpc-native-bridge-risk.js";
+
+describe("security-scan/local-rpc-native-bridge-risk — regressions", () => {
+  it("stays silent on exact-hostname localhost checks (cal.com preview shape)", () => {
+    const findings = runScanRule(localRpcNativeBridgeRisk, {
+      relativePath: "src/preview.ts",
+      content: `const url = new URL(window.location.href);\nif (url.hostname === "localhost") {\n  const allowed = trustedHosts.includes(url.hostname);\n  if (allowed) state.update({ previewMode: true });\n}\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags a localhost WebSocket bridge that executes commands", () => {
+    const findings = runScanRule(localRpcNativeBridgeRisk, {
+      relativePath: "src/bridge.ts",
+      content: `const socket = new WebSocket("ws://127.0.0.1:9001");\nsocket.onmessage = ({ data }) => {\n  exec(JSON.parse(data).command);\n};\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/local-rpc-native-bridge-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/local-rpc-native-bridge-risk.ts
new file mode 100644
index 000000000..635e0c8d4
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/local-rpc-native-bridge-risk.ts
@@ -0,0 +1,20 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+export const localRpcNativeBridgeRisk = defineRule({
+  id: "local-rpc-native-bridge-risk",
+  title: "Weak localhost native bridge boundary",
+  severity: "warn",
+  recommendation:
+    "Use exact origin allowlists after URL parsing, per-request nonces, narrow methods, and never expose install/update commands to arbitrary web pages.",
+  // Generic verbs (includes/indexOf/install/update) match dev-server helpers
+  // and ordinary state updates — only native-capability commands count.
+  scan: scanByPattern({
+    shouldScan: (file) => isProductionSourcePath(file.relativePath),
+    pattern:
+      /\b(?:127\.0\.0\.1|localhost|Access-Control-Allow-Origin|websocket|WebSocket)\b[\s\S]{0,700}(?:\b(?:UpdateApp|InstallApp|child_process)\b|(?<![.\w$])(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)\s*\()/i,
+    message:
+      "Code appears to bridge browser code to localhost/native capabilities with weak origin or update/install checks.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/mcp-tool-capability-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/mcp-tool-capability-risk.ts
new file mode 100644
index 000000000..f3547fe28
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/mcp-tool-capability-risk.ts
@@ -0,0 +1,25 @@
+import { AGENT_TOOL_DANGEROUS_CAPABILITY_PATTERN } from "../../constants/security-scan.js";
+import { defineRule } from "../../utils/define-rule.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+const MCP_IMPORT_PATTERN =
+  /\bfrom\s+["']@modelcontextprotocol\/sdk[^"']*["']|\bMcpServer\b|\bMcpAgent\b/;
+
+const MCP_TOOL_SURFACE_PATTERN =
+  /\b(?:server\.\s*(?:tool|resource|prompt)\s*\(|register(?:Tool|Resource|Prompt)\s*\(|setRequestHandler\s*\(\s*(?:CallToolRequestSchema|ListToolsRequestSchema)|new\s+(?:McpServer|McpAgent)\s*\()/;
+
+export const mcpToolCapabilityRisk = defineRule({
+  id: "mcp-tool-capability-risk",
+  title: "MCP tool exposes dangerous capability",
+  severity: "warn",
+  recommendation:
+    "MCP tool calls run with the connecting client's authority. Validate inputs, enforce per-tool authorization, and avoid raw filesystem/shell/network access where possible.",
+  scan: scanByPattern({
+    shouldScan: (file) => isProductionSourcePath(file.relativePath),
+    pattern: MCP_TOOL_SURFACE_PATTERN,
+    requireAll: [MCP_IMPORT_PATTERN, AGENT_TOOL_DANGEROUS_CAPABILITY_PATTERN],
+    message:
+      "An MCP tool/resource/prompt handler appears to expose file, shell, network, or code-execution capability.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/mdx-ssr-execution-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/mdx-ssr-execution-risk.regressions.test.ts
new file mode 100644
index 000000000..e0ed1a2e5
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/mdx-ssr-execution-risk.regressions.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { mdxSsrExecutionRisk } from "./mdx-ssr-execution-risk.js";
+
+describe("security-scan/mdx-ssr-execution-risk — regressions", () => {
+  it("stays silent on page.evaluate / webpack compile shapes without MDX", () => {
+    const findings = runScanRule(mdxSsrExecutionRisk, {
+      relativePath: "src/server/render-preview.ts",
+      content: `const html = await page.evaluate(() => document.body.outerHTML);\nconst compiled = compiler.compile(entrySource);\nawait cache.set(cacheKey, compiled);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags server-side MDX compilation of tenant content", () => {
+    const findings = runScanRule(mdxSsrExecutionRisk, {
+      relativePath: "src/app/docs/page.tsx",
+      content: `import { compileMDX } from "next-mdx-remote/rsc";\n\nconst { content } = await compileMDX({ source: tenantDocumentSource });\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on docs sites rendering their own MDX content", () => {
+    const findings = runScanRule(mdxSsrExecutionRisk, {
+      relativePath: "components/mdx-content/index.tsx",
+      content: `import { MDXRemote } from "next-mdx-remote/rsc";\nimport MDXComponents from "../mdx-components";\n\nexport const MDXContent = ({ children }: { children: string }) => (\n  <MDXRemote source={children} components={MDXComponents} />\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags MDX rendering with raw HTML enabled", () => {
+    const findings = runScanRule(mdxSsrExecutionRisk, {
+      relativePath: "components/mdx-content/index.tsx",
+      content: `import { MDXRemote } from "next-mdx-remote/rsc";\n\nexport const MDXContent = ({ children }) => (\n  <MDXRemote source={children} options={{ mdxOptions: { rehypePlugins: [rehypeRaw] } }} />\n);\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/mdx-ssr-execution-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/mdx-ssr-execution-risk.ts
new file mode 100644
index 000000000..020fe7cc6
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/mdx-ssr-execution-risk.ts
@@ -0,0 +1,22 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+export const mdxSsrExecutionRisk = defineRule({
+  id: "mdx-ssr-execution-risk",
+  title: "Server-rendered MDX can execute code",
+  severity: "warn",
+  recommendation:
+    "Use a constrained compiler for untrusted content, disable expressions/raw HTML, sandbox renderers, and avoid caching attacker-controlled output across tenants.",
+  // Bare `evaluate`/`compile` triggers match webpack compiles, page.evaluate,
+  // moduleRef.compile, etc. — the trigger must name an MDX library surface.
+  // Generic words (content/source/body/mdx) match every docs site rendering
+  // its own MDX; require an untrusted-shaped source or a dangerous flag.
+  scan: scanByPattern({
+    shouldScan: (file) => isProductionSourcePath(file.relativePath),
+    pattern:
+      /(?:@mdx-js\/mdx|next-mdx-remote|\b(?:MDXRemote|compileMDX|evaluateMdx)\b)[\s\S]{0,700}\b(?:repo|customer|tenant|user[-_]?(?:content|markdown|mdx|input|provided|generated|submitted)|untrusted|searchParams|req\.|request\.|fetch\s*\(|prisma\.|db\.|database|rehypeRaw|allowDangerousHtml)/i,
+    message:
+      "MDX/markdown rendering code may evaluate user or repository content during SSR or static generation.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/nosql-injection-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/nosql-injection-risk.ts
new file mode 100644
index 000000000..468e44283
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/nosql-injection-risk.ts
@@ -0,0 +1,20 @@
+import { DATABASE_SOURCE_FILE_PATTERN } from "../../constants/security-scan.js";
+import { defineRule } from "../../utils/define-rule.js";
+import { isProductionFilePath } from "./utils/is-production-file-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+const NOSQL_INJECTION_RISK_PATTERN =
+  /\$where\s*['"]?\s*:\s*(?:f?['"`][^'"`]{0,200}\$\{|function|f['"])|\.find\s*\(\s*JSON\.parse\s*\(\s*(?:req|request)\.|\.aggregate\s*\(\s*\[?\s*\{[^}]{0,400}\$where|\bnew\s+RegExp\s*\(\s*(?:req|request)\.|\$regex['"]?\s*:\s*(?:req|request)\./i;
+
+export const nosqlInjectionRisk = defineRule({
+  id: "nosql-injection-risk",
+  title: "NoSQL query accepts operator-shaped input",
+  severity: "warn",
+  recommendation:
+    "Coerce scalar fields before querying, reject operator keys from client input, and avoid `$where` or request-derived regexes.",
+  scan: scanByPattern({
+    shouldScan: (file) => isProductionFilePath(file.relativePath, DATABASE_SOURCE_FILE_PATTERN),
+    pattern: NOSQL_INJECTION_RISK_PATTERN,
+    message: "Code appears to pass raw JSON, regex, or `$where` style input into a NoSQL query.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/package-metadata-secret.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/package-metadata-secret.ts
new file mode 100644
index 000000000..89c728e66
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/package-metadata-secret.ts
@@ -0,0 +1,28 @@
+import { SECRET_VALUE_PATTERNS } from "../../constants/security.js";
+import { defineRule } from "../../utils/define-rule.js";
+import { findSuspiciousPublicEnvSecretNamePattern } from "./utils/find-suspicious-public-env-secret-name.js";
+import { getMatchLocation } from "./utils/get-match-location.js";
+
+export const packageMetadataSecret = defineRule({
+  id: "package-metadata-secret",
+  title: "Secret-like package metadata",
+  severity: "warn",
+  recommendation:
+    "Keep secrets out of package metadata and generated reports; they are often published to registries, logs, or browser artifacts.",
+  scan: (file) => {
+    if (!file.relativePath.endsWith("package.json")) return [];
+    const pattern =
+      findSuspiciousPublicEnvSecretNamePattern(file.content) ??
+      SECRET_VALUE_PATTERNS.find((candidate) => candidate.test(file.content));
+    if (pattern === undefined) return [];
+
+    const location = getMatchLocation(file.content, pattern);
+    return [
+      {
+        message: "Package metadata contains secret-like values or public env secret names.",
+        line: location.line,
+        column: location.column,
+      },
+    ];
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/path-traversal-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/path-traversal-risk.regressions.test.ts
new file mode 100644
index 000000000..4bace9bed
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/path-traversal-risk.regressions.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { pathTraversalRisk } from "./path-traversal-risk.js";
+
+describe("security-scan/path-traversal-risk — regressions", () => {
+  it("flags filesystem paths joined from request params", () => {
+    const findings = runScanRule(pathTraversalRisk, {
+      relativePath: "src/server/files.ts",
+      content: `export const readUserFile = (req) => readFileSync(path.join(UPLOADS_DIR, req.params.fileName));\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent when a taint word only appears inside a string literal (posthog render-query shape)", () => {
+    const findings = runScanRule(pathTraversalRisk, {
+      relativePath: "frontend/bundler.mjs",
+      content: `const outfile = path.resolve(__dirname, 'dist', 'render-query.js');\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent in build and tooling scripts", () => {
+    const findings = runScanRule(pathTraversalRisk, {
+      relativePath: "frontend/build.mjs",
+      content: `const out = path.resolve(__dirname, parsed.outputDir);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/path-traversal-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/path-traversal-risk.ts
new file mode 100644
index 000000000..7d53e332d
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/path-traversal-risk.ts
@@ -0,0 +1,24 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isDevToolingPath } from "./utils/is-dev-tooling-path.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+// `(?<![-.\w$'"])` keeps taint accessors that merely appear inside string
+// literals (`path.resolve(__dirname, 'render-query.js')`) from counting.
+const PATH_TRAVERSAL_RISK_PATTERN =
+  /\b(?:readFile|readFileSync|writeFile|writeFileSync)\s*\(\s*(?:req\.|request\.|params\.|query\.|body\.|parsed\.|`[^`]*(?<![-.\w$'"])(?:req\.|request\.|params\.|query\.|body\.))|\bpath\.(?:join|resolve)\s*\([^)]*(?<![-.\w$'"])(?:req\.|request\.|params\.|query\.|body\.|parsed\.)/;
+
+export const pathTraversalRisk = defineRule({
+  id: "path-traversal-risk",
+  title: "Filesystem path uses caller input",
+  severity: "warn",
+  recommendation:
+    "Resolve paths against a fixed base directory, reject traversal after normalization, and map user-visible identifiers to server-owned paths.",
+  scan: scanByPattern({
+    shouldScan: (file) =>
+      isProductionSourcePath(file.relativePath) && !isDevToolingPath(file.relativePath),
+    pattern: PATH_TRAVERSAL_RISK_PATTERN,
+    message:
+      "Filesystem access appears to use request, query, params, or body data as part of the path.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/plugin-update-trust-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/plugin-update-trust-risk.regressions.test.ts
new file mode 100644
index 000000000..b5717898a
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/plugin-update-trust-risk.regressions.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { pluginUpdateTrustRisk } from "./plugin-update-trust-risk.js";
+
+describe("security-scan/plugin-update-trust-risk — regressions", () => {
+  it("stays silent on a plain download link near an https URL", () => {
+    const findings = runScanRule(pluginUpdateTrustRisk, {
+      relativePath: "src/components/download-button.tsx",
+      content: `const downloadHref = "https://example.com/exports/report.csv";\nexport const DownloadButton = () => <a href={downloadHref}>Download</a>;\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags an updater downloading and unpacking an executable artifact", () => {
+    const findings = runScanRule(pluginUpdateTrustRisk, {
+      relativePath: "src/updater.ts",
+      content: `import { spawnSync } from "node:child_process";\nconst updateUrl = await fetchLatestRelease();\nawait downloadFile(updateUrl, "/tmp/update.zip");\nspawnSync("unzip", ["/tmp/update.zip"]);\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on install instructions only displayed in UI copy", () => {
+    const findings = runScanRule(pluginUpdateTrustRisk, {
+      relativePath: "src/onboarding/install-step.tsx",
+      content: `export const InstallStep = () => (\n  <CodeSnippet>{"curl --proto '=https' -LsSf https://example.com/cli-installer.sh | sh"}</CodeSnippet>\n);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on install-command constants that are never executed", () => {
+    const findings = runScanRule(pluginUpdateTrustRisk, {
+      relativePath: "src/types/agent.ts",
+      content: `export const CLI_INSTALL_COMMANDS = [\n  "curl -fsSL https://claude.ai/install.sh | bash",\n  "brew install --cask claude-code",\n] as const;\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on curl uploads of build artifacts (postiz extension shape)", () => {
+    const findings = runScanRule(pluginUpdateTrustRisk, {
+      relativePath: ".github/workflows/build-extension.yaml",
+      content: `      - name: Upload artifact\n        run: |\n          curl -T apps/extension/extension.zip \\\n            https://artifacts.example.com/upload\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on checksum-verified downloads (infisical oracle-client shape)", () => {
+    const findings = runScanRule(pluginUpdateTrustRisk, {
+      relativePath: "backend/Dockerfile",
+      content: `RUN ORACLE_ZIP="instantclient-basic-linux.x64-23.26.0.0.0.zip" && \\\n    EXPECTED_SHA="d6c79cbcf0ff209363e779855c690d4fc730aed847e9198a2c439bcf34760af5" && \\\n    wget -q "https://download.oracle.com/otn_software/\${ORACLE_ZIP}" && \\\n    echo "\${EXPECTED_SHA} \${ORACLE_ZIP}" | sha256sum -c -\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on healthcheck wget near unrelated chmod (outline Dockerfile shape)", () => {
+    const findings = runScanRule(pluginUpdateTrustRisk, {
+      relativePath: "Dockerfile",
+      content: `RUN apt-get update \\\n    && apt-get install -y wget \\\n    && rm -rf /var/lib/apt/lists/*\nRUN mkdir -p "/var/lib/outline/data" && chmod 1777 "/var/lib/outline/data"\nHEALTHCHECK --interval=1m CMD wget -qO- "http://localhost:3000/_health" | grep -q "OK" || exit 1\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/plugin-update-trust-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/plugin-update-trust-risk.ts
new file mode 100644
index 000000000..a1a53fb4a
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/plugin-update-trust-risk.ts
@@ -0,0 +1,53 @@
+import { SOURCE_FILE_PATTERN } from "../../constants/security-scan.js";
+import { defineRule } from "../../utils/define-rule.js";
+import { getMatchLocation } from "./utils/get-match-location.js";
+import { isConfigOrCiPath } from "./utils/is-config-or-ci-path.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+import { getScannableContent } from "./utils/scan-by-pattern.js";
+
+// `download` near `https://` matches every download link; require an
+// updater-shaped trigger plus a concrete executable artifact or pipe-to-shell
+// close by (instructional `curl ... | sh` strings shown in onboarding UIs sit
+// far from any artifact, and a 700-char window bled across unrelated code).
+// `curl -T`/`--upload-file` UPLOADS an artifact, and bare `binary`/`chmod`
+// near a healthcheck wget is Dockerfile housekeeping, not an installer.
+const UPDATER_TRUST_PATTERN =
+  /\b(?:repoUrl|updateUrl|UpdateApp|InstallApp|auto.?updater?|installer|curl(?!\s+(?:-T\b|--upload-file\b))|wget)\b[\s\S]{0,250}(?:\.(?:zip|exe|dmg|appimage|msi|deb|rpm)\b|\.tar\.gz\b|\|\s*(?:bash|sh)\b)/i;
+
+// A download whose hash is checked before use is exactly what the rule's
+// recommendation asks for.
+const CHECKSUM_VERIFICATION_PATTERN =
+  /sha(?:256|512|1)sum|--checksum|checksum=|EXPECTED_SHA|gpg\s+--verify|\.sha(?:256|512)\b/i;
+
+// Source files that only DISPLAY install commands (docs components, snippet
+// generators) never execute them; require a process-execution surface.
+const EXECUTION_CONTEXT_PATTERN =
+  /\b(?:child_process|childProcess|execa|os\.system|subprocess\.|Deno\.run|autoUpdater|electron-updater)\b|\b(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)\s*\(/;
+
+export const pluginUpdateTrustRisk = defineRule({
+  id: "plugin-update-trust-risk",
+  title: "Plugin or updater trust boundary risk",
+  severity: "warn",
+  recommendation:
+    "Require signed updates/plugins, pin trusted repositories, verify hashes before execution, and keep custom repository installs behind explicit warnings.",
+  scan: (file) => {
+    if (!isProductionSourcePath(file.relativePath) && !isConfigOrCiPath(file.relativePath)) {
+      return [];
+    }
+    const content = getScannableContent(file);
+    if (!UPDATER_TRUST_PATTERN.test(content)) return [];
+    if (CHECKSUM_VERIFICATION_PATTERN.test(content)) return [];
+    if (SOURCE_FILE_PATTERN.test(file.relativePath) && !EXECUTION_CONTEXT_PATTERN.test(content)) {
+      return [];
+    }
+    const location = getMatchLocation(content, UPDATER_TRUST_PATTERN);
+    return [
+      {
+        message:
+          "Code appears to download, install, update, or execute plugin/updater content across a trust boundary.",
+        line: location.line,
+        column: location.column,
+      },
+    ];
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/postmessage-origin-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/postmessage-origin-risk.regressions.test.ts
new file mode 100644
index 000000000..a06fb7aae
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/postmessage-origin-risk.regressions.test.ts
@@ -0,0 +1,116 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { postmessageOriginRisk } from "./postmessage-origin-risk.js";
+
+describe("security-scan/postmessage-origin-risk — regressions", () => {
+  it("flags a message listener that reads event.data without an origin check", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/widget.ts",
+      content: `window.addEventListener("message", (event) => {\n  handleCommand(event.data);\n});\n`,
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.message).toBe(
+      "A message event handler reads cross-window messages without an obvious origin check.",
+    );
+    expect(findings[0]?.line).toBe(1);
+    // No per-finding overrides: severity/title come from the rule metadata.
+    expect(findings[0]?.severity).toBeUndefined();
+    expect(findings[0]?.title).toBeUndefined();
+  });
+
+  it("stays silent when the handler validates event.origin before reading event.data", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/widget.ts",
+      content: `window.addEventListener("message", (event) => {\n  if (event.origin !== "https://trusted.example.com") return;\n  handleCommand(event.data);\n});\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent when origin validation lives in a called helper", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/widget.ts",
+      content: `window.addEventListener("message", (event) => {\n  if (!isAllowedOrigin(event)) return;\n  handleCommand(event.data);\n});\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent when the handler never reads event.data", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/widget.ts",
+      content: `window.addEventListener("message", () => {\n  refreshBadge();\n});\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on MessagePort and worker channels", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/widget.ts",
+      content: `channel.port1.onmessage = (event) => {\n  handleCommand(event.data);\n};\nworker.addEventListener("message", (event) => {\n  applyResult(event.data);\n});\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on worker-global self.onmessage handlers", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/subset/subset-chunk.ts",
+      content: `self.onmessage = async (e) => {\n  process(e.data.arrayBuffer);\n};\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent in worker-named files", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/fonts/subset-worker.chunk.ts",
+      content: `globalThis.addEventListener("message", (event) => {\n  process(event.data);\n});\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on non-production source paths even with the vulnerable shape", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/__tests__/widget.test.ts",
+      content: `window.addEventListener("message", (event) => {\n  handleCommand(event.data);\n});\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on EventSource message handlers", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/dev-toolbar-context.tsx",
+      content: `const eventSource = new EventSource(streamUrl);\neventSource.onmessage = (event) => {\n  appendEvent(JSON.parse(event.data));\n};\neventSource.addEventListener("message", (event) => {\n  appendEvent(JSON.parse(event.data));\n});\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on WebSocket message handlers", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/editor/comments.tsx",
+      content: `socket?.addEventListener("message", function (event) {\n  if (event.data === "threads") fetchData();\n});\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("treats event.source comparisons as a sender check", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/widgets/custom-widget-script.ts",
+      content: `window.addEventListener("message", (event) => {\n  if (event.source === window.parent) {\n    handlerList.forEach((handler) => handler(event.data));\n  }\n});\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on camelCase BroadcastChannel receivers", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/auth-state.ts",
+      content: `const tokenChannel = new BroadcastChannel("auth_token");\ntokenChannel.onmessage = (event) => {\n  applyToken(event.data.token);\n};\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on server-sent-event sources named source", () => {
+    const findings = runScanRule(postmessageOriginRisk, {
+      relativePath: "src/context/event-stream-context.tsx",
+      content: `const source = new EventSource("/api/events");\nsource.addEventListener("message", async (e) => {\n  dispatch(JSON.parse(e.data));\n});\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/postmessage-origin-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/postmessage-origin-risk.ts
new file mode 100644
index 000000000..2eaa93d79
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/postmessage-origin-risk.ts
@@ -0,0 +1,98 @@
+import { defineRule } from "../../utils/define-rule.js";
+import type { EsTreeNode } from "../../utils/es-tree-node.js";
+import type { ScanFinding } from "../../utils/file-scan.js";
+import { isAstNode } from "../../utils/is-ast-node.js";
+import { parseSourceText } from "../../utils/parse-source-file.js";
+import { walkAst } from "../../utils/walk-ast.js";
+import { getLocationAtIndex } from "./utils/get-location-at-index.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+
+// Any reference to an origin counts as a check: validation frequently lives
+// in a called helper (`isTrustedOrigin(event)`) or a destructured binding.
+// Substring match (not \b) so camelCase helper names count; `(?!al)` keeps
+// `original` from counting. `event.source ===` comparisons against a known
+// window are an equivalent sender check.
+const POSTMESSAGE_ORIGIN_CHECK_PATTERN = /origin(?!al)|\.source\s*[!=]==?/i;
+
+const MESSAGE_DATA_READ_PATTERN = /\b(?:event|e|evt|msg|message)\.data\b/;
+
+// MessagePort/Worker/BroadcastChannel/EventSource/WebSocket message events
+// are same-application or server-stream channels; window-origin checks
+// neither exist nor apply there. `self.onmessage` is the worker-global
+// handler idiom. Substring match (no left \b) so camelCase receivers like
+// `tokenChannel.onmessage` count; `^source\.` is the EventSource idiom.
+const SAME_APPLICATION_CHANNEL_TARGET_PATTERN =
+  /port\d?\b|worker|channel|broadcast|socket|\bws\b|\bsse\b|eventsource|^self\.|^source\./i;
+
+const WORKER_FILE_PATH_PATTERN = /worker/i;
+
+// oxc's parseSync emits ESTree byte offsets as `start`/`end` (it never
+// populates `range`), which TSESTree's types don't declare — so read
+// them structurally.
+const getNodeStartIndex = (node: EsTreeNode): number =>
+  "start" in node && typeof node.start === "number" ? node.start : -1;
+
+const getNodeText = (content: string, node: EsTreeNode): string => {
+  const startIndex = getNodeStartIndex(node);
+  const endIndex = "end" in node && typeof node.end === "number" ? node.end : -1;
+  if (startIndex < 0 || endIndex < 0) return "";
+  return content.slice(startIndex, endIndex);
+};
+
+// Returns the listener target (the `window.addEventListener` callee text or
+// the `window.onmessage` assignment target) when `node` registers a message
+// handler, and null otherwise.
+const getMessageHandlerTarget = (content: string, node: EsTreeNode): string | null => {
+  if (node.type === "CallExpression") {
+    const calleeText = isAstNode(node.callee) ? getNodeText(content, node.callee) : "";
+    if (!calleeText.endsWith("addEventListener")) return null;
+    const firstArgument = node.arguments[0];
+    const isMessageEvent =
+      isAstNode(firstArgument) &&
+      firstArgument.type === "Literal" &&
+      firstArgument.value === "message";
+    return isMessageEvent ? calleeText : null;
+  }
+  if (node.type === "AssignmentExpression" && isAstNode(node.left)) {
+    const leftText = getNodeText(content, node.left);
+    return leftText.endsWith(".onmessage") ? leftText : null;
+  }
+  return null;
+};
+
+export const postmessageOriginRisk = defineRule({
+  id: "postmessage-origin-risk",
+  title: "postMessage handler without origin check",
+  severity: "warn",
+  recommendation:
+    "Validate `event.origin` against an exact allowlist before using `event.data`, especially when an iframe or parent window can be attacker-controlled.",
+  scan: (file) => {
+    if (!isProductionSourcePath(file.relativePath)) return [];
+    if (WORKER_FILE_PATH_PATTERN.test(file.relativePath)) return [];
+    const ast = parseSourceText(file.absolutePath, file.content);
+    if (ast === null) return [];
+
+    const findings: ScanFinding[] = [];
+    walkAst(ast, (node) => {
+      const targetText = getMessageHandlerTarget(file.content, node);
+      if (targetText === null) return;
+      if (SAME_APPLICATION_CHANNEL_TARGET_PATTERN.test(targetText)) return;
+
+      const nodeText = getNodeText(file.content, node);
+      const messageDataIndex = nodeText.search(MESSAGE_DATA_READ_PATTERN);
+      if (messageDataIndex < 0) return;
+      const originCheckIndex = nodeText.search(POSTMESSAGE_ORIGIN_CHECK_PATTERN);
+      if (originCheckIndex >= 0 && originCheckIndex < messageDataIndex) return;
+
+      const location = getLocationAtIndex(file.content, getNodeStartIndex(node));
+      findings.push({
+        message:
+          "A message event handler reads cross-window messages without an obvious origin check.",
+        line: location.line,
+        column: location.column,
+      });
+    });
+
+    return findings;
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-debug-artifact.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-debug-artifact.regressions.test.ts
new file mode 100644
index 000000000..157b0bd14
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-debug-artifact.regressions.test.ts
@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { publicDebugArtifact } from "./public-debug-artifact.js";
+
+describe("security-scan/public-debug-artifact — regressions", () => {
+  it("flags a browser-reachable debug log at the rule's default severity", () => {
+    const findings = runScanRule(publicDebugArtifact, {
+      relativePath: "public/debug.log",
+      content: "request failed: GET /internal/admin 500\n",
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.message).toBe(
+      "A browser-reachable debug, log, dump, report, or env artifact is present.",
+    );
+    // No severity override — the finding inherits the rule's "warn".
+    expect(findings[0]?.severity).toBeUndefined();
+    expect(publicDebugArtifact.severity).toBe("warn");
+  });
+
+  it('escalates to "error" via the per-finding override when the artifact carries a secret', () => {
+    const findings = runScanRule(publicDebugArtifact, {
+      relativePath: "public/debug.log",
+      content: "auth token: ghp_abcdefghijklmnopqrstuvwxyz0123456789\n",
+    });
+    expect(findings).toHaveLength(1);
+    expect(findings[0]?.severity).toBe("error");
+  });
+
+  it("stays silent on the same content outside a browser-reachable debug path", () => {
+    const findings = runScanRule(publicDebugArtifact, {
+      relativePath: "logs/debug.log",
+      content: "auth token: ghp_abcdefghijklmnopqrstuvwxyz0123456789\n",
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on locale bundles whose filenames echo debug nouns (signoz trace.json shape)", () => {
+    const findings = runScanRule(publicDebugArtifact, {
