feat: add industry-specific pre-merge check examples & README

README.md

@@ -10,6 +10,7 @@ This curated list covers the best resources, tutorials, and community content re
 - [Getting Started](#getting-started)
 - [API Reference](#api-reference)
 - [Configuration Examples](#configuration-examples)
+- [Pre-Merge Check Packs](#pre-merge-check-packs)
 - [Integration Guides](#integration-guides)
 - [Video Tutorials](#video-tutorials)
 - [Blogs](#blogs)
@@ -90,6 +91,13 @@ configs/
 └── multi-language/ # Full-stack project configurations
 ```
 
+## Pre-Merge Check Packs
+
+The [pre-merge check catalog](configs/pre-mergechecks/README.md) contains
+copyable policy examples for common engineering risks, multi-tenant SaaS,
+fintech, and health tech. It explains how to select, adapt, and safely introduce
+individual checks without replacing existing repository configuration.
+
 
 ## Integration Guides
 

configs/pre-mergechecks/.coderabbit-data-privacy.yaml

@@ -11,4 +11,4 @@ reviews:
       - name: "Deployment-Ready Config Verification"
         mode: "error"
         instructions: >-
-          When production configuration files are modified, review all new or modified values in those files. Fail if any value contains a placeholder such as `TBD`, `PLACEHOLDER`, `TODO`, `REPLACE_ME`, or an empty string where a real value is required. Fail if required identifiers (workflow IDs, service endpoints, ARNs, connection strings) are not populated with real values. Fail if configuration key names are inconsistent across environments (the same logical setting using different key names in staging vs. production). Pass only when all production configuration values are real, consistent, and deployment-ready.
+          When production configuration files are modified, review all new or modified values in those files. Fail if any value contains a placeholder such as `TBD`, `PLACEHOLDER`, `TODO`, `REPLACE_ME`, or an empty string where a real value is required. Do not flag environment-variable, secret-manager, or template references that are intentionally resolved during deployment. Fail if required identifiers (workflow IDs, service endpoints, ARNs, connection strings) are neither populated nor supplied through one of those mechanisms. Fail if configuration key names are inconsistent across environments. Pass only when production configuration is consistent and deployment-ready.

configs/pre-mergechecks/.coderabbit-fintech.yaml

@@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+language: "en-US"
+reviews:
+  pre_merge_checks:
+    custom_checks:
+      - name: "Use Exact Monetary Arithmetic"
+        mode: "warning"
+        instructions: >-
+          When changed code stores, parses, calculates, or compares monetary amounts, fail if it uses binary floating-point values or constructs an exact decimal type directly from a float or double, such as `BigDecimal(double)` or `Decimal(float)`. Precision may already be lost before conversion. Require decimal-string parsing, integer minor units, or the repository's established money type, with currency and rounding behavior explicit at conversion boundaries. Pass when calculations use an exact representation throughout. Mark not applicable for display-only formatting of an already exact amount and for changes that do not handle money.
+
+      - name: "Make Financial Effects Idempotent"
+        mode: "warning"
+        instructions: >-
+          When changed code creates a charge, refund, payout, transfer, ledger entry, invoice payment, or financial-webhook side effect, fail if retrying the same logical operation can create a duplicate effect. Verify a stable idempotency key, provider event ID, or persisted deduplication record is checked at the side-effect boundary. An in-memory flag is insufficient. Pass when the provider call and local state transition are protected by a durable idempotency mechanism. Mark not applicable for read-only financial operations.
+
+      - name: "Keep Financial Secrets Out of Output"
+        mode: "warning"
+        instructions: >-
+          When changed code emits logs, analytics, errors, traces, or API responses involving financial data, fail if it can expose a full card number, card verification code, bank-account credential, payment-provider secret, or unredacted provider request containing those values. Masking must occur before the value reaches the output call. Pass when only approved tokens, non-sensitive identifiers, or masked values are emitted. Mark not applicable when the PR does not handle financial data or observable output.
