CAIN-42 CAIN StudioThe checks
Severity as of the 2026-11-02 engine (in the repository; live after the next gateway deploy).
| Check | Finds | Severity |
|---|---|---|
rng_fabrication | A random number returned as a measurement, score or result | CRITICAL / HIGH (LOW for ids, keys, jitter) |
route_engine_mismatch | A route calling an engine method that does not exist | CRITICAL |
hardcoded_success_claim | A typed-in pass count, score or "verified" with no computation behind it | MEDIUM-HIGH |
mock_data_literal | Variables named fake_result, mock_data, simulated_… in shipped code | HIGH |
swallowed_import_error | A failed import silently ignored (LOW for recognised fallback idioms) | HIGH |
unconditional_verdict, check_cannot_fail | A verifier that returns valid without comparing anything | MEDIUM |
error_grants_access | An exception path that returns True for a permission check | MEDIUM |
mock_in_production, fixed_result, fake_encryption, dependency_status_unchecked | A MagicMock as the database; a hard-coded answer; encrypt() that only encodes; a health check that never calls the dependency | MEDIUM |
placeholder_marker | TODO / STUB / PLACEHOLDER / MOCK / FAKE comments (FIXME / XXX now LOW) | MEDIUM |
bare_except_pass | Every error swallowed with no logging (LOW for cleanup, fail-closed, try/else) | MEDIUM |
placeholder_route | An API route that returns a canned answer | MEDIUM (was LOW) |
fake_check_timestamp | "last_checked: now" with no check performed | MEDIUM (was LOW) |
always_pass | A result object whose pass flag is a constant True | MEDIUM (was LOW) |
unverified_signature_count | Counting "valid signatures" without verifying any | MEDIUM (was LOW) |
secret_written_world_readable | A key or secret written to a file others can read | MEDIUM (was LOW) |
tenant_store_unscoped | A tenant route reading the whole store, unfiltered | MEDIUM (was LOW) |
secret_compare_not_constant_time | A MAC, signature, API key or token compared with == | MEDIUM (was LOW) |
tenant_param_ignored | A route given a tenant id that never uses it | LOW (1 benchmark false alarm) |
error_counted_as_success | A loop that counts a failed attempt as done | LOW (1 benchmark false alarm) |
hardcoded_success, logged_and_continued | A literal "status: ok"; an error logged and ignored | LOW |
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.