+      relativePath: "public/locales/en-GB/traceDetails.json",
+      content: `{ "title": "Trace details", "spans": "Spans" }\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-debug-artifact.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-debug-artifact.ts
new file mode 100644
index 000000000..eff30d342
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-debug-artifact.ts
@@ -0,0 +1,25 @@
+import { SECRET_VALUE_PATTERNS } from "../../constants/security.js";
+import { defineRule } from "../../utils/define-rule.js";
+import type { ScanFinding } from "../../utils/file-scan.js";
+import { isPublicDebugArtifactPath } from "./utils/is-public-debug-artifact-path.js";
+
+export const publicDebugArtifact = defineRule({
+  id: "public-debug-artifact",
+  title: "Public debug artifact",
+  severity: "warn",
+  recommendation:
+    "Remove debug artifacts from public output; logs and dumps often reveal source paths, internal routes, tokens, or environment snapshots.",
+  scan: (file) => {
+    if (!isPublicDebugArtifactPath(file.relativePath)) return [];
+    // The finding is about the file existing at a public path, so there is
+    // no content match to anchor to — whole-file findings sit at 1:1.
+    const finding: ScanFinding = {
+      message: "A browser-reachable debug, log, dump, report, or env artifact is present.",
+      line: 1,
+      column: 1,
+    };
+    // Secret-bearing debug artifacts escalate over the rule's default "warn".
+    const hasSecretValue = SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(file.content));
+    return [hasSecretValue ? { ...finding, severity: "error" } : finding];
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-env-secret-name.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-env-secret-name.regressions.test.ts
new file mode 100644
index 000000000..ddc4521cf
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-env-secret-name.regressions.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { publicEnvSecretName } from "./public-env-secret-name.js";
+
+describe("security-scan/public-env-secret-name — regressions", () => {
+  it("flags a secret-named public env variable", () => {
+    const findings = runScanRule(publicEnvSecretName, {
+      relativePath: "src/lib/identity.ts",
+      content: `export const pylonSecret = import.meta.env.VITE_PYLON_IDENTITY_SECRET;\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on publishable posthog tokens", () => {
+    const findings = runScanRule(publicEnvSecretName, {
+      relativePath: "src/lib/analytics.ts",
+      content: `const posthog = new PostHog(process.env.VITE_PUBLIC_POSTHOG_TOKEN!, { host: "https://us.posthog.com" });\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on snippets under a docs tree", () => {
+    const findings = runScanRule(publicEnvSecretName, {
+      relativePath: "docs/onboarding/feature-flags/react-router.tsx",
+      content: `const client = createClient(process.env.VITE_PUBLIC_LICENSE_SECRET);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-env-secret-name.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-env-secret-name.ts
new file mode 100644
index 000000000..0923ff905
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/public-env-secret-name.ts
@@ -0,0 +1,31 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { findSuspiciousPublicEnvSecretNamePattern } from "./utils/find-suspicious-public-env-secret-name.js";
+import { getMatchLocation } from "./utils/get-match-location.js";
+import { isClientSourcePath } from "./utils/is-client-source-path.js";
+
+// Source files under a docs tree are onboarding snippets, not shipped code.
+const DOCS_DIRECTORY_PATTERN = /(?:^|\/)docs?\//i;
+
+export const publicEnvSecretName = defineRule({
+  id: "public-env-secret-name",
+  title: "Secret-like public env variable",
+  severity: "warn",
+  recommendation:
+    "Public env prefixes are inlined into browser bundles. Rename public values to non-secret names, and keep tokens, passwords, private keys, and service-role credentials server-only.",
+  scan: (file) => {
+    if (!isClientSourcePath(file.relativePath)) return [];
+    if (DOCS_DIRECTORY_PATTERN.test(file.relativePath)) return [];
+    const pattern = findSuspiciousPublicEnvSecretNamePattern(file.content);
+    if (pattern === undefined) return [];
+
+    const location = getMatchLocation(file.content, pattern);
+    return [
+      {
+        message:
+          "Client code references a public env variable whose name looks like a secret or privileged credential.",
+        line: location.line,
+        column: location.column,
+      },
+    ];
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/raw-sql-injection-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/raw-sql-injection-risk.regressions.test.ts
new file mode 100644
index 000000000..00089b022
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/raw-sql-injection-risk.regressions.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { rawSqlInjectionRisk } from "./raw-sql-injection-risk.js";
+
+describe("security-scan/raw-sql-injection-risk — regressions", () => {
+  it("stays silent on Prisma.raw with a pure string literal", () => {
+    const findings = runScanRule(rawSqlInjectionRisk, {
+      relativePath: "src/server/filter-to-prisma.ts",
+      content: `return Prisma.join([Prisma.raw("AND "), sql], "");\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on whereRaw with driver-side parameter binding", () => {
+    const findings = runScanRule(rawSqlInjectionRisk, {
+      relativePath: "src/server/services/sessions.ts",
+      content: `builder\n  .whereRaw("e.session_id = {sessionId: String}", { sessionId: props.sessionId })\n  .whereRaw("e.is_deleted = 0");\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent when query interpolations are wrapped in a sanitizer", () => {
+    const findings = runScanRule(rawSqlInjectionRisk, {
+      relativePath: "src/crm/service.ts",
+      content:
+        "const result = await conn.query(`SELECT Id FROM User WHERE Email = '${this.sanitizeSoqlValue(email)}' LIMIT 1`);\n",
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags queryRawUnsafe escape hatches", () => {
+    const findings = runScanRule(rawSqlInjectionRisk, {
+      relativePath: "src/raw-sql.ts",
+      content:
+        "export const q = (prisma, id) => prisma.$queryRawUnsafe(`SELECT * FROM users WHERE id = '${id}'`);\n",
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("flags Prisma.raw built from interpolation", () => {
+    const findings = runScanRule(rawSqlInjectionRisk, {
+      relativePath: "src/server/order-by.ts",
+      content: "return Prisma.raw(`ORDER BY ${column} ${direction}`);\n",
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("flags whereRaw built from interpolation", () => {
+    const findings = runScanRule(rawSqlInjectionRisk, {
+      relativePath: "src/server/query.ts",
+      content: "builder.whereRaw(`tenant_id = '${tenantId}'`);\n",
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on parameterized whereRaw whose literal starts on the next line", () => {
+    const findings = runScanRule(rawSqlInjectionRisk, {
+      relativePath: "src/server/repositories/events.ts",
+      content:
+        'queryBuilder.whereRaw(\n  "e.span_id IN (SELECT span_id FROM qualifying_obs WHERE _rn = {_posRn: UInt32})",\n  { _posRn: Math.max(1, position) },\n);\n',
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/raw-sql-injection-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/raw-sql-injection-risk.ts
new file mode 100644
index 000000000..d5f11a4b9
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/raw-sql-injection-risk.ts
@@ -0,0 +1,36 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isProductionScriptSourcePath } from "./utils/is-production-script-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+// `Prisma.raw("AND ")` (pure literal) and `whereRaw("col = {p: String}", {p})`
+// (driver-side binding) are parameterized usage, not string-built SQL — the
+// escape hatch only matters when the argument is dynamic. The `${` check
+// skips interpolations wrapped in a sanitizer/escaper call.
+const RAW_SQL_RISK_PATTERNS = [
+  /\$queryRawUnsafe\s*\(/,
+  /\$executeRawUnsafe\s*\(/,
+  /\bPrisma\.raw\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,
+  /\bsql\.\s*(?:raw|unsafe)\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,
+  /\b(?:client|pool|conn)\.query\s*\(\s*['"`]\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^)]{0,400}\$\{(?!\s*[\w$.]*(?:sanitiz|escape|quote)[\w$]*\s*\()/i,
+  /\.query\s*\(\s*['"`][^'"`]{0,200}['"`]\s*\+/,
+  /\.(?:where|orderBy|having)Raw\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,
+  /\bcursor\.execute\s*\(\s*f['"]/,
+  /\bcursor\.execute\s*\(\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*(?:%|\.format\s*\(|\+)/,
+  /\b(?:engine|session)\.execute\s*\(\s*(?:text\s*\(\s*)?f['"]/,
+  /\$[\w]+->(?:query|exec|prepare|executeQuery|executeStatement|createQuery|createNativeQuery)\s*\(\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*\.\s*\$/,
+  /mysqli_query\s*\(\s*[^,]+,\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*\.\s*\$/,
+] as const;
+
+export const rawSqlInjectionRisk = defineRule({
+  id: "raw-sql-injection-risk",
+  title: "Raw SQL built outside parameter binding",
+  severity: "warn",
+  recommendation:
+    "Keep user input in driver parameters or ORM bind variables. Avoid unsafe/raw SQL helpers and string interpolation for queries.",
+  scan: scanByPattern({
+    shouldScan: (file) => isProductionScriptSourcePath(file.relativePath),
+    pattern: RAW_SQL_RISK_PATTERNS,
+    message:
+      "Code uses a raw SQL escape hatch or string-built query shape that can bypass parameter binding.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/repository-secret-file.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/repository-secret-file.regressions.test.ts
new file mode 100644
index 000000000..842540c6d
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/repository-secret-file.regressions.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { repositorySecretFile } from "./repository-secret-file.js";
+
+describe("security-scan/repository-secret-file — regressions", () => {
+  it("stays silent on .env.template and .env.sample files", () => {
+    for (const relativePath of [".env.template", ".env.sample", "projects/app/.env.template"]) {
+      const findings = runScanRule(repositorySecretFile, {
+        relativePath,
+        content: `MONGODB_URI="mongodb://myusername:mypassword@localhost:27017/app"\n`,
+      });
+      expect(findings).toHaveLength(0);
+    }
+  });
+
+  it("stays silent on placeholder connection-string credentials in dev env files", () => {
+    const findings = runScanRule(repositorySecretFile, {
+      relativePath: ".env.development",
+      content: `DATABASE_URL=postgres://user:pass@127.0.0.1:5432/outline\nREDIS_URL=redis://127.0.0.1:6379\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on same-word default credentials", () => {
+    const findings = runScanRule(repositorySecretFile, {
+      relativePath: ".env",
+      content: `DATABASE_URL=postgres://postgres:postgres@localhost:5433/oasst_web\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("still flags realistic connection-string credentials", () => {
+    const findings = runScanRule(repositorySecretFile, {
+      relativePath: ".env",
+      content: `DATABASE_URL=postgres://app_prod:N7v!q2mXfA9z@db.internal.example.com:5432/app\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/repository-secret-file.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/repository-secret-file.ts
new file mode 100644
index 000000000..f8ce47db3
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/repository-secret-file.ts
@@ -0,0 +1,38 @@
+import { TEST_CONTEXT_PATTERN } from "../../constants/security-scan.js";
+import { SECRET_VALUE_PATTERNS } from "../../constants/security.js";
+import { defineRule } from "../../utils/define-rule.js";
+import { findSuspiciousPublicEnvSecretNamePattern } from "./utils/find-suspicious-public-env-secret-name.js";
+import { getMatchLocation } from "./utils/get-match-location.js";
+import { isRepositorySecretFilePath } from "./utils/is-repository-secret-file-path.js";
+
+const isRepositorySecretExamplePath = (relativePath: string): boolean =>
+  /(?:^|\/)\.env\.(?:example|sample|template|dist|defaults?)$|(?:^|\/)[^/]*(?:example|sample|template)[^/]*\.(?:env|json|pem|key)$/i.test(
+    relativePath,
+  );
+
+export const repositorySecretFile = defineRule({
+  id: "repository-secret-file",
+  title: "Secret file checked into repository",
+  severity: "error",
+  recommendation:
+    "Remove committed env files, service-account credentials, npm auth tokens, and webhook URLs; rotate exposed values and keep only redacted examples in source.",
+  scan: (file) => {
+    if (!isRepositorySecretFilePath(file.relativePath)) return [];
+    if (isRepositorySecretExamplePath(file.relativePath)) return [];
+    if (TEST_CONTEXT_PATTERN.test(file.relativePath)) return [];
+
+    const pattern =
+      SECRET_VALUE_PATTERNS.find((candidate) => candidate.test(file.content)) ??
+      findSuspiciousPublicEnvSecretNamePattern(file.content);
+    if (pattern === undefined) return [];
+
+    const location = getMatchLocation(file.content, pattern);
+    return [
+      {
+        message: "A repository credential/config file contains secret-looking values.",
+        line: location.line,
+        column: location.column,
+      },
+    ];
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/supabase-client-owned-authz-field.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/supabase-client-owned-authz-field.ts
new file mode 100644
index 000000000..ca0cf04f2
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/supabase-client-owned-authz-field.ts
@@ -0,0 +1,24 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isClientSourcePath } from "./utils/is-client-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+const SENSITIVE_AUTH_FIELD_PATTERN =
+  /\b(?:ownerId|ownerID|creatorId|creatorID|userId|userID|uid|providerId|providerID|orgId|orgID|tenantId|tenantID|teamId|teamID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin|admin)\b/;
+
+const SUPABASE_CLIENT_AUTHZ_WRITE_PATTERN =
+  /\b(?:supabase\b|\.from\s*\(\s*["'][^"']+["']\s*\))[\s\S]{0,700}\b(?:insert|upsert|update)\s*\(\s*(?:\{|\[?\s*\{)[\s\S]{0,700}\b(?:ownerId|creatorId|userId|orgId|tenantId|role|isAdmin)\b/i;
+
+export const supabaseClientOwnedAuthzField = defineRule({
+  id: "supabase-client-owned-authz-field",
+  title: "Client writes Supabase authorization field",
+  severity: "error",
+  recommendation:
+    "Use RLS policies based on `auth.uid()` and server-owned membership rows; do not trust client-provided owner, org, or role columns.",
+  scan: scanByPattern({
+    shouldScan: (file) => isClientSourcePath(file.relativePath),
+    pattern: SENSITIVE_AUTH_FIELD_PATTERN,
+    requireAll: [SUPABASE_CLIENT_AUTHZ_WRITE_PATTERN],
+    message:
+      "Client Supabase code appears to write user, tenant, owner, or role fields that should be enforced by RLS.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/supabase-rls-policy-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/supabase-rls-policy-risk.ts
new file mode 100644
index 000000000..328c5bb13
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/supabase-rls-policy-risk.ts
@@ -0,0 +1,33 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isSqlPath } from "./utils/is-sql-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+const DISABLED_RLS_PATTERN = /disable\s+row\s+level\s+security/i;
+
+const SERVICE_ROLE_POLICY_PATTERN =
+  /create\s+policy[\s\S]{0,700}auth\.role\(\)\s*=\s*["']service_role["']/i;
+
+const OPEN_WRITE_POLICY_PATTERN =
+  /create\s+policy[\s\S]{0,700}\bfor\s+(?:all|insert|update|delete)\b[\s\S]{0,500}\b(?:using|with\s+check)\s*\(\s*true\s*\)/i;
+
+const IMPLICIT_OPEN_POLICY_PATTERN =
+  /create\s+policy(?:(?!\bfor\s+select\b)[\s\S]){0,700}\b(?:using|with\s+check)\s*\(\s*true\s*\)/i;
+
+export const supabaseRlsPolicyRisk = defineRule({
+  id: "supabase-rls-policy-risk",
+  title: "Permissive Supabase RLS policy",
+  severity: "error",
+  recommendation:
+    "Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",
+  scan: scanByPattern({
+    shouldScan: (file) => isSqlPath(file.relativePath),
+    pattern: [
+      DISABLED_RLS_PATTERN,
+      SERVICE_ROLE_POLICY_PATTERN,
+      OPEN_WRITE_POLICY_PATTERN,
+      IMPLICIT_OPEN_POLICY_PATTERN,
+    ],
+    message:
+      "Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/svg-filter-clickjacking-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/svg-filter-clickjacking-risk.ts
new file mode 100644
index 000000000..92f68723a
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/svg-filter-clickjacking-risk.ts
@@ -0,0 +1,18 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+export const svgFilterClickjackingRisk = defineRule({
+  id: "svg-filter-clickjacking-risk",
+  title: "SVG-filtered iframe clickjacking primitive",
+  severity: "warn",
+  recommendation:
+    "Avoid filtering cross-origin iframes. Use `frame-ancestors` on sensitive pages and keep SVG filters away from embedded privileged UI.",
+  scan: scanByPattern({
+    shouldScan: (file) => isProductionSourcePath(file.relativePath),
+    pattern:
+      /<iframe\b[\s\S]{0,700}\bfilter\s*:\s*["']?url\(#|filter\s*:\s*url\(#.*[\s\S]{0,700}<iframe\b|<fe(?:DisplacementMap|ColorMatrix|Composite|Tile|Morphology)\b[\s\S]{0,700}<iframe\b/i,
+    message:
+      "An iframe is rendered through an SVG/CSS filter, which can support advanced clickjacking or visual exfiltration tricks.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/tenant-static-proxy-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/tenant-static-proxy-risk.regressions.test.ts
new file mode 100644
index 000000000..ca427d3b1
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/tenant-static-proxy-risk.regressions.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { tenantStaticProxyRisk } from "./tenant-static-proxy-risk.js";
+
+describe("security-scan/tenant-static-proxy-risk — regressions", () => {
+  it("stays silent on OAuth callbacks that build a params object near a token fetch", () => {
+    const findings = runScanRule(tenantStaticProxyRisk, {
+      relativePath: "packages/app-store/zohocalendar/api/callback.ts",
+      content: `const params = {\n  client_id,\n  grant_type: "authorization_code",\n  client_secret,\n  redirect_uri: \`\${WEBAPP_URL}/api/integrations/\${config.slug}/callback\`,\n  code,\n};\nconst tokenResponse = await fetch(\`https://accounts.zoho.com/oauth/v2/token?\${stringify(params)}\`);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on route handlers that pass request params to an API call", () => {
+    const findings = runScanRule(tenantStaticProxyRisk, {
+      relativePath: "app/api/users/route.ts",
+      content: `export async function GET(request, { params }) {\n  const response = await fetch("/api/users", { method: "POST", body: JSON.stringify(params) });\n  return response;\n}\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags asset fetches whose path interpolates a tenant identifier", () => {
+    const findings = runScanRule(tenantStaticProxyRisk, {
+      relativePath: "app/api/static/route.ts",
+      content:
+        "export const GET = async (request) => fetch(`${CDN_BASE}/${tenant}/${assetPath}`);\n",
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("flags asset path joins built from tenant input", () => {
+    const findings = runScanRule(tenantStaticProxyRisk, {
+      relativePath: "server/routes/assets.ts",
+      content: `export const resolveAssetPath = (subdomain, assetName) =>\n  path.join(STATIC_ROOT, subdomain, assetName);\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on local path joins of workspace-prefixed data (insomnia shape)", () => {
+    const findings = runScanRule(tenantStaticProxyRisk, {
+      relativePath: "src/routes/import.ts",
+      content: `const fullPath = window.path.join(workspaceData.folderPath, workspaceData.fileName);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/tenant-static-proxy-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/tenant-static-proxy-risk.ts
new file mode 100644
index 000000000..17587ae25
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/tenant-static-proxy-risk.ts
@@ -0,0 +1,21 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isServerRouteSourcePath } from "./utils/is-server-route-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+export const tenantStaticProxyRisk = defineRule({
+  id: "tenant-static-proxy-risk",
+  title: "Tenant-controlled static asset proxy",
+  severity: "warn",
+  recommendation:
+    "Bind tenant identity to the trusted host or authenticated org, canonicalize after decoding, reject traversal, and never let one tenant choose another tenant's asset prefix.",
+  // `params` near `fetch` matched every dynamic route handler; the tenant
+  // identifier must sit inside the asset-fetch call's own argument list.
+  // `(?<!\.)org` keeps `.org` domain literals from counting.
+  scan: scanByPattern({
+    shouldScan: (file) => isServerRouteSourcePath(file.relativePath),
+    pattern:
+      /\b(?:fetch|path\.join|getObject\w*|GetObjectCommand|getSignedUrl|createReadStream)\s*\([^;]{0,200}(?:\$\{[^}]{0,100}\b(?:tenant|subdomain|workspace|hostPattern|(?<!\.)organization(?:Id|Slug)?)\b|\b(?:tenant|subdomain|workspace)(?:Id|Slug|Name)?\b\s*[,)+\].])/i,
+    message:
+      "Route code appears to compose tenant or subdomain input into a static/CDN/object-store fetch path.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/untrusted-redirect-following.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/untrusted-redirect-following.regressions.test.ts
new file mode 100644
index 000000000..3cf579442
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/untrusted-redirect-following.regressions.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { untrustedRedirectFollowing } from "./untrusted-redirect-following.js";
+
+describe("security-scan/untrusted-redirect-following — regressions", () => {
+  it("stays silent when a url variable is built from internal config", () => {
+    const findings = runScanRule(untrustedRedirectFollowing, {
+      relativePath: "server/routers/admin/create-coupon.ts",
+      content: `const url = \`\${LICENSE_API_BASE}/v1/coupons\`;\nreturn await fetch(url, { method: "POST", headers, body: JSON.stringify(body) });\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on generic fetch wrappers that accept a url parameter", () => {
+    const findings = runScanRule(untrustedRedirectFollowing, {
+      relativePath: "src/lib/api/fetch-with-timeout.ts",
+      content: `export async function fetchWithTimeout(url, init, options) {\n  const response = await fetch(url, { ...init, signal: controller.signal });\n  return response;\n}\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on Durable Object stub fetches of the inbound request url", () => {
+    const findings = runScanRule(untrustedRedirectFollowing, {
+      relativePath: "worker/routes/stream.ts",
+      content: `const durableObjectStub = env.AGENT_DURABLE_OBJECT.get(id);\nconst response = await durableObjectStub.fetch(request.url, { method: "POST" });\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags fetches of a url read directly from the request", () => {
+    const findings = runScanRule(untrustedRedirectFollowing, {
+      relativePath: "app/api/preview/route.ts",
+      content: `export const GET = (request) => fetch(request.nextUrl.searchParams.get("url"));\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("flags fetches of a url destructured from the request body", () => {
+    const findings = runScanRule(untrustedRedirectFollowing, {
+      relativePath: "app/api/preview/route.ts",
+      content: `export const POST = async (request) => {\n  const { imageUrl } = await request.json();\n  return fetch(imageUrl);\n};\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent when the request-sourced fetch disables redirect following", () => {
+    const findings = runScanRule(untrustedRedirectFollowing, {
+      relativePath: "app/api/preview/route.ts",
+      content: `export const POST = async (request) => {\n  const { imageUrl } = await request.json();\n  return fetch(imageUrl, { redirect: "manual" });\n};\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/untrusted-redirect-following.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/untrusted-redirect-following.ts
new file mode 100644
index 000000000..edcca0e6d
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/untrusted-redirect-following.ts
@@ -0,0 +1,63 @@
+import { defineRule } from "../../utils/define-rule.js";
+import type { ScanFinding } from "../../utils/file-scan.js";
+import { isServerRouteSourcePath } from "./utils/is-server-route-source-path.js";
+
+// `(?<![.\w$])fetch` keeps method fetches (Durable Object stubs, service
+// bindings, `this.fetch`) out — those are same-application proxies.
+const OUTBOUND_FETCH_CALL_PATTERN =
+  /(?:(?<![.\w$])fetch|\baxios\.\s*(?:get|post|put|delete|head)|\bgot|\bgot\.\s*(?:get|post))\s*\(\s*([^,)]+)/;
+
+const CALLER_STYLE_URL_NAME_PATTERN =
+  /\b(?:url|targetUrl|callbackUrl|redirectUrl|webhookUrl|companyUrl|websiteUrl|domainUrl|imageUrl|fetchUrl|next|return_to|returnTo|destination|location)\b/i;
+
+const REQUEST_INPUT_EXPRESSION_PATTERN =
+  /\breq\.|\brequest\.(?:query|body|params|nextUrl)|\bsearchParams\b|\bparams\.|\bbody\.|\bquery\./;
+
+const SAFE_REDIRECT_MODE_PATTERN = /\bredirect\s*:\s*["'](?:manual|error)["']/;
+
+// A variable merely NAMED `url` is not caller input; the URL expression (or
+// the same-file assignment that produced it) must read from the request.
+const isRequestSourcedUrlExpression = (urlExpression: string, fileContent: string): boolean => {
+  if (REQUEST_INPUT_EXPRESSION_PATTERN.test(urlExpression)) return true;
+  const identifierMatch = /^[\w$]+$/.exec(urlExpression.trim());
+  if (identifierMatch === null) return false;
+  // `[^=;\n]{0,80}` on both sides of the name covers plain declarations and
+  // destructuring (`const { imageUrl } = await request.json()`).
+  const assignmentPattern = new RegExp(
+    `(?:const|let|var)[^=;\\n]{0,80}\\b${identifierMatch[0]}\\b[^=;\\n]{0,80}=[^;\\n]*(?:\\breq\\.|\\brequest\\.|\\bsearchParams\\b|\\bparams\\.|\\bbody\\.|\\bquery\\.|\\$_(?:GET|POST|REQUEST))`,
+  );
+  return assignmentPattern.test(fileContent);
+};
+
+export const untrustedRedirectFollowing = defineRule({
+  id: "untrusted-redirect-following",
+  title: "Server fetch follows redirects for caller-shaped URL",
+  severity: "warn",
+  recommendation:
+    'Use `redirect: "manual"` or equivalent and re-validate every redirect target before following it to avoid SSRF redirect bypasses.',
+  scan: (file) => {
+    if (!isServerRouteSourcePath(file.relativePath)) return [];
+    if (!OUTBOUND_FETCH_CALL_PATTERN.test(file.content)) return [];
+
+    const findings: ScanFinding[] = [];
+    const lines = file.content.split("\n");
+    for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+      const line = lines[lineIndex] ?? "";
+      const fetchMatch = line.match(OUTBOUND_FETCH_CALL_PATTERN);
+      const urlExpression = fetchMatch?.[1] ?? "";
+      if (!fetchMatch || !CALLER_STYLE_URL_NAME_PATTERN.test(urlExpression)) continue;
+      if (!isRequestSourcedUrlExpression(urlExpression, file.content)) continue;
+
+      const fetchWindow = lines.slice(lineIndex, lineIndex + 5).join("\n");
+      if (SAFE_REDIRECT_MODE_PATTERN.test(fetchWindow)) continue;
+
+      findings.push({
+        message:
+          "Server-side fetch code appears to follow redirects for a URL shaped like caller-controlled input.",
+        line: lineIndex + 1,
+        column: line.search(/\S/) + 1,
+      });
+    }
+    return findings;
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/url-prefilled-privileged-action.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/url-prefilled-privileged-action.regressions.test.ts
new file mode 100644
index 000000000..2a537a154
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/url-prefilled-privileged-action.regressions.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { urlPrefilledPrivilegedAction } from "./url-prefilled-privileged-action.js";
+
+describe("security-scan/url-prefilled-privileged-action — regressions", () => {
+  it("stays silent when searchParams merely coexists with next/* imports and user words", () => {
+    const findings = runScanRule(urlPrefilledPrivilegedAction, {
+      relativePath: "src/app/bookings/page.tsx",
+      content: `import { useSearchParams } from "next/navigation";\nimport { useUser } from "@/hooks/use-user";\n\nexport default function Page({ searchParams }: PageProps) {\n  return buildMetadata(searchParams);\n}\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("flags reading a privileged role parameter from the URL", () => {
+    const findings = runScanRule(urlPrefilledPrivilegedAction, {
+      relativePath: "src/app/invite/page.tsx",
+      content: `const searchParams = useSearchParams();\nconst invitedRole = searchParams.get("role");\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("flags a privileged property read off Next.js searchParams", () => {
+    const findings = runScanRule(urlPrefilledPrivilegedAction, {
+      relativePath: "src/app/team/page.tsx",
+      content: `export default function Page({ searchParams }: PageProps) {\n  prefillInvite(searchParams.userstoinvite);\n  return null;\n}\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent when the read is wrapped in a validating helper (posthog getRelativeNextPath shape)", () => {
+    const findings = runScanRule(urlPrefilledPrivilegedAction, {
+      relativePath: "src/scenes/organization/confirmOrganizationLogic.ts",
+      content: `const nextUrl = getRelativeNextPath(new URLSearchParams(location.search).get('next'), location);\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/url-prefilled-privileged-action.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/url-prefilled-privileged-action.ts
new file mode 100644
index 000000000..c15bee39e
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/url-prefilled-privileged-action.ts
@@ -0,0 +1,25 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isClientSourcePath } from "./utils/is-client-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+// The privileged name must be the parameter actually read — a proximity
+// window matches `from "next/..."` imports and any file mentioning users.
+// No `email`/`user`: prefilled emails and username route params are benign
+// booking/contact UX, not privileged actions. The lookbehind skips reads
+// already wrapped in a validating helper (`getRelativeNextPath(...get("next"))`).
+const PRIVILEGED_QUERY_PARAM_PATTERN =
+  /(?<!(?:safe|valid|sanitiz|relativ|allowlist|whitelist)[\w$]*\(\s*(?:new\s+)?)\b(?:searchParams|useSearchParams\s*\(\s*\)|URLSearchParams\s*\([^)]{0,120}\))(?:[?!])?\.get(?:All)?\s*\(\s*["'](?:userstoinvite|role|permission|sharingaction|invite|admin|next|continue|returnTo|redirect_uri|callbackUrl)["']|\bsearchParams\.(?:userstoinvite|role|permission|sharingaction|invite|admin|returnTo|redirect_uri|callbackUrl)\b/i;
