Why this matters
Live I/O introduces slowness, nondeterminism, and external failures unrelated to the code.
Unit tests must stub or fake external HTTP/DB calls; allow real I/O only in integration/e2e tests tagged accordingly.
Live I/O introduces slowness, nondeterminism, and external failures unrelated to the code.
Side-by-side examples engineers can pattern-match during review.
test("loads profile", () => {
const res = http.get("https://api.example.com/profile/42");
assertEquals(res.status, 200);
});test("loads profile (stubbed)", () => {
const http = fakeHttp({"/profile/42": {status: 200, body: {id: 42}}});
const res = http.get("/profile/42");
assertEquals(res.status, 200);
});unit: uses fakeHttp()/mockClient()unit: calls https://...From the same buckets as this rule.
Reject PRs adding real PAN/CVV in fixtures, seeds, or mocks. Only use Luhn-valid test PANs from the gateway or opaque tokens (e.g., tok_) and never include CVV. Add a check to fail if a PAN regex is matched. (PCI DSS data minimization)