+
+      - name: "Audit Financial State Transitions"
+        mode: "warning"
+        instructions: >-
+          When changed code transitions a payment, refund, payout, transfer, invoice, or ledger entry between business states, fail if it bypasses the repository's existing durable audit or domain-event mechanism. Verify the recorded event identifies the affected entity, transition, initiating actor or system, and correlation or provider event ID without including sensitive financial credentials. Pass when the existing audit mechanism is invoked with those fields. Mark not applicable when no financial state transition is added or modified, or when the repository has no established audit mechanism to enforce.

configs/pre-mergechecks/.coderabbit-health-tech.yaml

@@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+language: "en-US"
+reviews:
+  pre_merge_checks:
+    custom_checks:
+      - name: "Keep Health Data Out of Telemetry"
+        mode: "warning"
+        instructions: >-
+          When changed code sends values to logs, traces, metrics, analytics, or error-reporting services, fail if a value can contain protected health information such as patient identity, medical record numbers, diagnoses, medications, test results, appointment details, or raw clinical content. Masking or removal must happen before the telemetry call. Pass when only approved non-sensitive identifiers or masked values are emitted. Mark not applicable when the PR does not change telemetry involving health data.
+
+      - name: "Authorize Patient Record Access"
+        mode: "warning"
+        instructions: >-
+          When a changed API handler, resolver, command, or service reads or mutates a patient or clinical record using an identifier from a request or message, fail if it does not verify that the authenticated principal is permitted to access that specific record. Authentication and tenant scope alone are insufficient. Trace calls to existing guards or policy helpers and verify their behavior before passing. Pass when tenant scope is enforced where applicable and record access is authorized through a verified patient relationship, care-team role, or explicit record policy. Mark not applicable for public reference data and changes that do not access patient records.
+
+      - name: "Minimize Health Data Responses"
+        mode: "warning"
+        instructions: >-
+          When changed server-side code returns patient or clinical data through an API, export, webhook, or third-party integration, fail if it serializes the full persistence model or removes sensitive fields with a denylist. Require an explicit response schema, projection, or allowlist containing only fields needed by that recipient. Pass when output fields are explicitly selected and authorization is applied before serialization. Mark not applicable when no health-data response or disclosure path is added or modified.
+
+      - name: "Audit Clinical Record Changes"
+        mode: "warning"
+        instructions: >-
+          When changed code creates, updates, deletes, or exports patient or clinical records, fail if it bypasses the repository's existing durable audit mechanism. Verify the audit event identifies the acting user or system, affected record or patient identifier, action, timestamp or correlation ID, and outcome without recording raw clinical content. Pass when the established audit mechanism is invoked with those fields. Mark not applicable when no clinical-record operation is added or modified, or when the repository has no established audit mechanism to enforce.

configs/pre-mergechecks/.coderabbit-infrastructure.yaml

@@ -6,7 +6,7 @@ reviews:
       - name: "IaC Template Version Integrity"
         mode: "error"
         instructions: >-
-          When infrastructure-as-code templates (CloudFormation, Terraform modules, Chef cookbooks, Helm charts, Ansible roles) are modified, and functional sections of an IaC template are changed (resources, parameters, outputs, recipes, tasks, or equivalent—not comments or metadata-only fields), the template's version identifier must be incremented. Verify that the version field exists in the modified template and that its value has changed compared to the base branch. Fail if functional changes are present but the version is unchanged. Pass when the version is incremented for any functional change, or when only comments or documentation are modified.
+          When infrastructure-as-code templates (CloudFormation, Terraform modules, Chef cookbooks, Helm charts, Ansible roles) are modified, and functional sections of an IaC template are changed (resources, parameters, outputs, recipes, tasks, or equivalent—not comments or metadata-only fields), enforce version increments only when that template or repository already uses an explicit version field or documented versioning convention. Fail if functional changes are present but the established version is unchanged. Pass when it is incremented or only comments or documentation are modified. Mark not applicable when no version identifier or convention exists.