+
+export const urlPrefilledPrivilegedAction = defineRule({
+  id: "url-prefilled-privileged-action",
+  title: "URL pre-fills a privileged action",
+  severity: "warn",
+  recommendation:
+    "Require server-side validation and explicit confirmation for URL-sourced invite, role, permission, redirect, or sharing parameters.",
+  scan: scanByPattern({
+    shouldScan: (file) => isClientSourcePath(file.relativePath),
+    pattern: PRIVILEGED_QUERY_PARAM_PATTERN,
+    message:
+      "Client code reads sensitive action state from the URL, which can pre-fill invites, roles, redirects, or sharing flows with attacker values.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/classify-security-scan-file.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/classify-security-scan-file.ts
new file mode 100644
index 000000000..23123f663
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/classify-security-scan-file.ts
@@ -0,0 +1,49 @@
+import { GENERATED_BUNDLE_FILE_PATTERN } from "../../../constants/security-scan.js";
+import { isBrowserArtifactPath } from "./is-browser-artifact-path.js";
+import { isConfigOrCiPath } from "./is-config-or-ci-path.js";
+import { isFirebaseRulesPath } from "./is-firebase-rules-path.js";
+import { isProbablyTextFile } from "./is-probably-text-file.js";
+import { isRepositorySecretFilePath } from "./is-repository-secret-file-path.js";
+import { isSqlPath } from "./is-sql-path.js";
+
+// `isGeneratedBundleByName` is the filename-only bundle test; the walker
+// still content-sniffs minified files afterwards before choosing the
+// larger bundle size cap, so the two signals must stay separate.
+export interface SecurityScanFileClassification {
+  readonly bucket: "priority" | "artifact" | "other";
+  readonly isGeneratedBundleByName: boolean;
+}
+
+// Pure path classification (no fs) used by the security-scan walker to
+// order files priority → artifact → other and apply per-bucket file caps.
+// Returns null for paths the scan never reads.
+export const classifySecurityScanFile = (
+  relativePath: string,
+): SecurityScanFileClassification | null => {
+  const isGeneratedBundleByName = GENERATED_BUNDLE_FILE_PATTERN.test(relativePath);
+  if (
+    isRepositorySecretFilePath(relativePath) ||
+    isSqlPath(relativePath) ||
+    isFirebaseRulesPath(relativePath) ||
+    isConfigOrCiPath(relativePath)
+  ) {
+    return { bucket: "priority", isGeneratedBundleByName };
+  }
+  if (isBrowserArtifactPath(relativePath, isGeneratedBundleByName)) {
+    return { bucket: "artifact", isGeneratedBundleByName };
+  }
+  if (isProbablyTextFile(relativePath)) return { bucket: "other", isGeneratedBundleByName };
+  return null;
+};
+
+// Read gate the walker applies after the size caps: generated bundles are
+// always read; everything else must look like text, config/CI, or a
+// repository secret file.
+export const shouldReadSecurityScanContent = (
+  relativePath: string,
+  isGeneratedBundle: boolean,
+): boolean =>
+  isGeneratedBundle ||
+  isProbablyTextFile(relativePath) ||
+  isConfigOrCiPath(relativePath) ||
+  isRepositorySecretFilePath(relativePath);
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/escape-reg-exp.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/escape-reg-exp.ts
new file mode 100644
index 000000000..a0f78f468
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/escape-reg-exp.ts
@@ -0,0 +1 @@
+export const escapeRegExp = (value: string): string => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/find-suspicious-public-env-secret-name.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/find-suspicious-public-env-secret-name.ts
new file mode 100644
index 000000000..e3f55f1f5
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/find-suspicious-public-env-secret-name.ts
@@ -0,0 +1,18 @@
+import {
+  PUBLIC_ENV_SECRET_NAME_PATTERN,
+  TRUSTED_PUBLIC_SECRET_NAME_PATTERN,
+} from "../../../constants/security.js";
+import { escapeRegExp } from "./escape-reg-exp.js";
+
+// Returns a RegExp matching the first suspicious name so callers can
+// locate the finding in the file content; `undefined` when every
+// public-prefixed env name in the content is a trusted/publishable one.
+export const findSuspiciousPublicEnvSecretNamePattern = (content: string): RegExp | undefined => {
+  for (const match of content.matchAll(new RegExp(PUBLIC_ENV_SECRET_NAME_PATTERN.source, "gi"))) {
+    const value = match[0] ?? "";
+    if (!TRUSTED_PUBLIC_SECRET_NAME_PATTERN.test(value)) {
+      return new RegExp(escapeRegExp(value));
+    }
+  }
+  return undefined;
+};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/get-location-at-index.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/get-location-at-index.ts
new file mode 100644
index 000000000..4d4953091
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/get-location-at-index.ts
@@ -0,0 +1,15 @@
+export interface SourceLocation {
+  readonly line: number;
+  readonly column: number;
+}
+
+// O(content) per call — memoizing line offsets is a tracked follow-up.
+export const getLocationAtIndex = (content: string, matchIndex: number): SourceLocation => {
+  if (matchIndex < 0) return { line: 1, column: 1 };
+  const prefix = content.slice(0, matchIndex);
+  const lines = prefix.split(/\r?\n/);
+  return {
+    line: lines.length,
+    column: (lines[lines.length - 1]?.length ?? 0) + 1,
+  };
+};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/get-match-location.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/get-match-location.ts
new file mode 100644
index 000000000..0caef463a
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/get-match-location.ts
@@ -0,0 +1,5 @@
+import type { SourceLocation } from "./get-location-at-index.js";
+import { getLocationAtIndex } from "./get-location-at-index.js";
+
+export const getMatchLocation = (content: string, pattern: RegExp): SourceLocation =>
+  getLocationAtIndex(content, content.search(pattern));
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/has-full-env-leak-shape.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/has-full-env-leak-shape.ts
new file mode 100644
index 000000000..e52519e9c
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/has-full-env-leak-shape.ts
@@ -0,0 +1,7 @@
+import {
+  FULL_ENV_LEAK_CONTEXT_PATTERN,
+  FULL_ENV_LEAK_SECRET_NAME_PATTERN,
+} from "../../../constants/security.js";
+
+export const hasFullEnvLeakShape = (content: string): boolean =>
+  FULL_ENV_LEAK_CONTEXT_PATTERN.test(content) && FULL_ENV_LEAK_SECRET_NAME_PATTERN.test(content);
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-browser-artifact-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-browser-artifact-path.ts
new file mode 100644
index 000000000..681df46a1
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-browser-artifact-path.ts
@@ -0,0 +1,14 @@
+import { BROWSER_ARTIFACT_PATH_PATTERNS } from "../../../constants/security-scan.js";
+
+const isServerOnlyBuildArtifactPath = (relativePath: string): boolean =>
+  /(?:^|\/)(?:\.next\/server|\.output\/server)\//.test(relativePath);
+
+export const isBrowserArtifactPath = (
+  relativePath: string,
+  isGeneratedBundle: boolean,
+): boolean => {
+  if (isServerOnlyBuildArtifactPath(relativePath)) return false;
+  if (isGeneratedBundle) return true;
+  if (relativePath.endsWith(".map")) return true;
+  return BROWSER_ARTIFACT_PATH_PATTERNS.some((pattern) => pattern.test(relativePath));
+};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-client-source-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-client-source-path.ts
new file mode 100644
index 000000000..858b6f095
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-client-source-path.ts
@@ -0,0 +1,8 @@
+import { SERVER_CONTEXT_PATTERN } from "../../../constants/security-scan.js";
+import { isProductionSourcePath } from "./is-production-source-path.js";
+
+export const isClientSourcePath = (relativePath: string): boolean => {
+  if (!isProductionSourcePath(relativePath)) return false;
+  if (SERVER_CONTEXT_PATTERN.test(relativePath)) return false;
+  return true;
+};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-config-or-ci-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-config-or-ci-path.ts
new file mode 100644
index 000000000..af144d985
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-config-or-ci-path.ts
@@ -0,0 +1,4 @@
+export const isConfigOrCiPath = (relativePath: string): boolean =>
+  /(?:^|\/)(?:package\.json|Dockerfile|docker-compose\.ya?ml|\.github\/workflows\/[^/]+\.ya?ml|vercel\.json|next\.config\.[cm]?[jt]s|netlify\.toml)$/i.test(
+    relativePath,
+  );
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-dev-tooling-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-dev-tooling-path.ts
new file mode 100644
index 000000000..e56b4964f
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-dev-tooling-path.ts
@@ -0,0 +1,7 @@
+// Repo tooling (release scripts, Django management commands, build entry
+// points) takes its input from argv and config, not web callers — request-
+// shaped taint heuristics misread their f-strings and path joins.
+export const isDevToolingPath = (relativePath: string): boolean =>
+  /(?:^|\/)(?:tools?|scripts?)\/|(?:^|\/)management\/commands\/|(?:^|\/)(?:build|make|gulpfile|gruntfile)\.[cm]?[jt]s$/i.test(
+    relativePath,
+  );
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-firebase-rules-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-firebase-rules-path.ts
new file mode 100644
index 000000000..35541be76
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-firebase-rules-path.ts
@@ -0,0 +1,2 @@
+export const isFirebaseRulesPath = (relativePath: string): boolean =>
+  /(?:^|\/)(?:firestore\.rules|storage\.rules|database\.rules\.json)$/.test(relativePath);
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-probably-text-file.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-probably-text-file.ts
new file mode 100644
index 000000000..382e2e87e
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-probably-text-file.ts
@@ -0,0 +1,4 @@
+import { DOTENV_FILE_PATTERN, TEXT_FILE_PATTERN } from "../../../constants/security-scan.js";
+
+export const isProbablyTextFile = (relativePath: string): boolean =>
+  TEXT_FILE_PATTERN.test(relativePath) || DOTENV_FILE_PATTERN.test(relativePath);
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-production-file-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-production-file-path.ts
new file mode 100644
index 000000000..0327af0fe
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-production-file-path.ts
@@ -0,0 +1,15 @@
+import {
+  BUILD_SCRIPT_CONTEXT_PATTERN,
+  DOCUMENTATION_CONTEXT_PATTERN,
+  GENERATED_SOURCE_CONTEXT_PATTERN,
+  TEST_CONTEXT_PATTERN,
+} from "../../../constants/security-scan.js";
+
+export const isProductionFilePath = (relativePath: string, sourceFilePattern: RegExp): boolean => {
+  if (!sourceFilePattern.test(relativePath)) return false;
+  if (TEST_CONTEXT_PATTERN.test(relativePath)) return false;
+  if (BUILD_SCRIPT_CONTEXT_PATTERN.test(relativePath)) return false;
+  if (DOCUMENTATION_CONTEXT_PATTERN.test(relativePath)) return false;
+  if (GENERATED_SOURCE_CONTEXT_PATTERN.test(relativePath)) return false;
+  return true;
+};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-production-script-source-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-production-script-source-path.ts
new file mode 100644
index 000000000..52a22448d
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-production-script-source-path.ts
@@ -0,0 +1,5 @@
+import { SCRIPT_SOURCE_FILE_PATTERN } from "../../../constants/security-scan.js";
+import { isProductionFilePath } from "./is-production-file-path.js";
+
+export const isProductionScriptSourcePath = (relativePath: string): boolean =>
+  isProductionFilePath(relativePath, SCRIPT_SOURCE_FILE_PATTERN);
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-production-source-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-production-source-path.ts
new file mode 100644
index 000000000..bc4d5c5d9
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-production-source-path.ts
@@ -0,0 +1,6 @@
+import { SOURCE_FILE_PATTERN } from "../../../constants/security-scan.js";
+import { isProductionFilePath } from "./is-production-file-path.js";
+
+export const isProductionSourcePath = (relativePath: string): boolean => {
+  return isProductionFilePath(relativePath, SOURCE_FILE_PATTERN);
+};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-public-debug-artifact-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-public-debug-artifact-path.ts
new file mode 100644
index 000000000..ffe167b75
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-public-debug-artifact-path.ts
@@ -0,0 +1,13 @@
+import { GENERATED_BUNDLE_FILE_PATTERN } from "../../../constants/security-scan.js";
+import { isBrowserArtifactPath } from "./is-browser-artifact-path.js";
+
+// Locale bundles (`public/locales/en/trace.json`) are translations whose
+// FILENAMES echo product nouns like "trace"/"report", not debug dumps.
+const LOCALE_DIRECTORY_PATTERN = /(?:^|\/)(?:locales?|i18n|lang|langs|translations?)\//i;
+
+export const isPublicDebugArtifactPath = (relativePath: string): boolean =>
+  isBrowserArtifactPath(relativePath, GENERATED_BUNDLE_FILE_PATTERN.test(relativePath)) &&
+  !LOCALE_DIRECTORY_PATTERN.test(relativePath) &&
+  /(?:^|\/)(?:\.env(?:\.[^/]*)?|[^/]*(?:debug|crash|trace|stack|report|dump|phpinfo)[^/]*\.(?:txt|log|json|html?)|[^/]+\.log)$/i.test(
+    relativePath,
+  );
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-repository-secret-file-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-repository-secret-file-path.ts
new file mode 100644
index 000000000..ab892f496
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-repository-secret-file-path.ts
@@ -0,0 +1,8 @@
+import { DOTENV_FILE_PATTERN } from "../../../constants/security-scan.js";
+
+export const isRepositorySecretFilePath = (relativePath: string): boolean =>
+  DOTENV_FILE_PATTERN.test(relativePath) ||
+  /(?:^|\/)\.npmrc$/.test(relativePath) ||
+  /(?:^|\/)[^/]*(?:credential|credentials|service-account|serviceAccount|firebase-admin|google-service-account|gcp-service-account)[^/]*\.(?:json|env|pem|key)$/i.test(
+    relativePath,
+  );
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-server-route-source-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-server-route-source-path.ts
new file mode 100644
index 000000000..10a6ad732
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-server-route-source-path.ts
@@ -0,0 +1,8 @@
+import { SERVER_CONTEXT_PATTERN } from "../../../constants/security-scan.js";
+import { isProductionSourcePath } from "./is-production-source-path.js";
+
+export const isServerRouteSourcePath = (relativePath: string): boolean => {
+  if (!isProductionSourcePath(relativePath)) return false;
+  if (SERVER_CONTEXT_PATTERN.test(relativePath)) return true;
+  return /(?:^|\/)(?:middleware|route)\.[cm]?[jt]sx?$/.test(relativePath);
+};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-sql-path.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-sql-path.ts
new file mode 100644
index 000000000..3cbeb3554
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/is-sql-path.ts
@@ -0,0 +1,2 @@
+export const isSqlPath = (relativePath: string): boolean =>
+  relativePath.endsWith(".sql") || /(?:^|\/)supabase\/(?:migrations|schemas)\//.test(relativePath);
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/scan-artifact-leak.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/scan-artifact-leak.ts
new file mode 100644
index 000000000..9e9ea5f1d
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/scan-artifact-leak.ts
@@ -0,0 +1,22 @@
+import { DOCUMENTATION_CONTEXT_PATTERN } from "../../../constants/security-scan.js";
+import type { ScanFinding, ScannedFile } from "../../../utils/file-scan.js";
+import { getMatchLocation } from "./get-match-location.js";
+import { isBrowserArtifactPath } from "./is-browser-artifact-path.js";
+
+// Shared by `artifact-secret-leak` and `artifact-env-leak`: both gate on
+// the same browser-artifact path test and report one finding at the first
+// match of whatever leak pattern the rule detects in the content.
+// Generated API-reference markdown can carry single lines long enough to
+// trip the bundle sniffer, but documentation is not a shipped artifact.
+export const scanArtifactLeak = (
+  file: ScannedFile,
+  findLeakPattern: (content: string) => RegExp | undefined,
+  message: string,
+): ScanFinding[] => {
+  if (DOCUMENTATION_CONTEXT_PATTERN.test(file.relativePath)) return [];
+  if (!isBrowserArtifactPath(file.relativePath, file.isGeneratedBundle)) return [];
+  const leakPattern = findLeakPattern(file.content);
+  if (leakPattern === undefined) return [];
+  const location = getMatchLocation(file.content, leakPattern);
+  return [{ message, line: location.line, column: location.column }];
+};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/scan-by-pattern.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/scan-by-pattern.ts
new file mode 100644
index 000000000..ef524c34e
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/scan-by-pattern.ts
@@ -0,0 +1,48 @@
+import { SOURCE_FILE_PATTERN } from "../../../constants/security-scan.js";
+import type { FileScan, ScannedFile } from "../../../utils/file-scan.js";
+import { getMatchLocation } from "./get-match-location.js";
+import { stripCommentsPreservingPositions } from "./strip-comments-preserving-positions.js";
+
+export interface ScanByPatternInput {
+  readonly shouldScan: (file: ScannedFile) => boolean;
+  // One pattern, or a disjunction tried in order — the first pattern that
+  // matches the file content locates the finding.
+  readonly pattern: RegExp | ReadonlyArray<RegExp>;
+  // Conjunction gates: every pattern must also match somewhere in the file
+  // (e.g. an MCP import that proves the matched tool surface is MCP).
+  readonly requireAll?: ReadonlyArray<RegExp>;
+  // Veto: a match anywhere in the file suppresses the finding (e.g. a
+  // signature-verification call that answers the rule's concern).
+  readonly suppressWhen?: RegExp;
+  readonly message: string;
+}
+
+const strippedContentCache = new WeakMap<ScannedFile, string>();
+
+// Comments are a recurring false-positive source ("Ajv compiles schemas via
+// `new Function(...)`"); blank them for JS/TS files before pattern matching.
+// Stripping preserves offsets, so reported lines/columns stay correct.
+export const getScannableContent = (file: ScannedFile): string => {
+  if (!SOURCE_FILE_PATTERN.test(file.relativePath)) return file.content;
+  const cachedContent = strippedContentCache.get(file);
+  if (cachedContent !== undefined) return cachedContent;
+  const strippedContent = stripCommentsPreservingPositions(file.content);
+  strippedContentCache.set(file, strippedContent);
+  return strippedContent;
+};
+
+export const scanByPattern =
+  ({ shouldScan, pattern, requireAll, suppressWhen, message }: ScanByPatternInput): FileScan =>
+  (file) => {
+    if (!shouldScan(file)) return [];
+    const content = getScannableContent(file);
+    if (requireAll !== undefined && !requireAll.every((gate) => gate.test(content))) {
+      return [];
+    }
+    const patterns = pattern instanceof RegExp ? [pattern] : pattern;
+    const matchedPattern = patterns.find((candidate) => candidate.test(content));
+    if (matchedPattern === undefined) return [];
+    if (suppressWhen !== undefined && suppressWhen.test(content)) return [];
+    const { line, column } = getMatchLocation(content, matchedPattern);
+    return [{ message, line, column }];
+  };
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/strip-comments-preserving-positions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/strip-comments-preserving-positions.test.ts
new file mode 100644
index 000000000..adbc5a708
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/strip-comments-preserving-positions.test.ts
@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vite-plus/test";
+import { stripCommentsPreservingPositions } from "./strip-comments-preserving-positions.js";
+
+describe("security-scan/utils/strip-comments-preserving-positions", () => {
+  it("blanks line comments while preserving offsets and newlines", () => {
+    const stripped = stripCommentsPreservingPositions(
+      "const a = 1; // new Function(x)\nconst b = 2;",
+    );
+    expect(stripped).toHaveLength("const a = 1; // new Function(x)\nconst b = 2;".length);
+    expect(stripped).not.toContain("new Function");
+    expect(stripped.split("\n")[1]).toBe("const b = 2;");
+  });
+
+  it("blanks block comments but keeps their newlines", () => {
+    const stripped = stripCommentsPreservingPositions(
+      "/* eval(\n  payload\n) */\nconst safe = true;",
+    );
+    expect(stripped).not.toContain("eval");
+    expect(stripped.split("\n")).toHaveLength(4);
+  });
+
+  it("keeps https:// URLs inside string literals intact", () => {
+    const source = `const endpoint = "https://example.com/api"; // trailing note`;
+    const stripped = stripCommentsPreservingPositions(source);
+    expect(stripped).toContain("https://example.com/api");
+    expect(stripped).not.toContain("trailing note");
+  });
+
+  it("does not treat // inside template literals as a comment", () => {
+    const source = "const url = `https://example.com/${path}`;";
+    expect(stripCommentsPreservingPositions(source)).toBe(source);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/strip-comments-preserving-positions.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/strip-comments-preserving-positions.ts
new file mode 100644
index 000000000..ea594edfc
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/utils/strip-comments-preserving-positions.ts
@@ -0,0 +1,56 @@
+// Pattern scans repeatedly match keyword pairs inside comments ("Ajv compiles
+// schemas via `new Function(...)`", JSX comments mentioning redirects). This
+// blanks comment text with spaces so every match index, line, and column in
+// the stripped content still maps 1:1 onto the original file.
+export const stripCommentsPreservingPositions = (content: string): string => {
+  const characters = content.split("");
+  let stringDelimiter: string | null = null;
+  let index = 0;
+
+  while (index < content.length) {
+    const character = content[index];
+    const nextCharacter = content[index + 1];
+
+    if (stringDelimiter !== null) {
+      if (character === "\\") {
+        index += 2;
+        continue;
+      }
+      if (character === stringDelimiter) stringDelimiter = null;
+      index += 1;
+      continue;
+    }
+
+    if (character === '"' || character === "'" || character === "`") {
+      stringDelimiter = character;
+      index += 1;
+      continue;
+    }
+
+    if (character === "/" && nextCharacter === "/") {
+      while (index < content.length && content[index] !== "\n") {
+        characters[index] = " ";
+        index += 1;
+      }
+      continue;
+    }
+
+    if (character === "/" && nextCharacter === "*") {
+      while (index < content.length) {
+        if (content[index] === "*" && content[index + 1] === "/") {
+          characters[index] = " ";
+          characters[index + 1] = " ";
+          index += 2;
+          break;
+        }
+        if (content[index] !== "\n") characters[index] = " ";
+        index += 1;
+      }
+      continue;
+    }
+
+    index += 1;
+  }
+
+  return characters.join("");
+};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/webhook-signature-risk.regressions.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/webhook-signature-risk.regressions.test.ts
new file mode 100644
index 000000000..cb07ba1d9
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/webhook-signature-risk.regressions.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runScanRule } from "../../../test-utils/run-scan-rule.js";
+import { webhookSignatureRisk } from "./webhook-signature-risk.js";
+
+describe("security-scan/webhook-signature-risk — regressions", () => {
+  it("flags an inbound webhook handler with no verification", () => {
+    const findings = runScanRule(webhookSignatureRisk, {
+      relativePath: "src/app/api/webhooks/github/route.ts",
+      content: `export async function POST(request: Request) {\n  const event = await request.json();\n  await applyEvent(event);\n  return Response.json({ ok: true });\n}\n`,
+    });
+    expect(findings).toHaveLength(1);
+  });
+
+  it("stays silent on outbound webhook-URL forwarding (twenty partner-application shape)", () => {
+    const findings = runScanRule(webhookSignatureRisk, {
+      relativePath: "src/app/api/partner-application/route.ts",
+      content: `const webhookUrlSchema = z.string().pipe(z.httpUrl({ error: "Invalid webhook URL." }));\nexport async function POST(request: Request) {\n  const webhookUrlResult = webhookUrlSchema.safeParse(process.env.PARTNER_APPLICATION_WEBHOOK_URL);\n  if (!webhookUrlResult.success) {\n    return Response.json({ error: "Partner application webhook is not configured." });\n  }\n  await fetch(webhookUrlResult.data, { method: "POST", body: await request.text() });\n  return Response.json({ ok: true });\n}\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+
+  it("stays silent on bare handler re-exports (langfuse stripe-webhook shape)", () => {
+    const findings = runScanRule(webhookSignatureRisk, {
+      relativePath: "src/app/api/billing/stripe-webhook/route.ts",
+      content: `import { stripeWebhookHandler } from "@/src/ee/features/billing/stripeWebhookHandler";\n\nexport const POST = stripeWebhookHandler;\n`,
+    });
+    expect(findings).toHaveLength(0);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/webhook-signature-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/webhook-signature-risk.ts
new file mode 100644
index 000000000..669f16eaa
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/webhook-signature-risk.ts
@@ -0,0 +1,57 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isProductionSourcePath } from "./utils/is-production-source-path.js";
+import { scanByPattern } from "./utils/scan-by-pattern.js";
+
+const WEBHOOK_HANDLER_PATTERN =
+  /(?:^|\/)[^/]*webhook[^/]*\/|(?:^|\/)[^/]*webhook[^/]*\.[cm]?[jt]s$|\bwebhook\b/i;
+
+const WEBHOOK_ENTRYPOINT_PATTERN =
+  /\b(?:export\s+(?:async\s+)?function\s+POST|export\s+const\s+(?:POST|handler|webhook)|webhookHandler|webhookRoute)\b/i;
+
+// Reading a `*-signature` header or delegating to a `verifyWebhook*` helper
+// is verification evidence even when the HMAC math lives in another module.
+const WEBHOOK_SIGNATURE_VERIFICATION_PATTERN =
+  /verifySignature|verify.*signature|verify\w*(?:Webhook|Auth)|constructEvent|createHmac|timingSafeEqual|svix|webhookSecret|stripe\.webhooks|["'][\w-]*signature["']/i;
+
+// `webhookUrl` mentions mark code SENDING to a webhook (outbound), where
+// signature verification is the receiver's job, not this file's. A webhook
+// URL read from the file's own env or a `sendToDiscordWebhook(...)` call is
+// likewise an outbound destination.
+const OUTBOUND_WEBHOOK_URL_MENTION_PATTERN = /webhook[\s_-]?ur[il]\w*/gi;
+
+const OUTBOUND_WEBHOOK_CONFIG_PATTERN =
+  /process\.env\.\w*WEBHOOK_URL|\b(?:send|post|dispatch|publish|notify)\w*Webhook/;
+
+// `export const POST = stripeWebhookHandler;` re-exports a handler defined
+// elsewhere — there is no body in this file to judge for verification.
+const REQUEST_READ_PATTERN = /\b(?:req|request)\b/;
+
+// "webhook" appearing only in comments or string literals (retry-behavior
+// notes, prompt text) does not make the file a webhook handler.
+const COMMENT_OR_STRING_PATTERN =
+  /\/\/[^\n]*|\/\*[\s\S]*?\*\/|"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`(?:\\.|[^`\\])*`/g;
+
+export const webhookSignatureRisk = defineRule({
+  id: "webhook-signature-risk",
+  title: "Webhook handler lacks signature verification",
+  severity: "warn",
+  recommendation:
+    "Verify provider signatures before parsing or acting on webhook bodies. Use provider SDK helpers or HMAC verification with timing-safe comparison.",
+  scan: scanByPattern({
+    shouldScan: (file) => {
+      if (!isProductionSourcePath(file.relativePath)) return false;
+      if (OUTBOUND_WEBHOOK_CONFIG_PATTERN.test(file.content)) return false;
+      const judgeableContent = file.content
+        .replace(COMMENT_OR_STRING_PATTERN, "")
+        .replace(OUTBOUND_WEBHOOK_URL_MENTION_PATTERN, "");
+      return (
+        WEBHOOK_HANDLER_PATTERN.test(file.relativePath) ||
+        WEBHOOK_HANDLER_PATTERN.test(judgeableContent)
+      );
+    },
+    pattern: WEBHOOK_ENTRYPOINT_PATTERN,
+    requireAll: [REQUEST_READ_PATTERN],
+    suppressWhen: WEBHOOK_SIGNATURE_VERIFICATION_PATTERN,
+    message: "Webhook handler code does not show an obvious signature verification step.",
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security/no-eval.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security/no-eval.ts
index a8c2f00c1..ef89f52df 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security/no-eval.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security/no-eval.ts
@@ -1,10 +1,9 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noEval = defineRule<Rule>({
+export const noEval = defineRule({
   id: "no-eval",
   title: "eval() runs untrusted code strings",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security/no-secrets-in-client-code.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security/no-secrets-in-client-code.ts
index 46ef97a7e..97d5cd6d5 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security/no-secrets-in-client-code.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security/no-secrets-in-client-code.ts
@@ -12,7 +12,6 @@ import { classifySecretFileExposure } from "../../utils/classify-secret-file-exp
 import { enclosingComponentOrHookName } from "../../utils/enclosing-component-or-hook-name.js";
 import { getIdentifierTrailingWord } from "../../utils/get-identifier-trailing-word.js";
 import { getReactDoctorStringSetting } from "../../utils/get-react-doctor-setting.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { hasDirective } from "../../utils/has-directive.js";
 import { isInsideServerOnlyScope } from "../../utils/is-inside-server-only-scope.js";
@@ -20,7 +19,7 @@ import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isPlaceholderSecretValue } from "../../utils/is-placeholder-secret-value.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noSecretsInClientCode = defineRule<Rule>({
+export const noSecretsInClientCode = defineRule({
   id: "no-secrets-in-client-code",
   title: "Secret in client code",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-after-nonblocking.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-after-nonblocking.ts
index 4ec10b6e7..bbf26e925 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-after-nonblocking.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-after-nonblocking.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { hasDirective } from "../../utils/has-directive.js";
 import { hasUseServerDirective } from "../../utils/has-use-server-directive.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -44,7 +43,7 @@ const isDeferrableSideEffectCall = (objectName: string, methodName: string): boo
   return false;
 };
 
