VNX-1110: Incomplete Design Documentation

A design, architecture, ADR or RFC document with a section that is empty or holds only a placeholder such as TBD or TODO.

Field	Value
Rule ID	`VNX-1110`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Any file
CWE	CWE-1110
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`documentation` `incomplete-design-documentation` `cwe-1110`
Source	`internal/sast/rules/vnx-1110.rego`

Overview

VNX-1110 maps to CWE-1110: Incomplete Design Documentation. It reads Markdown design documents and reports sections that were never written.

Why This Matters

A design document is where a reviewer learns the trust boundaries, the threat model and the data flows. A section headed “Threat model” whose body is TBD reads as if the question was considered, when nobody answered it. Reviews and audits that rely on the document then miss what it does not say.

What Gets Flagged

Design documents are Markdown files named or filed as design, architecture, ADR, RFC, proposal or threat-model documents (DESIGN.md, ARCHITECTURE.md, docs/design/*, docs/adr/*, rfcs/*).

## Threat model

TBD                          <!-- FLAGGED: the section is only a placeholder -->

## Security considerations   <!-- FLAGGED: empty, the next heading follows -->

## Deployment

Placeholders recognised: TBD, TBC, TODO, FIXME, WIP, “To be written/determined/decided/defined”, “Coming soon”, .... A heading with nothing before the next heading of the same or a higher level, or before the end of the file, is reported as empty.

What Does Not Get Flagged

README files and other prose that is not a design document.
Templates (0000-template.md, files under templates/), whose placeholders are deliberate, and files where “design” is only part of a word (designer-onboarding.md).
A placeholder word inside a sentence (“The period is TBD by legal; until then we keep 30 days”).
A section that holds only subsections.
Anything inside a fenced code block.

Remediation

Write the section, or delete the heading if the topic does not apply and say so in one line.
For sections deliberately left for later, track the work in an issue and link it from the section.

References

CWE-1110: Incomplete Design Documentation

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1110
// nosec vnx-1110

Or record an ignore rule: vulnetix ignore add --rule vnx-1110 --reason "...". See Suppressing findings.