 
       - name: "Chart Dependency Lock Consistency"
         mode: "warning"

configs/pre-mergechecks/.coderabbit-multi-tenant-saas.yaml

@@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+language: "en-US"
+reviews:
+  pre_merge_checks:
+    custom_checks:
+      - name: "Require Tenant-Scoped Data Access"
+        mode: "warning"
+        instructions: >-
+          When changed server-side code reads or mutates tenant-owned records, fail if the operation can select records by a resource ID or other global criteria without also constraining access to the authenticated tenant or an explicitly authorized cross-tenant scope. A tenant ID supplied only by the request is not proof of authorization; verify it is matched to trusted authentication context or an existing authorization policy. Pass when every applicable operation is tenant-scoped or calls a verified central policy that enforces the same constraint. Mark not applicable when the PR does not access tenant-owned data or the affected data is explicitly global.
+
+      - name: "Partition Tenant Cache Entries"
+        mode: "warning"
+        instructions: >-
+          When changed code reads or writes cached tenant-owned data, fail if the cache key or namespace omits the trusted tenant identifier or another trusted authorization dimension that changes the cached value, such as user, role, delegated scope, or resource permissions. Do not require access-control dimensions that affect only whether a caller may read an otherwise identical value. Pass when the key includes every dimension that changes the value, a verified cache helper adds them, or sharing is explicitly intentional. Mark not applicable for public, immutable, explicitly global, or non-cached data.
+
+      - name: "Authorize Privileged Tenant Changes"
+        mode: "warning"
+        instructions: >-
+          When a changed handler or service can alter tenant membership, roles, permissions, billing settings, security settings, or tenant ownership, fail if no authorization check is executed before the mutation. Verify the check by following calls to existing middleware, guards, or policy helpers; do not accept a function name as evidence without inspecting its behavior. Pass when the code requires an appropriate privileged role or a verified central policy. Mark not applicable when the PR does not add or modify a privileged tenant operation.
+
+      - name: "Scope Asynchronous Tenant Work"
+        mode: "warning"
+        instructions: >-
+          When changed producers or consumers enqueue, receive, or process work for tenant-owned resources, fail if the message lacks trusted tenant context or if the consumer loads the resource without verifying that it belongs to that tenant before causing side effects. Pass when both message context and resource access are tenant-scoped, or when the referenced job framework can be verified to enforce tenant scope centrally. Mark not applicable for global jobs and changes that do not process tenant-owned resources asynchronously.

configs/pre-mergechecks/.coderabbit-performance.yaml

@@ -6,4 +6,4 @@ reviews:
       - name: "Runtime Efficiency and Scaling Review"
         mode: "error"
         instructions: >-
-          Review changed code for material performance regressions. Flag O(n²) or worse behavior in any path that processes non-trivially sized input, including request handlers, background jobs, rendering paths, and collection iteration. Flag N+1 query patterns—database or external service calls inside a loop that should be batched, joined, or preloaded. Flag repeated recomputation of deterministic values inside loops where caching, memoization, or pre-computation outside the loop would eliminate redundant work. Flag inefficient data structure choices such as linear-search arrays for membership checks where a hash set is appropriate. Flag unbounded data accumulation, missing pagination, or caches without eviction. Flag expensive synchronous work (compression, hashing, template rendering) in hot paths where it should be deferred or sampled. Report only issues that could materially degrade latency, throughput, or resource usage at realistic input sizes—ignore micro-optimizations and speculative concerns.
+          Review changed code for material performance regressions. Flag O(n²) or worse behavior in paths that process non-trivially sized input. Flag N+1 query patterns—database or external service calls inside a loop that should be batched, joined, or preloaded. Flag repeated recomputation of deterministic values inside loops where caching or pre-computation would eliminate redundant work. Flag inefficient data structure choices such as linear-search arrays for membership checks where a hash set is appropriate. Flag unbounded data accumulation, missing pagination, or caches without eviction. Flag expensive synchronous work (compression, hashing, template rendering) in hot paths where it should be deferred or sampled. Report only issues that could materially degrade latency, throughput, or resource usage at realistic input sizes; ignore micro-optimizations and speculative concerns.