-export const serverAfterNonblocking = defineRule<Rule>({
+export const serverAfterNonblocking = defineRule({
   id: "server-after-nonblocking",
   title: "Blocking side effect before response",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-auth-actions.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-auth-actions.ts
index 2c25a7af9..4173e3be2 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-auth-actions.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-auth-actions.ts
@@ -11,7 +11,6 @@ import { hasUseServerDirective } from "../../utils/has-use-server-directive.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -202,7 +201,7 @@ const getCandidateFromDefaultDeclaration = (
   };
 };
 
-export const serverAuthActions = defineRule<Rule>({
+export const serverAuthActions = defineRule({
   id: "server-auth-actions",
   title: "Unauthenticated server action can be called directly",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-cache-with-object-literal.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-cache-with-object-literal.ts
index 103c478bf..ba85a1be2 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-cache-with-object-literal.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-cache-with-object-literal.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -10,7 +9,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // distinct argument objects per render, so the cache never hits and the
 // underlying fetch runs twice per request. Pass primitives (or memoize
 // the argument object once at module/route scope).
-export const serverCacheWithObjectLiteral = defineRule<Rule>({
+export const serverCacheWithObjectLiteral = defineRule({
   id: "server-cache-with-object-literal",
   title: "React.cache with object literal",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-dedup-props.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-dedup-props.ts
index addb6da31..2ce60e0d8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-dedup-props.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-dedup-props.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { getRootIdentifierName } from "../../utils/get-root-identifier-name.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -20,7 +19,7 @@ const getDerivingMethodName = (node: EsTreeNode): string | null => {
 // React serializes across the RSC wire. The client gets two copies of
 // roughly the same array; one of the props is redundant. Have the
 // client derive what it needs from the single source prop instead.
-export const serverDedupProps = defineRule<Rule>({
+export const serverDedupProps = defineRule({
   id: "server-dedup-props",
   title: "Duplicate data in server props",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-fetch-without-revalidate.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-fetch-without-revalidate.ts
index 908b90445..25efa905d 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-fetch-without-revalidate.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-fetch-without-revalidate.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -57,7 +56,7 @@ const APP_ROUTER_FILE_PATTERN = new RegExp(
 
