R003 · no-injection
Frontmatter free of injection vectors
- Code: R003
- Slug:
no-injection - Tier: structure
- Default severity: error
- Packages: minimal, recommended, strict
- Locked: Yes (safety: cannot be disabled or demoted)
- Doc: https://doraval.dev/reference/rules/R003
| What | Scans every string in frontmatter for < or > characters. Locked (safety). |
| Why | Angle brackets can be read as tags and inject instructions when Level‑1 metadata enters a system prompt. |
How to fix
Remove < and > from frontmatter values, or move that text into the Markdown body where it is not treated as metadata.