configs/pre-mergechecks/.coderabbit-security.yaml

@@ -6,7 +6,7 @@ reviews:
       - name: "Query Parameterization Enforcement"
         mode: "error"
         instructions: >-
-          Review all new or modified database query construction. Fail if any query is built by concatenating or interpolating user-supplied input directly into a SQL string. Use parameterized queries or prepared statements with placeholders for all external values. Reuse prepared statements for repeated queries rather than rebuilding them per call. Flag any string-building approach to query construction and require it to be replaced with parameterized equivalents before merging.
+          Review all new or modified database query construction. Fail if a query is built by concatenating or interpolating user-supplied or otherwise untrusted input directly into executable query text. Use parameterized queries or prepared statements with placeholders for external values. Do not flag composition from fixed, code-defined fragments or identifiers selected through a strict allowlist. Pass when no untrusted value can alter query structure.
 
       - name: "Sensitive Output Leak Prevention"
         mode: "error"
@@ -16,12 +16,12 @@ reviews:
       - name: "Top Vulnerability Pattern Audit"
         mode: "warning"
         instructions: >-
-          Review all changed code against the OWASP Top 10 for Web (2021) and API Security (2023). Flag broken access control (missing authorization checks, insecure direct object references, privilege escalation paths); cryptographic failures (hardcoded secrets, weak algorithms such as MD5/SHA1/DES, unencrypted sensitive data in transit or at rest); injection vulnerabilities (SQL, NoSQL, OS command, or expression-language injection via unsanitized input); security misconfiguration (default credentials, verbose error messages exposing stack traces, permissive IAM policies); vulnerable or outdated components with published CVEs; identification and authentication failures (weak session management, improper token validation); and SSRF (user-controlled URLs passed to server-side HTTP requests without allowlisting). For API endpoints, additionally flag broken object-level authorization, unrestricted resource consumption without rate limiting or pagination, and over-fetching of sensitive fields in responses. Post each finding as a comment on the affected line with a brief remediation note.
+          Review changed code against the OWASP Top 10 for Web (2021) and API Security (2023). Flag broken access control; hardcoded secrets, weak cryptography, or unencrypted sensitive data; SQL, NoSQL, command, or expression-language injection; default credentials, verbose errors, or permissive IAM; dependencies with applicable published CVEs; weak session management or token validation; and user-controlled URLs passed to server-side requests without allowlisting. For APIs, also flag missing object-level authorization, unrestricted resource consumption without rate limits or pagination, and over-fetching of sensitive response fields. Report only evidence found in changed code and include a brief remediation in the check summary.
 
       - name: "Dependency Risk Assessment"
         mode: "warning"
         instructions: >-
-          When dependency manifests (package.json, pom.xml, requirements.txt, go.mod, Gemfile, etc.) are modified, review newly added or upgraded third-party libraries. Flag any dependency with known security vulnerabilities in public advisory databases. Flag libraries with non-permissive licenses (e.g., AGPL, GPL) when the project requires permissive licenses (e.g., MIT, Apache 2.0). Pay particular attention to libraries that handle authentication, payments, healthcare data, or cryptography. Require explicit justification in the PR description for any dependency that introduces significant legal or security risk.
+          When dependency manifests, constraints, or lock files are modified, review every changed direct and resolved transitive dependency version, including additions, upgrades, and downgrades. Flag a security vulnerability only after verifying that a public advisory applies to the resolved version; return inconclusive when the version or affected range cannot be established. Flag non-permissive licenses (e.g., AGPL, GPL) only when the repository documents a permissive-license policy. Pay particular attention to libraries handling authentication, payments, health data, or cryptography. Require PR justification for a verified legal or security risk.
 
       - name: "Personal Data Exposure Guard"
         mode: "error"