 const NON_PROJECT_PATH_PATTERN = /\/(?:node_modules|dist|build|\.next)\//;
 
-export const serverFetchWithoutRevalidate = defineRule<Rule>({
+export const serverFetchWithoutRevalidate = defineRule({
   id: "server-fetch-without-revalidate",
   title: "Fetch without revalidate",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-hoist-static-io.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-hoist-static-io.ts
index 87005199e..4d55bc296 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-hoist-static-io.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-hoist-static-io.ts
@@ -3,7 +3,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -118,7 +117,7 @@ const collectIdentifierParams = (params: EsTreeNode[]): Set<string> => {
 // catch BOTH App Router (`export async function GET/POST/...` in
 // `app/.../route.ts`) and Pages Router (`export default async function
 // handler(req, res)` in `pages/api/...`).
-export const serverHoistStaticIo = defineRule<Rule>({
+export const serverHoistStaticIo = defineRule({
   id: "server-hoist-static-io",
   title: "Static file read on every request",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-no-mutable-module-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-no-mutable-module-state.ts
index 3dce35fdb..16382e97f 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-no-mutable-module-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-no-mutable-module-state.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { hasDirective } from "../../utils/has-directive.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -28,7 +27,7 @@ const isMutableConstInitializer = (init: EsTreeNode | null | undefined): string
 // and serverless cold-starts produce inconsistent state. Per-request data
 // must live inside the action, in headers/cookies, or in a request scope
 // (React.cache, AsyncLocalStorage, etc.).
-export const serverNoMutableModuleState = defineRule<Rule>({
+export const serverNoMutableModuleState = defineRule({
   id: "server-no-mutable-module-state",
   title: "Mutable module state on the server",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-sequential-independent-await.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-sequential-independent-await.ts
index e40b45a84..14ef8f3f8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-sequential-independent-await.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/server/server-sequential-independent-await.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 
@@ -60,7 +59,7 @@ const declarationReadsAnyName = (declaration: EsTreeNode, names: Set<string>): b
   return didRead;
 };
 
-export const serverSequentialIndependentAwait = defineRule<Rule>({
+export const serverSequentialIndependentAwait = defineRule({
   id: "server-sequential-independent-await",
   title: "Sequential independent awaits",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/activity-wraps-effect-heavy-subtree.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/activity-wraps-effect-heavy-subtree.ts
index 79577448e..6db1fe900 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/activity-wraps-effect-heavy-subtree.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/activity-wraps-effect-heavy-subtree.ts
@@ -4,7 +4,6 @@ import { findProgramRoot } from "../../utils/find-program-root.js";
 import { getImportedName } from "../../utils/get-imported-name.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { walkAst } from "../../utils/walk-ast.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -96,7 +95,7 @@ const countEffectHookCalls = (body: EsTreeNode | null): number => {
   return count;
 };
 
-export const activityWrapsEffectHeavySubtree = defineRule<Rule>({
+export const activityWrapsEffectHeavySubtree = defineRule({
   id: "activity-wraps-effect-heavy-subtree",
   title: "Activity wraps an effect-heavy subtree",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/advanced-event-handler-refs.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/advanced-event-handler-refs.ts
index 779eafabf..c43849211 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/advanced-event-handler-refs.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/advanced-event-handler-refs.ts
@@ -4,7 +4,6 @@ import { getEffectCallback } from "../../utils/get-effect-callback.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -27,7 +26,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // so this rule and `prefer-use-sync-external-store` agree on what
 // counts as a subscription-shaped call (zustand/Redux `subscribe`,
 // browser `addEventListener`, EventEmitter `on`, etc.).
-export const advancedEventHandlerRefs = defineRule<Rule>({
+export const advancedEventHandlerRefs = defineRule({
   id: "advanced-event-handler-refs",
   title: "Listener re-subscribes on every handler change",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/effect-needs-cleanup.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/effect-needs-cleanup.ts
index bf275ec6c..8addbf755 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/effect-needs-cleanup.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/effect-needs-cleanup.ts
@@ -6,7 +6,6 @@ import { isHookCall } from "../../utils/is-hook-call.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import { walkInsideStatementBlocks } from "../../utils/walk-inside-statement-blocks.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import {
   isCleanupReturningSubscribeLikeCallExpression,
@@ -210,7 +209,7 @@ const effectHasCleanupReturn = (
   return didFindCleanupReturn;
 };
 
-export const effectNeedsCleanup = defineRule<Rule>({
+export const effectNeedsCleanup = defineRule({
   id: "effect-needs-cleanup",
   title: "Effect subscription or timer never cleaned up",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/hooks-no-nan-in-deps.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/hooks-no-nan-in-deps.ts
index 84e1f346c..210809382 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/hooks-no-nan-in-deps.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/hooks-no-nan-in-deps.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { getCalleeName } from "../../utils/get-callee-name.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 
 // Hooks whose tail (or trailing) argument is an explicit dependency array.
 // Notably excludes `@preact/signals`'s `useSignalEffect(callback)` — it
@@ -58,7 +57,7 @@ const isNanLiteral = (node: EsTreeNode): boolean => {
 // `useSignalEffect` is intentionally excluded: its signature is
 // `useSignalEffect(callback)` with no deps argument; signal reads
 // inside the callback auto-track, so there's no array to inspect.
-export const hooksNoNanInDeps = defineRule<Rule>({
+export const hooksNoNanInDeps = defineRule({
   id: "hooks-no-nan-in-deps",
   title: "NaN in a hook dependency array",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-adjust-state-on-prop-change.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-adjust-state-on-prop-change.ts
index 06b2d406c..27aabe223 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-adjust-state-on-prop-change.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-adjust-state-on-prop-change.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getArgsUpstreamRefs, getCallExpr, getUpstreamRefs } from "./utils/effect/ast.js";
 import { getProgramAnalysis } from "./utils/effect/get-program-analysis.js";
@@ -17,7 +16,7 @@ import {
 // (severity and message intentionally diverge — see SOURCE.md).
 // Note: upstream does NOT skip on cleanup return.
 
