Linting

Variables, functions, methods, and parameters should use snake_case.

# Bad
let myVar = 10
def processData end

# Good
let my_var = 10
def process_data end

Classes and interfaces should use PascalCase.

# Bad
class my_class end
interface data_store end

# Good
class MyClass end
interface DataStore end

Blocks should not be empty. Add a comment or remove the block.

Lines should not exceed 120 characters.

Code after a return statement is unreachable and will never execute.

def example
  return 42
  print("never reached");  # Warning: unreachable code
end

Catch blocks should not be empty. Silently swallowing errors hides bugs.

# Bad - error silently ignored
try
  risky()catch e
end

# Good - at least log the error
try
  risky()catch e
  print("Error: " + str(e))
end

Nesting depth should not exceed 4 levels. Consider extracting logic into separate functions.

A class should not have two methods with the same name.

Calls to db_query_raw, Trusted.*, System.shell / System.shell_sync, or backtick command substitution from app/controllers/, app/middleware/, or app/views/. These primitives are powerful but become injection / traversal sinks when fed request-controlled data. The diagnostic spells out the safe alternative for each:

• db_query_raw → parameterised @sdbql{ ... #{value} ... } block, or Model.where("x = #{v}", { "v": v }).
• Trusted.* → jailed File.* (read/write/exists), which keeps every operation under the app root.
• System.shell / backticks → System.run(["prog", "arg1", ...]) with an argv array, which never invokes a shell.

Models, migrations, and tests are out of scope — those layers legitimately use these APIs against operator-controlled data.