-export const noAdjustStateOnPropChange = defineRule<Rule>({
+export const noAdjustStateOnPropChange = defineRule({
   id: "no-adjust-state-on-prop-change",
   title: "State synced to a prop inside an effect",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-cascading-set-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-cascading-set-state.ts
index 8767f27b0..e8e4691e8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-cascading-set-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-cascading-set-state.ts
@@ -7,7 +7,6 @@ import { isHookCall } from "../../utils/is-hook-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isSetterCall } from "../../utils/is-setter-call.js";
 import { isUseStateSetterInScope } from "../../utils/is-use-state-setter-in-scope.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
@@ -143,7 +142,7 @@ const isInitOnlyEffect = (node: EsTreeNodeOfType<"CallExpression">): boolean =>
   return (depsArg.elements ?? []).length === 0;
 };
 
-export const noCascadingSetState = defineRule<Rule>({
+export const noCascadingSetState = defineRule({
   id: "no-cascading-set-state",
   title: "Multiple setState calls in one effect",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-chain-state-updates.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-chain-state-updates.ts
index 71e0b0b11..e569fa9e5 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-chain-state-updates.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-chain-state-updates.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getArgsUpstreamRefs, getCallExpr, getUpstreamRefs } from "./utils/effect/ast.js";
 import { getProgramAnalysis } from "./utils/effect/get-program-analysis.js";
@@ -17,7 +16,7 @@ import {
 // 1:1 port of upstream
 // `src/rules/no-chain-state-updates.js`.
 
-export const noChainStateUpdates = defineRule<Rule>({
+export const noChainStateUpdates = defineRule({
   id: "no-chain-state-updates",
   title: "State updates chained through effects",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-create-context-in-render.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-create-context-in-render.ts
index a6de2a7ab..c28312b4d 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-create-context-in-render.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-create-context-in-render.ts
@@ -8,7 +8,6 @@ import {
 } from "../../utils/find-import-source-for-name.js";
 import { isCanonicalReactNamespaceName } from "../../utils/is-canonical-react-namespace-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 const MESSAGE =
@@ -66,7 +65,7 @@ const isCreateContextCallee = (callee: EsTreeNode): boolean => {
 //   - Reports only when the call is inside a function whose name looks
 //     like a React component (PascalCase) or hook (`use*`). Calls inside
 //     plain helper functions or at module scope are left alone.
-export const noCreateContextInRender = defineRule<Rule>({
+export const noCreateContextInRender = defineRule({
   id: "no-create-context-in-render",
   title: "createContext called during render",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-create-store-in-render.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-create-store-in-render.ts
index 81b99fd36..b42b1c000 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-create-store-in-render.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-create-store-in-render.ts
@@ -7,7 +7,6 @@ import {
   isImportedFromModule,
 } from "../../utils/find-import-source-for-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 interface StoreApi {
@@ -125,7 +124,7 @@ const resolveStoreFactoryForCallee = (callee: EsTreeNode): StoreApi | null => {
 //   - Subclasses of the store factory.
 //   - User-defined helpers that wrap a factory and are themselves
 //     named like a component/hook (`useMakeStore`).
-export const noCreateStoreInRender = defineRule<Rule>({
+export const noCreateStoreInRender = defineRule({
   id: "no-create-store-in-render",
   title: "Store created during render",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-state-effect.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-state-effect.ts
index f84fb5876..552e52f73 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-state-effect.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-state-effect.ts
@@ -11,7 +11,6 @@ import { isSetterIdentifier } from "../../utils/is-setter-identifier.js";
 import { isUseStateSetterInScope } from "../../utils/is-use-state-setter-in-scope.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -74,7 +73,7 @@ const collectValueIdentifierNames = (node: EsTreeNode | null | undefined, into:
   }
 };
 
-export const noDerivedStateEffect = defineRule<Rule>({
+export const noDerivedStateEffect = defineRule({
   id: "no-derived-state-effect",
   title: "Derived state stored in an effect",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-state.ts
index eada0d90e..5fad9855c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-state.ts
@@ -4,7 +4,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isInitialOnlyPropName } from "../../utils/is-initial-only-prop-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getArgsUpstreamRefs, getCallExpr, getUpstreamRefs } from "./utils/effect/ast.js";
 import { getProgramAnalysis } from "./utils/effect/get-program-analysis.js";
@@ -46,7 +45,7 @@ const getStateNameForUseStateDecl = (useStateNode: EsTreeNode | null): string |
   return isNodeOfType(candidate, "Identifier") ? candidate.name : null;
 };
 
-export const noDerivedState = defineRule<Rule>({
+export const noDerivedState = defineRule({
   id: "no-derived-state",
   title: "Derived value copied into state",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-use-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-use-state.ts
index a8cfa7bb4..89db8857e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-use-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-derived-use-state.ts
@@ -3,12 +3,11 @@ import { defineRule } from "../../utils/define-rule.js";
 import { getRootIdentifierName } from "../../utils/get-root-identifier-name.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { isInitialOnlyPropName } from "../../utils/is-initial-only-prop-name.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noDerivedUseState = defineRule<Rule>({
+export const noDerivedUseState = defineRule({
   id: "no-derived-useState",
   title: "Prop derived into useState",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-direct-state-mutation.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-direct-state-mutation.ts
index f8edcfe3b..534be8438 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-direct-state-mutation.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-direct-state-mutation.ts
@@ -6,7 +6,6 @@ import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { collectUseStateBindings } from "./utils/collect-use-state-bindings.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -78,7 +77,7 @@ const walkComponentRespectingShadows = (
   }
 };
 
-export const noDirectStateMutation = defineRule<Rule>({
+export const noDirectStateMutation = defineRule({
   id: "no-direct-state-mutation",
   title: "State mutated in place",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-chain.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-chain.ts
index 91267ad03..40a47623b 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-chain.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-chain.ts
@@ -15,7 +15,6 @@ import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import { walkInsideStatementBlocks } from "../../utils/walk-inside-statement-blocks.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { collectUseStateBindings } from "./utils/collect-use-state-bindings.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -223,7 +222,7 @@ interface EffectInfo {
   isExternalSync: boolean;
 }
 
-export const noEffectChain = defineRule<Rule>({
+export const noEffectChain = defineRule({
   id: "no-effect-chain",
   title: "Effects chained together",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-event-handler.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-event-handler.ts
index aff9992a6..7627cb7e5 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-event-handler.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-event-handler.ts
@@ -9,7 +9,6 @@ import { areExpressionsStructurallyEqual } from "../../utils/are-expressions-str
 import { walkAst } from "../../utils/walk-ast.js";
 import { findTriggeredSideEffectCalleeName } from "./utils/find-triggered-side-effect-callee-name.js";
 import { hasDocumentClassListMutation } from "./utils/has-document-class-list-mutation.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
@@ -153,7 +152,7 @@ const doesAnyEventLikeCallReferenceAnyRoot = (
   rootIdentifierNames: Set<string>,
 ): boolean => nodes.some((node) => doesEventLikeCallReferenceAnyRoot(node, rootIdentifierNames));
 
-export const noEffectEventHandler = defineRule<Rule>({
+export const noEffectEventHandler = defineRule({
   id: "no-effect-event-handler",
   title: "Effect used as an event handler",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-event-in-deps.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-event-in-deps.ts
index 9b79f677c..a02922e24 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-event-in-deps.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-event-in-deps.ts
@@ -7,7 +7,6 @@ import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { RuleVisitors } from "../../utils/rule-visitors.js";
 
@@ -89,7 +88,7 @@ const createComponentBindingStackTracker = (
 // Bindings are scoped per-component using a stack so a `useEffectEvent`
 // binding named `onChange` in ComponentA doesn't taint a regular variable
 // `onChange` in ComponentB in the same file.
-export const noEffectEventInDeps = defineRule<Rule>({
+export const noEffectEventInDeps = defineRule({
   id: "no-effect-event-in-deps",
   title: "Effect Event listed in effect deps",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-with-fresh-deps.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-with-fresh-deps.ts
index 00c9171f1..ebfef4db5 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-with-fresh-deps.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-effect-with-fresh-deps.ts
@@ -6,7 +6,6 @@ import { findVariableInitializer } from "../../utils/find-variable-initializer.j
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 type FreshDepKind = "object" | "array" | "function" | "JSX" | "instance";
@@ -125,7 +124,7 @@ const resolveDependencyFreshness = (dep: EsTreeNode): ResolvedFreshness | null =
 //   - Custom user hooks (`useMyThing(...)`) returning fresh objects
 //     are treated as opaque to avoid flagging genuinely-stable
 //     custom-hook results.
-export const noEffectWithFreshDeps = defineRule<Rule>({
+export const noEffectWithFreshDeps = defineRule({
   id: "no-effect-with-fresh-deps",
   title: "Effect dependency recreated every render",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-event-handler.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-event-handler.ts
index bfd075c19..719cfcea8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-event-handler.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-event-handler.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { findDownstreamNodes, getDownstreamRefs, getUpstreamRefs } from "./utils/effect/ast.js";
 import { getProgramAnalysis } from "./utils/effect/get-program-analysis.js";
@@ -132,7 +131,7 @@ const isPureEarlyExitConsequent = (consequent: EsTreeNode): boolean => {
 // 1:1 port of upstream `src/rules/no-event-handler.js`, narrowed to
 // skip pure early-exit guard patterns (`if (!enabled) return;`) and
 // one-shot ref-guarded effects (`if (wrapperRef.current && ...)`).
-export const noEventHandler = defineRule<Rule>({
+export const noEventHandler = defineRule({
   id: "no-event-handler",
   title: "Event logic handled in an effect",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-event-trigger-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-event-trigger-state.ts
index 286ac4dcc..8ce85c7d7 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-event-trigger-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-event-trigger-state.ts
@@ -7,7 +7,6 @@ import { isHookCall } from "../../utils/is-hook-call.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { collectUseStateBindings } from "./utils/collect-use-state-bindings.js";
 import { buildLocalDependencyGraph } from "./utils/build-local-dependency-graph.js";
@@ -114,7 +113,7 @@ const collectHandlerOnlyWriteStateNames = (
   return handlerOnlyWriteStateNames;
 };
 
-export const noEventTriggerState = defineRule<Rule>({
+export const noEventTriggerState = defineRule({
   id: "no-event-trigger-state",
   title: "State exists only to trigger an effect",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-fetch-in-effect.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-fetch-in-effect.ts
index 685118ea4..627c32ccd 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-fetch-in-effect.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-fetch-in-effect.ts
@@ -3,11 +3,10 @@ import { containsFetchCall } from "../../utils/contains-fetch-call.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { getEffectCallback } from "../../utils/get-effect-callback.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const noFetchInEffect = defineRule<Rule>({
+export const noFetchInEffect = defineRule({
   id: "no-fetch-in-effect",
   title: "Data fetching inside an effect",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-initialize-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-initialize-state.ts
index fdc252370..a398119c0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-initialize-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-initialize-state.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getCallExpr } from "./utils/effect/ast.js";
 import { getProgramAnalysis } from "./utils/effect/get-program-analysis.js";
@@ -23,7 +22,7 @@ import {
 // canonical literal / identifier / call shapes; falls back to
 // `<expression>` for complex inputs.
 
-export const noInitializeState = defineRule<Rule>({
+export const noInitializeState = defineRule({
   id: "no-initialize-state",
   title: "State initialized from a mount effect",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mirror-prop-effect.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mirror-prop-effect.ts
index 069b68ba9..84e1245b3 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mirror-prop-effect.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mirror-prop-effect.ts
@@ -8,7 +8,6 @@ import { getRootIdentifierName } from "../../utils/get-root-identifier-name.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { isSetterIdentifier } from "../../utils/is-setter-identifier.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 
@@ -52,7 +51,7 @@ interface MirrorBinding {
   propRootName: string;
 }
 
-export const noMirrorPropEffect = defineRule<Rule>({
+export const noMirrorPropEffect = defineRule({
   id: "no-mirror-prop-effect",
   title: "Prop mirrored into state via effect",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mutable-in-deps.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mutable-in-deps.ts
index ee6972b06..afb743219 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mutable-in-deps.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mutable-in-deps.ts
@@ -7,7 +7,6 @@ import { isHookCall } from "../../utils/is-hook-call.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -68,7 +67,7 @@ const findMutableDepIssue = (
   return null;
 };
 
-export const noMutableInDeps = defineRule<Rule>({
+export const noMutableInDeps = defineRule({
   id: "no-mutable-in-deps",
   title: "Mutable value in effect dependencies",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mutating-reducer-state.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mutating-reducer-state.ts
index 3bd8cc1e1..ba144e79c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mutating-reducer-state.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-mutating-reducer-state.ts
@@ -7,7 +7,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { findVariableInitializer } from "../../utils/find-variable-initializer.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
 import { walkAst } from "../../utils/walk-ast.js";
@@ -802,7 +801,7 @@ const analyzeReactUseReducerFunctionForStateMutation = (
   });
 };
 
-export const noMutatingReducerState = defineRule<Rule>({
+export const noMutatingReducerState = defineRule({
   id: "no-mutating-reducer-state",
   title: "Reducer mutates its state",
   severity: "error",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-pass-data-to-parent.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-pass-data-to-parent.ts
index e3a4ea9cc..5a36d660d 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-pass-data-to-parent.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-pass-data-to-parent.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNamespacedApiCallee } from "../../utils/is-namespaced-api-call.js";
 import { DATA_SINK_METHOD_NAMES } from "../../constants/data-sink-method-names.js";
 import { getCallMethodName } from "../../utils/get-call-method-name.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import {
   getArgsUpstreamRefs,
@@ -64,7 +63,7 @@ const isUseRefIdentifier = (identifier: EsTreeNode): boolean => {
   return false;
 };
 
-export const noPassDataToParent = defineRule<Rule>({
+export const noPassDataToParent = defineRule({
   id: "no-pass-data-to-parent",
   title: "Data passed to parent via effect",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-pass-live-state-to-parent.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-pass-live-state-to-parent.ts
index 476a96360..ec4964c58 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-pass-live-state-to-parent.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-pass-live-state-to-parent.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNamespacedApiCallee } from "../../utils/is-namespaced-api-call.js";
 import { DATA_SINK_METHOD_NAMES } from "../../constants/data-sink-method-names.js";
 import { getCallMethodName } from "../../utils/get-call-method-name.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getArgsUpstreamRefs, getCallExpr, isSynchronous } from "./utils/effect/ast.js";
 import { getProgramAnalysis } from "./utils/effect/get-program-analysis.js";
@@ -16,7 +15,7 @@ import {
   isUseEffect,
 } from "./utils/effect/react.js";
 
-export const noPassLiveStateToParent = defineRule<Rule>({
+export const noPassLiveStateToParent = defineRule({
   id: "no-pass-live-state-to-parent",
   title: "Live state pushed to parent via effect",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-prop-callback-in-effect.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-prop-callback-in-effect.ts
index 3a0ef8ab3..9deacda94 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-prop-callback-in-effect.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-prop-callback-in-effect.ts
@@ -5,7 +5,6 @@ import { getEffectCallback } from "../../utils/get-effect-callback.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { walkInsideStatementBlocks } from "../../utils/walk-inside-statement-blocks.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -17,7 +16,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // stale mirror. The right shape is to lift state into a Provider that
 // both child and parent read from; the child then doesn't need an
 // effect-driven sync at all.
-export const noPropCallbackInEffect = defineRule<Rule>({
+export const noPropCallbackInEffect = defineRule({
   id: "no-prop-callback-in-effect",
   title: "Parent kept in sync with a callback effect",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-reset-all-state-on-prop-change.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-reset-all-state-on-prop-change.ts
index 580994577..7d94855a7 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-reset-all-state-on-prop-change.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-reset-all-state-on-prop-change.ts
@@ -3,7 +3,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getCallExpr, getDownstreamRefs, getUpstreamRefs } from "./utils/effect/ast.js";
 import { getProgramAnalysis, type ProgramAnalysis } from "./utils/effect/get-program-analysis.js";
@@ -85,7 +84,7 @@ const findPropUsedToResetAllState = (
   return null;
 };
 
-export const noResetAllStateOnPropChange = defineRule<Rule>({
+export const noResetAllStateOnPropChange = defineRule({
   id: "no-reset-all-state-on-prop-change",
   title: "All state reset on prop change",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-self-updating-effect.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-self-updating-effect.ts
index e8e6ebbb4..348e650d3 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-self-updating-effect.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-self-updating-effect.ts
@@ -11,7 +11,6 @@ import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { collectUseStateBindings } from "./utils/collect-use-state-bindings.js";
 
@@ -642,7 +641,7 @@ const everySetterCallIsTopLevel = (
   return safe;
 };
 
-export const noSelfUpdatingEffect = defineRule<Rule>({
+export const noSelfUpdatingEffect = defineRule({
   id: "no-self-updating-effect",
   title: "Effect updates its own dependency",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-set-state-in-render.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-set-state-in-render.ts
index b96102a3b..2e55d60df 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-set-state-in-render.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-set-state-in-render.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { collectUseStateBindings } from "./utils/collect-use-state-bindings.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
@@ -35,7 +34,7 @@ const isUnconditionalSetterCallStatement = (
   return expression;
 };
 
-export const noSetStateInRender = defineRule<Rule>({
+export const noSetStateInRender = defineRule({
   id: "no-set-state-in-render",
   title: "setState called during render",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-effect-event.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-effect-event.ts
index 6e03b59e7..4fe8ca863 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-effect-event.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-effect-event.ts
@@ -10,7 +10,6 @@ import { getEffectCallback } from "../../utils/get-effect-callback.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 
@@ -226,7 +225,7 @@ const classifyCallableReadsInsideEffect = (
   return { hasAnyRead, allReadsAreInSubHandlers, firstSubHandlerName };
 };
 
-export const preferUseEffectEvent = defineRule<Rule>({
+export const preferUseEffectEvent = defineRule({
   id: "prefer-use-effect-event",
   title: "Effect re-subscribes on a changing callback",
   requires: ["react:19"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-reducer.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-reducer.ts
index ff276b128..5a98fa26e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-reducer.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-reducer.ts
@@ -4,12 +4,11 @@ import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const preferUseReducer = defineRule<Rule>({
+export const preferUseReducer = defineRule({
   id: "prefer-useReducer",
   title: "Many related useState calls",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-sync-external-store.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-sync-external-store.ts
index e2e7926a2..95b08cda0 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-sync-external-store.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/prefer-use-sync-external-store.ts
@@ -9,7 +9,6 @@ import { isSetterIdentifier } from "../../utils/is-setter-identifier.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isCleanupReturn } from "./utils/is-cleanup-return.js";
 import { isCleanupReturningSubscribeLikeCallExpression } from "./utils/is-subscribe-like-call-expression.js";
@@ -165,7 +164,7 @@ const cleanupReleasesSubscription = (
   );
 };
 
-export const preferUseSyncExternalStore = defineRule<Rule>({
+export const preferUseSyncExternalStore = defineRule({
   id: "prefer-use-sync-external-store",
   title: "Hand-rolled external store subscription",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/redux-useselector-inline-derivation.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/redux-useselector-inline-derivation.ts
index ceb3bb415..2bd9dfc65 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/redux-useselector-inline-derivation.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/redux-useselector-inline-derivation.ts
@@ -6,7 +6,6 @@ import { isFunctionLike } from "../../utils/is-function-like.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
 import { walkAst } from "../../utils/walk-ast.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { inlineUseSelectorFunction } from "./utils/inline-use-selector-function.js";
 
@@ -145,7 +144,7 @@ const findReturnedAllocatingCall = (expression: EsTreeNode): AllocatingCallSiteW
 //     primitive aggregation).
 //   - Companion to `redux-useselector-returns-new-collection`, which
 //     covers selectors returning a bare `{...}` / `[...]` literal.
-export const reduxUseselectorInlineDerivation = defineRule<Rule>({
+export const reduxUseselectorInlineDerivation = defineRule({
   id: "redux-useselector-inline-derivation",
   title: "useSelector derives data inline",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/redux-useselector-returns-new-collection.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/redux-useselector-returns-new-collection.ts
index ddf6b59e9..963f8b8a8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/redux-useselector-returns-new-collection.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/redux-useselector-returns-new-collection.ts
@@ -4,7 +4,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { inlineUseSelectorFunction } from "./utils/inline-use-selector-function.js";
 
@@ -61,7 +60,7 @@ const isConciseBodyReturningCollection = (functionNode: EsTreeNode): boolean =>
 //   - inline arrow/function selectors only. Selector hoisted to an
 //     identifier is skipped — those usually live alongside a `createSelector`
 //     pipeline that the user knows is memoised.
-export const reduxUseselectorReturnsNewCollection = defineRule<Rule>({
+export const reduxUseselectorReturnsNewCollection = defineRule({
   id: "redux-useselector-returns-new-collection",
   title: "useSelector returns a new collection",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-defer-reads-hook.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-defer-reads-hook.ts
index 1497063b2..24245c6fa 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-defer-reads-hook.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-defer-reads-hook.ts
@@ -3,7 +3,6 @@ import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { collectHandlerBindingNames } from "./utils/collect-handler-binding-names.js";
 import { isInsideEventHandler } from "./utils/is-inside-event-handler.js";
@@ -49,7 +48,7 @@ const findHookCallBindings = (
 //
 // Heuristic: hook value-name appears only inside arrow / function
 // expressions that are themselves bound to JSX `on*` attributes.
-export const rerenderDeferReadsHook = defineRule<Rule>({
+export const rerenderDeferReadsHook = defineRule({
   id: "rerender-defer-reads-hook",
   title: "URL hook value only read in handlers",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-dependencies.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-dependencies.ts
index 2612048af..812625753 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-dependencies.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-dependencies.ts
@@ -1,12 +1,11 @@
 import { HOOKS_WITH_DEPS } from "../../constants/react.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const rerenderDependencies = defineRule<Rule>({
+export const rerenderDependencies = defineRule({
   id: "rerender-dependencies",
   title: "Unstable value recreated every render",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-functional-setstate.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-functional-setstate.ts
index a4ce57db1..566026a9b 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-functional-setstate.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-functional-setstate.ts
@@ -2,7 +2,6 @@ import { defineRule } from "../../utils/define-rule.js";
 import { isSetterCall } from "../../utils/is-setter-call.js";
 import { isUseStateSetterInScope } from "../../utils/is-use-state-setter-in-scope.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -87,7 +86,7 @@ const isInsideDeferredCallback = (node: EsTreeNode): boolean => {
   return false;
 };
 
-export const rerenderFunctionalSetstate = defineRule<Rule>({
+export const rerenderFunctionalSetstate = defineRule({
   id: "rerender-functional-setstate",
   title: "setState reads a stale value",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-lazy-ref-init.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-lazy-ref-init.ts
index 0dea48ac4..c218f56ec 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-lazy-ref-init.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-lazy-ref-init.ts
@@ -4,7 +4,6 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { isReactHookName } from "../../utils/is-react-hook-name.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 
 // Sister rule to `rerender-lazy-state-init`. `useRef` is even less
@@ -34,7 +33,7 @@ import type { RuleContext } from "../../utils/rule-context.js";
 //   - Trivial wrappers (`Number`, `String`, `Array`, `Boolean`,
 //     `parseInt`, `parseFloat`) are exempt because they're essentially
 //     free — same exemption list as `rerender-lazy-state-init`.
-export const rerenderLazyRefInit = defineRule<Rule>({
+export const rerenderLazyRefInit = defineRule({
   id: "rerender-lazy-ref-init",
   title: "Ref initializer runs on every render",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-lazy-state-init.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-lazy-state-init.ts
index 9ee1f71a2..b088f9a37 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-lazy-state-init.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-lazy-state-init.ts
@@ -1,12 +1,11 @@
 import { TRIVIAL_INITIALIZER_NAMES } from "../../constants/react.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const rerenderLazyStateInit = defineRule<Rule>({
+export const rerenderLazyStateInit = defineRule({
   id: "rerender-lazy-state-init",
   title: "State initializer runs on every render",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-state-only-in-handlers.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-state-only-in-handlers.ts
index 346382d9c..585a5c2ff 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-state-only-in-handlers.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/rerender-state-only-in-handlers.ts
@@ -3,7 +3,6 @@ import { isComponentAssignment } from "../../utils/is-component-assignment.js";
 import { isUppercaseName } from "../../utils/is-uppercase-name.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { collectUseStateBindings } from "./utils/collect-use-state-bindings.js";
 import { collectRenderReachableExpressions } from "./utils/collect-render-reachable-expressions.js";
@@ -14,7 +13,7 @@ import { collectFunctionLikeLocalNames } from "./utils/collect-function-like-loc
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const rerenderStateOnlyInHandlers = defineRule<Rule>({
+export const rerenderStateOnlyInHandlers = defineRule({
   id: "rerender-state-only-in-handlers",
   title: "State only used in handlers",
   severity: "warn",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-destructure-result.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-destructure-result.ts
index f81e4d025..d9aaabf00 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-destructure-result.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-destructure-result.ts
@@ -1,11 +1,10 @@
 import { TANSTACK_QUERY_HOOKS } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const queryDestructureResult = defineRule<Rule>({
+export const queryDestructureResult = defineRule({
   id: "query-destructure-result",
   title: "Whole query result subscribes to every field",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-mutation-missing-invalidation.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-mutation-missing-invalidation.ts
index bd7493bd8..04ffd8883 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-mutation-missing-invalidation.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-mutation-missing-invalidation.ts
@@ -2,12 +2,11 @@ import { QUERY_CACHE_UPDATE_METHODS, TANSTACK_MUTATION_HOOKS } from "../../const
 import { defineRule } from "../../utils/define-rule.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const queryMutationMissingInvalidation = defineRule<Rule>({
+export const queryMutationMissingInvalidation = defineRule({
   id: "query-mutation-missing-invalidation",
   title: "Mutation without cache invalidation",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-query-in-effect.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-query-in-effect.ts
index a6a1301b0..9ac3d575a 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-query-in-effect.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-query-in-effect.ts
@@ -4,12 +4,11 @@ import { getEffectCallback } from "../../utils/get-effect-callback.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const queryNoQueryInEffect = defineRule<Rule>({
+export const queryNoQueryInEffect = defineRule({
   id: "query-no-query-in-effect",
   title: "Query refetch inside useEffect",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-rest-destructuring.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-rest-destructuring.ts
index cbc84a6af..33acfa20e 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-rest-destructuring.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-rest-destructuring.ts
@@ -1,12 +1,11 @@
 import { TANSTACK_QUERY_HOOKS } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const queryNoRestDestructuring = defineRule<Rule>({
+export const queryNoRestDestructuring = defineRule({
   id: "query-no-rest-destructuring",
   title: "Rest destructuring on query result",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-use-query-for-mutation.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-use-query-for-mutation.ts
index da3160baf..ac0b32ec2 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-use-query-for-mutation.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-use-query-for-mutation.ts
@@ -3,12 +3,11 @@ import { TANSTACK_QUERY_HOOKS } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const queryNoUseQueryForMutation = defineRule<Rule>({
+export const queryNoUseQueryForMutation = defineRule({
   id: "query-no-usequery-for-mutation",
   title: "useQuery used for mutation",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-void-query-fn.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-void-query-fn.ts
index 3b3b07e99..23dc17af7 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-void-query-fn.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-no-void-query-fn.ts
@@ -1,12 +1,11 @@
 import { TANSTACK_QUERY_HOOKS } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const queryNoVoidQueryFn = defineRule<Rule>({
+export const queryNoVoidQueryFn = defineRule({
   id: "query-no-void-query-fn",
   title: "queryFn returns no value",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-stable-query-client.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-stable-query-client.ts
index 8e2bb15b3..5a0a19a2b 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-stable-query-client.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-query/query-stable-query-client.ts
@@ -3,12 +3,11 @@ import { TANSTACK_QUERY_CLIENT_CLASS } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const queryStableQueryClient = defineRule<Rule>({
+export const queryStableQueryClient = defineRule({
   id: "query-stable-query-client",
   title: "Unstable QueryClient in component",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-get-mutation.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-get-mutation.ts
index d232c3342..724e1f6b6 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-get-mutation.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-get-mutation.ts
@@ -3,13 +3,12 @@ import { collectLocallyScopedCookieBindings } from "../../utils/collect-locally-
 import { collectLocallyScopedSafeBindings } from "../../utils/collect-locally-scoped-safe-bindings.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { findSideEffect } from "../../utils/find-side-effect.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { walkServerFnChain } from "./utils/walk-server-fn-chain.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const tanstackStartGetMutation = defineRule<Rule>({
+export const tanstackStartGetMutation = defineRule({
   id: "tanstack-start-get-mutation",
   title: "Mutation in GET server function",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-loader-parallel-fetch.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-loader-parallel-fetch.ts
index 65dee39b7..7f1827bbe 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-loader-parallel-fetch.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-loader-parallel-fetch.ts
@@ -1,7 +1,6 @@
 import { SEQUENTIAL_AWAIT_THRESHOLD_FOR_LOADER } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getRouteOptionsObject } from "./utils/get-route-options-object.js";
 import { getPropertyKeyName } from "./utils/get-property-key-name.js";
@@ -30,7 +29,7 @@ const hasTopLevelAwait = (statement: EsTreeNode): boolean => {
   return false;
 };
 
-export const tanstackStartLoaderParallelFetch = defineRule<Rule>({
+export const tanstackStartLoaderParallelFetch = defineRule({
   id: "tanstack-start-loader-parallel-fetch",
   title: "Sequential awaits in loader",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-missing-head-content.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-missing-head-content.ts
index ecc48936c..b77b53a2f 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-missing-head-content.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-missing-head-content.ts
@@ -2,7 +2,6 @@ import { TANSTACK_ROOT_ROUTE_FILE_PATTERN } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -65,7 +64,7 @@ const isCustomJsxElementName = (node: EsTreeNodeOfType<"JSXOpeningElement">["nam
   );
 };
 
-export const tanstackStartMissingHeadContent = defineRule<Rule>({
+export const tanstackStartMissingHeadContent = defineRule({
   id: "tanstack-start-missing-head-content",
   title: "Root route missing HeadContent",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-anchor-element.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-anchor-element.ts
index 9788fe6e2..37a7f217c 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-anchor-element.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-anchor-element.ts
@@ -1,12 +1,11 @@
 import { TANSTACK_ROUTE_FILE_PATTERN } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const tanstackStartNoAnchorElement = defineRule<Rule>({
+export const tanstackStartNoAnchorElement = defineRule({
   id: "tanstack-start-no-anchor-element",
   title: "Plain anchor reloads TanStack Router navigation",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-direct-fetch-in-loader.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-direct-fetch-in-loader.ts
index e0dabcaea..228027f8a 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-direct-fetch-in-loader.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-direct-fetch-in-loader.ts
@@ -1,14 +1,13 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getRouteOptionsObject } from "./utils/get-route-options-object.js";
 import { getPropertyKeyName } from "./utils/get-property-key-name.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const tanstackStartNoDirectFetchInLoader = defineRule<Rule>({
+export const tanstackStartNoDirectFetchInLoader = defineRule({
   id: "tanstack-start-no-direct-fetch-in-loader",
   title: "Direct fetch in route loader",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-dynamic-server-fn-import.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-dynamic-server-fn-import.ts
index c5e739ef4..dde59aaa9 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-dynamic-server-fn-import.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-dynamic-server-fn-import.ts
@@ -1,11 +1,10 @@
 import { TANSTACK_SERVER_FN_FILE_PATTERN } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const tanstackStartNoDynamicServerFnImport = defineRule<Rule>({
+export const tanstackStartNoDynamicServerFnImport = defineRule({
   id: "tanstack-start-no-dynamic-server-fn-import",
   title: "Dynamic server function import",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-navigate-in-render.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-navigate-in-render.ts
index c98d45912..ba8e82e0d 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-navigate-in-render.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-navigate-in-render.ts
@@ -9,13 +9,12 @@ import { defineRule } from "../../utils/define-rule.js";
 import { normalizeFilename } from "../../utils/normalize-filename.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isFunctionLike } from "../../utils/is-function-like.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const tanstackStartNoNavigateInRender = defineRule<Rule>({
+export const tanstackStartNoNavigateInRender = defineRule({
   id: "tanstack-start-no-navigate-in-render",
   title: "navigate() called during render",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-secrets-in-loader.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-secrets-in-loader.ts
index b435cf2fc..4e1a8c229 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-secrets-in-loader.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-secrets-in-loader.ts
@@ -1,7 +1,6 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getRouteOptionsObject } from "./utils/get-route-options-object.js";
 import { getPropertyKeyName } from "./utils/get-property-key-name.js";
@@ -21,7 +20,7 @@ const isLikelySecret = (envVarName: string): boolean => {
   return SECRET_KEYWORD_PATTERN.test(envVarName);
 };
 
-export const tanstackStartNoSecretsInLoader = defineRule<Rule>({
+export const tanstackStartNoSecretsInLoader = defineRule({
   id: "tanstack-start-no-secrets-in-loader",
   title: "Secret exposed in a loader",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-use-effect-fetch.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-use-effect-fetch.ts
index a0c4bd9d1..d57a7a2d3 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-use-effect-fetch.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-use-effect-fetch.ts
@@ -5,12 +5,11 @@ import { normalizeFilename } from "../../utils/normalize-filename.js";
 import { isHookCall } from "../../utils/is-hook-call.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const tanstackStartNoUseEffectFetch = defineRule<Rule>({
+export const tanstackStartNoUseEffectFetch = defineRule({
   id: "tanstack-start-no-useeffect-fetch",
   title: "fetch inside useEffect in route",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-use-server-in-handler.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-use-server-in-handler.ts
index 055e2a2a0..6b72e1420 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-use-server-in-handler.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-no-use-server-in-handler.ts
@@ -1,11 +1,10 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const tanstackStartNoUseServerInHandler = defineRule<Rule>({
+export const tanstackStartNoUseServerInHandler = defineRule({
   id: "tanstack-start-no-use-server-in-handler",
   title: "Redundant use server in handler",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-redirect-in-try-catch.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-redirect-in-try-catch.ts
index bed695f49..1ba90ff97 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-redirect-in-try-catch.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-redirect-in-try-catch.ts
@@ -1,11 +1,10 @@
 import { TANSTACK_REDIRECT_FUNCTIONS } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const tanstackStartRedirectInTryCatch = defineRule<Rule>({
+export const tanstackStartRedirectInTryCatch = defineRule({
   id: "tanstack-start-redirect-in-try-catch",
   title: "redirect() inside try-catch",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-route-property-order.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-route-property-order.ts
index c038c3bc5..d3b9905de 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-route-property-order.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-route-property-order.ts
@@ -1,12 +1,11 @@
 import { TANSTACK_ROUTE_PROPERTY_ORDER } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { getRouteOptionsObject } from "./utils/get-route-options-object.js";
 import { getPropertyKeyName } from "./utils/get-property-key-name.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const tanstackStartRoutePropertyOrder = defineRule<Rule>({
+export const tanstackStartRoutePropertyOrder = defineRule({
   id: "tanstack-start-route-property-order",
   title: "Route property order breaks type inference",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-server-fn-method-order.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-server-fn-method-order.ts
index 72928a038..a549013b8 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-server-fn-method-order.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-server-fn-method-order.ts
@@ -4,12 +4,11 @@ import {
 } from "../../constants/tanstack.js";
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const tanstackStartServerFnMethodOrder = defineRule<Rule>({
+export const tanstackStartServerFnMethodOrder = defineRule({
   id: "tanstack-start-server-fn-method-order",
   title: "Server function method order breaks type inference",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-server-fn-validate-input.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-server-fn-validate-input.ts
index 17062397a..7261b87d1 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-server-fn-validate-input.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/tanstack-start/tanstack-start-server-fn-validate-input.ts
@@ -1,13 +1,12 @@
 import { defineRule } from "../../utils/define-rule.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { walkServerFnChain } from "./utils/walk-server-fn-chain.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 
-export const tanstackStartServerFnValidateInput = defineRule<Rule>({
+export const tanstackStartServerFnValidateInput = defineRule({
   id: "tanstack-start-server-fn-validate-input",
   title: "Server function without input validation",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/view-transitions/no-document-start-view-transition.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/view-transitions/no-document-start-view-transition.ts
index 6ceeb3769..4128bc718 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/view-transitions/no-document-start-view-transition.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/view-transitions/no-document-start-view-transition.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
@@ -10,7 +9,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // emits. The supported way is to render <ViewTransition> and let React
 // call startViewTransition for you (around startTransition, useDeferredValue,
 // or Suspense reveals).
-export const noDocumentStartViewTransition = defineRule<Rule>({
+export const noDocumentStartViewTransition = defineRule({
   id: "no-document-start-view-transition",
   title: "Direct document.startViewTransition call",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/view-transitions/no-flush-sync.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/view-transitions/no-flush-sync.ts
index 586170410..a1b29e490 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/view-transitions/no-flush-sync.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/view-transitions/no-flush-sync.ts
@@ -1,5 +1,4 @@
 import { defineRule } from "../../utils/define-rule.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { getImportedName } from "../../utils/get-imported-name.js";
@@ -10,7 +9,7 @@ import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 // would have triggered is silently dropped. We report only on the import
 // (a single actionable diagnostic per file) instead of on every call
 // site, which would clutter output for files with several flushSync()s.
-export const noFlushSync = defineRule<Rule>({
+export const noFlushSync = defineRule({
   id: "no-flush-sync",
   title: "flushSync skips View Transitions",
   tags: ["test-noise"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-error-apis.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-error-apis.ts
index 424bf1483..851d32d00 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-error-apis.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-error-apis.ts
@@ -3,7 +3,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import {
   getMethodCall,
@@ -63,7 +62,7 @@ const isReceiverOfDeprecatedZodErrorMember = (
   return isDeprecatedZodErrorMemberAccess(parent);
 };
 
-export const zodV4NoDeprecatedErrorApis = defineRule<Rule>({
+export const zodV4NoDeprecatedErrorApis = defineRule({
   id: "zod-v4-no-deprecated-error-apis",
   title: "Zod 3 error API breaks in Zod 4",
   requires: ["zod:4"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-error-customization.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-error-customization.ts
index 3f7eeef97..ccdd36740 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-error-customization.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-error-customization.ts
@@ -3,7 +3,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import {
   getZodFactoryCallName,
@@ -88,7 +87,7 @@ const parseCallUsesErrorMap = (callExpression: EsTreeNodeOfType<"CallExpression"
   );
 };
 
-export const zodV4NoDeprecatedErrorCustomization = defineRule<Rule>({
+export const zodV4NoDeprecatedErrorCustomization = defineRule({
   id: "zod-v4-no-deprecated-error-customization",
   title: "Zod 3 error customization breaks in Zod 4",
   requires: ["zod:4"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-schema-apis.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-schema-apis.ts
index d773a58b5..d9cf411f1 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-schema-apis.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-no-deprecated-schema-apis.ts
@@ -3,7 +3,6 @@ import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
 import { isNodeOfType } from "../../utils/is-node-of-type.js";
 import { stripParenExpression } from "../../utils/strip-paren-expression.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import {
   getMethodCall,
@@ -162,7 +161,7 @@ const isZodNamespaceImportMemberCreate = (
   );
 };
 
-export const zodV4NoDeprecatedSchemaApis = defineRule<Rule>({
+export const zodV4NoDeprecatedSchemaApis = defineRule({
   id: "zod-v4-no-deprecated-schema-apis",
   title: "Zod 3 schema API breaks in Zod 4",
   requires: ["zod:4"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-prefer-top-level-string-formats.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-prefer-top-level-string-formats.ts
index 8a0f6ceff..0ff258ec7 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-prefer-top-level-string-formats.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/zod/zod-v4-prefer-top-level-string-formats.ts
@@ -1,6 +1,5 @@
 import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
-import type { Rule } from "../../utils/rule.js";
 import type { RuleContext } from "../../utils/rule-context.js";
 import { isDirectMethodCallOnZodFactory } from "./utils/zod-ast.js";
 
@@ -29,7 +28,7 @@ const STRING_FORMAT_METHODS = new Set([
   "uuid",
 ]);
 
-export const zodV4PreferTopLevelStringFormats = defineRule<Rule>({
+export const zodV4PreferTopLevelStringFormats = defineRule({
   id: "zod-v4-prefer-top-level-string-formats",
   title: "Format method on z.string()",
   requires: ["zod:4"],
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/define-rule.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/define-rule.ts
index 4bad7c63c..8e490c380 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/define-rule.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/define-rule.ts
@@ -1,3 +1,4 @@
+import type { FileScan } from "./file-scan.js";
 import { isTestlikeFilename } from "./is-testlike-filename.js";
 import {
   fileImportsNonReactJsxDialect,
@@ -6,10 +7,13 @@ import {
 import type { Rule } from "./rule.js";
 import type { EsTreeNodeOfType } from "./es-tree-node-of-type.js";
 
-interface DefineRule {
-  (rule: Rule): Rule;
-  <RuleDefinition>(rule: RuleDefinition): RuleDefinition;
-}
+// A rule definition has exactly one execution mode. An AST rule provides
+// `create` (per-file visitors, hosted by oxlint/ESLint); a scan rule
+// provides `scan` (a project-level file scan, executed by
+// @react-doctor/core's check-security-scan environment check) and gets an
+// inert visitor factory injected for host compatibility. Metadata,
+// registration, tags, and severity flow identically either way.
+export type RuleDefinition = Rule | (Omit<Rule, "create"> & { scan: FileScan });
 
 // Rules tagged `"test-noise"` are by-design noisy in tests / stories /
 // playgrounds — design-system style preferences, deprecated-API hints,
@@ -91,11 +95,12 @@ const wrapCreateForReactJsxOnly = <
     return wrappedVisitors;
   }) as CreateFn;
 
-export const defineRule: DefineRule = <RuleDefinition>(rule: RuleDefinition): RuleDefinition => {
-  const tags = (rule as { tags?: ReadonlyArray<string> }).tags;
-  const create = (rule as { create?: unknown }).create;
-  if (typeof create !== "function") return rule;
-  let wrappedCreate = create as (...args: unknown[]) => unknown;
+export const defineRule = (rule: RuleDefinition): Rule => {
+  if (!("create" in rule)) {
+    return { ...rule, create: () => ({}) };
+  }
+  const tags = rule.tags;
+  let wrappedCreate = rule.create;
   // `migration-hint` wins over `test-noise` — deprecated API usage in
   // test code is the very surface that needs migration (`react-dom/test-utils`
   // imports, legacy lifecycle methods in test class fixtures, etc.).
@@ -107,9 +112,9 @@ export const defineRule: DefineRule = <RuleDefinition>(rule: RuleDefinition): Ru
   if (tags?.includes("react-jsx-only")) {
     wrappedCreate = wrapCreateForReactJsxOnly(wrappedCreate as never) as never;
   }
-  if (wrappedCreate === create) return rule;
+  if (wrappedCreate === rule.create) return rule;
   return {
     ...rule,
     create: wrappedCreate,
-  } as RuleDefinition;
+  };
 };
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/file-scan.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/file-scan.ts
new file mode 100644
index 000000000..748659796
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/file-scan.ts
@@ -0,0 +1,32 @@
+// A file scan is a PROJECT-LEVEL security check, not an oxlint AST rule:
+// @react-doctor/core's check-security-scan environment check walks the
+// whole project tree, reads each candidate file once, and hands it to every
+// registered scan rule's `scan`. Scan rules carry registry metadata
+// (id / title / severity / recommendation / tags) like any other rule but
+// are excluded from the generated oxlint config and never receive visitors.
+
+export interface ScannedFile {
+  readonly absolutePath: string;
+  readonly relativePath: string;
+  readonly content: string;
+  readonly isGeneratedBundle: boolean;
+}
+
+// `severity` / `title` / `help` are per-finding OVERRIDES of the rule's
+// registry metadata (e.g. `public-debug-artifact` escalates to "error"
+// when the artifact contains a secret value); omit them to inherit the
+// rule's `severity` / `title` / `recommendation`. `severity` uses the
+// plugin vocabulary ("warn") — the core dispatcher maps it to the
+// diagnostic vocabulary ("warning").
+export interface ScanFinding {
+  readonly message: string;
+  readonly line: number;
+  readonly column: number;
+  readonly severity?: "error" | "warn";
+  readonly title?: string;
+  readonly help?: string;
+}
+
+export interface FileScan {
+  (file: ScannedFile): ScanFinding[];
+}
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/parse-source-file.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/parse-source-file.ts
index 0b47425e2..b1a90cfaa 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/parse-source-file.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/parse-source-file.ts
@@ -27,6 +27,22 @@ interface CacheEntry {
   readonly program: EsTreeNode | null;
 }
 
+export const parseSourceText = (filename: string, sourceText: string): EsTreeNode | null => {
+  try {
+    const result = parseSync(filename, sourceText, {
+      astType: "ts",
+      lang: resolveLang(filename),
+    });
+    const hasFatalError = result.errors.some((parseError) => parseError.severity === "Error");
+    if (hasFatalError) return null;
+    const parsedProgram = result.program as unknown as EsTreeNode;
+    attachParentReferences(parsedProgram);
+    return parsedProgram;
+  } catch {
+    return null;
+  }
+};
+
 // Module-level cache of parsed Programs keyed by absolute file path.
 // Each entry stores the file's mtime + byte size at parse time so a
 // changed file invalidates the cache automatically. Storing `null`
@@ -87,22 +103,7 @@ export const parseSourceFile = (absoluteFilePath: string): EsTreeNode | null =>
     return null;
   }
 
-  let parsedProgram: EsTreeNode | null = null;
-  try {
-    const result = parseSync(absoluteFilePath, sourceText, {
-      astType: "ts",
-      lang: resolveLang(absoluteFilePath),
-    });
-    // Treat fatal parse errors as a parse failure (returns null).
-    // Recoverable warnings still produce a usable AST.
-    const hasFatalError = result.errors.some((parseError) => parseError.severity === "Error");
-    if (!hasFatalError) {
-      parsedProgram = result.program as unknown as EsTreeNode;
-      attachParentReferences(parsedProgram);
-    }
-  } catch {
-    parsedProgram = null;
-  }
+  const parsedProgram = parseSourceText(absoluteFilePath, sourceText);
 
   parseCache.set(absoluteFilePath, {
     mtimeMs: fileStat.mtimeMs,
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/rule.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/rule.ts
index d7a22ef2f..13d634e40 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/rule.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/rule.ts
@@ -1,3 +1,4 @@
+import type { FileScan } from "./file-scan.js";
 import type { RuleContext } from "./rule-context.js";
 import type { RuleVisitors } from "./rule-visitors.js";
 
@@ -68,6 +69,11 @@ export interface Rule {
   // Retired rules stay registered only so legacy configs and docs tooling
   // can resolve the id. They intentionally never report diagnostics.
   lifecycle?: "retired";
+  // Project-level file scan. Rules with `scan` are registered for
+  // metadata/tags/severity like any rule, but are EXCLUDED from the
+  // generated oxlint config and executed by @react-doctor/core's
+  // check-security-scan environment check over a whole-tree walk.
+  scan?: FileScan;
   recommendation?: string;
   create: (context: RuleContext) => RuleVisitors;
 }
diff --git a/packages/oxlint-plugin-react-doctor/src/rules.ts b/packages/oxlint-plugin-react-doctor/src/rules.ts
index b55246459..2aa4fc2a2 100644
--- a/packages/oxlint-plugin-react-doctor/src/rules.ts
+++ b/packages/oxlint-plugin-react-doctor/src/rules.ts
@@ -24,9 +24,18 @@ const toKeyedSeverity = (entries: ReadonlyArray<RegistryEntry>): ReadonlyArray<K
 const isRecommendedByDefault = (entry: RegistryEntry): boolean =>
   entry.rule.defaultEnabled !== false;
 
+// Scan rules (`scan` field) stay in the full registry exports for
+// metadata consumers (`REACT_DOCTOR_RULES`, `ALL_REACT_DOCTOR_RULE_KEYS`)
+// but are excluded from the preset rule maps: their lint visitor is a
+// no-op (they run via @react-doctor/core's check-security-scan
+// environment check), so enabling them in an ESLint/oxlint config would
+// only register dead rules.
+const isScanRule = (entry: RegistryEntry): boolean => entry.rule.scan !== undefined;
+
 const collectReactDoctorRulesByFramework = (frameworkName: RuleFramework) =>
   reactDoctorRules.filter(
-    (entry) => entry.rule.framework === frameworkName && isRecommendedByDefault(entry),
+    (entry) =>
+      entry.rule.framework === frameworkName && isRecommendedByDefault(entry) && !isScanRule(entry),
   );
 
 const collectExternalRulesBySource = (source: string) =>
@@ -97,7 +106,9 @@ export const TANSTACK_QUERY_RULES = toRuleMap(
 export const PREACT_RULES = toRuleMap(
   toKeyedSeverity(collectReactDoctorRulesByFramework("preact")),
 );
-export const ALL_REACT_DOCTOR_RULES = toRuleMap(toKeyedSeverity(REACT_DOCTOR_RULES));
+export const ALL_REACT_DOCTOR_RULES = toRuleMap(
+  toKeyedSeverity(REACT_DOCTOR_RULES.filter((entry) => !isScanRule(entry))),
+);
 export const ALL_REACT_DOCTOR_RULE_KEYS: ReadonlySet<string> = new Set(
   REACT_DOCTOR_RULES.map((rule) => rule.key),
 );
diff --git a/packages/oxlint-plugin-react-doctor/src/test-utils/run-scan-rule.ts b/packages/oxlint-plugin-react-doctor/src/test-utils/run-scan-rule.ts
new file mode 100644
index 000000000..39e062c2f
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/test-utils/run-scan-rule.ts
@@ -0,0 +1,29 @@
+import type { ScanFinding, ScannedFile } from "../plugin/utils/file-scan.js";
+import type { Rule } from "../plugin/utils/rule.js";
+
+export interface ScanFileInput {
+  relativePath: string;
+  content: string;
+  // Mirrors the walker's bundle classification (filename pattern or
+  // minified-content sniff); defaults to false like an ordinary source file.
+  isGeneratedBundle?: boolean;
+}
+
+// Pure-TS scan-rule runner mirroring what @react-doctor/core's
+// check-security-scan environment check does at runtime: build an
+// in-memory `ScannedFile` for one candidate file and hand it to the rule's
+// `scan`. Used by `<rule>.regressions.test.ts` to assert finding semantics
+// without touching the filesystem.
+export const runScanRule = (rule: Rule, file: ScanFileInput): ScanFinding[] => {
+  const { scan } = rule;
+  if (typeof scan !== "function") {
+    throw new Error(`Rule "${rule.id}" has no scan; runScanRule only runs scan rules.`);
+  }
+  const scannedFile: ScannedFile = {
+    absolutePath: `/${file.relativePath}`,
+    relativePath: file.relativePath,
+    content: file.content,
+    isGeneratedBundle: file.isGeneratedBundle ?? false,
+  };
+  return scan(scannedFile);
+};
diff --git a/packages/react-doctor/tests/regressions/scan-resilience.test.ts b/packages/react-doctor/tests/regressions/scan-resilience.test.ts
index 11a11b77c..23261f352 100644
--- a/packages/react-doctor/tests/regressions/scan-resilience.test.ts
+++ b/packages/react-doctor/tests/regressions/scan-resilience.test.ts
@@ -705,4 +705,23 @@ describe("issue #141: oxlint config must not reference unloaded plugins", () =>
       expect(recommendedRuleKeys.has(ruleKey)).toBe(false);
     }
   });
+
+  // Same bug class as #fa3d54f2 for scan rules: they're
+  // project-level scans executed by core's check-security-scan
+  // environment check, and their oxlint visitor is a no-op. Core's
+  // oxlint config builder skips them with its own filter (tested in
+  // core's oxlint-config-settings suite), but the ESLint preset maps
+  // are an independent code path — if `rules.ts` ever drops its
+  // scan-rule filter, every preset would silently enable 36 no-op rules.
+  it("ESLint presets exclude security-scan (scan) rules", async () => {
+    const pluginModule = await import("oxlint-plugin-react-doctor");
+    const scanRuleKeys = pluginModule.REACT_DOCTOR_RULES.filter(
+      (entry) => entry.rule.scan !== undefined,
+    ).map((entry) => entry.key);
+    expect(scanRuleKeys).toHaveLength(36);
+    for (const key of scanRuleKeys) {
+      expect(pluginModule.RECOMMENDED_RULES).not.toHaveProperty(key);
+      expect(pluginModule.ALL_REACT_DOCTOR_RULES).not.toHaveProperty(key);
+    }
+  });
 });
diff --git a/packages/react-doctor/tests/rule-tag-registration.test.ts b/packages/react-doctor/tests/rule-tag-registration.test.ts
index 829707d74..3ac9f3e44 100644
--- a/packages/react-doctor/tests/rule-tag-registration.test.ts
+++ b/packages/react-doctor/tests/rule-tag-registration.test.ts
@@ -35,6 +35,14 @@ describe("rule tag registration", () => {
     }
   });
 
+  it('tags every security scan rule (every rule carrying a scan) with "security-scan"', () => {
+    const securityScanRuleIds = collectRuleIdsMatching((rule) => rule.scan !== undefined);
+    expect(securityScanRuleIds.length).toBeGreaterThan(0);
+    for (const ruleId of securityScanRuleIds) {
+      expect(getRuleTags(ruleId)).toContain("security-scan");
+    }
+  });
+
   it('tags the four migration-hint rules with "migration-hint"', () => {
     const migrationHintRuleIds = [
       "no-react19-deprecated-apis",
diff --git a/scripts/smoke-packed-cli-install.ts b/scripts/smoke-packed-cli-install.ts
index 439e35305..2de965fbd 100644
--- a/scripts/smoke-packed-cli-install.ts
+++ b/scripts/smoke-packed-cli-install.ts
@@ -112,25 +112,39 @@ const main = (): void => {
       `${JSON.stringify({ name: "react-doctor-packed-cli-smoke", private: true }, null, 2)}\n`,
     );
 
+    // Pack the CLI together with its workspace dependency: changesets
+    // version-bumps and publishes them as a pinned pair, so installing
+    // both tarballs mirrors what a release ships. Installing only the
+    // CLI tarball would resolve `oxlint-plugin-react-doctor` from the
+    // registry and reject any PR that adds cross-package API before
+    // it's published.
     runCommand({
       command: "pnpm",
-      args: ["--filter", "react-doctor", "pack", "--pack-destination", packDirectory],
+      args: [
+        "--filter",
+        "react-doctor",
+        "--filter",
+        "oxlint-plugin-react-doctor",
+        "pack",
+        "--pack-destination",
+        packDirectory,
+      ],
       cwd: REPOSITORY_ROOT,
       needsShell: process.platform === "win32",
     });
 
     const tarballs = fs.readdirSync(packDirectory).filter((fileName) => fileName.endsWith(".tgz"));
-    if (tarballs.length !== 1) {
+    if (tarballs.length !== 2) {
       console.error(
-        `Expected exactly one packed tarball in ${packDirectory}, found ${tarballs.length}.`,
+        `Expected exactly two packed tarballs in ${packDirectory}, found ${tarballs.length}.`,
       );
       process.exit(1);
     }
-    const tarballPath = path.join(packDirectory, tarballs[0] ?? "");
+    const tarballPaths = tarballs.map((tarball) => path.join(packDirectory, tarball));
 
     runCommand({
       command: "npm",
-      args: ["install", "--omit=dev", tarballPath],
+      args: ["install", "--omit=dev", ...tarballPaths],
       cwd: installDirectory,
       needsShell: process.platform === "win32",
     });