@n8n/eslint-plugin-community-nodes 0.26.0 → 0.27.0

package/src/rules/credential-password-field.ts

@@ -6,47 +6,11 @@ import {
 	findClassProperty,
 	findObjectProperty,
 	getStringLiteralValue,
-	getBooleanLiteralValue,
+	isSensitiveName,
+	hasPasswordTypeOption,
 	createRule,
 } from '../utils/index.js';
 
-const SENSITIVE_PATTERNS = [
-	'password',
-	'secret',
-	'token',
-	'cert',
-	'passphrase',
-	'apikey',
-	'secretkey',
-	'privatekey',
-	'authkey',
-];
-
-const NON_SENSITIVE_PATTERNS = ['url', 'pub', 'id'];
-
-function isSensitiveFieldName(name: string): boolean {
-	const lowerName = name.toLowerCase();
-
-	if (NON_SENSITIVE_PATTERNS.some((pattern) => lowerName.includes(pattern))) {
-		return false;
-	}
-
-	return SENSITIVE_PATTERNS.some((pattern) => lowerName.includes(pattern));
-}
-
-function hasPasswordTypeOption(element: TSESTree.ObjectExpression): boolean {
-	const typeOptionsProperty = findObjectProperty(element, 'typeOptions');
-
-	if (typeOptionsProperty?.value.type !== TSESTree.AST_NODE_TYPES.ObjectExpression) {
-		return false;
-	}
-
-	const passwordProperty = findObjectProperty(typeOptionsProperty.value, 'password');
-	const passwordValue = passwordProperty ? getBooleanLiteralValue(passwordProperty.value) : null;
-
-	return passwordValue === true;
-}
-
 function createPasswordFix(
 	element: TSESTree.ObjectExpression,
 	typeOptionsProperty: TSESTree.Property | null,
@@ -87,7 +51,7 @@ export const CredentialPasswordFieldRule = createRule({
 	meta: {
 		type: 'problem',
 		docs: {
-			description: 'Ensure credential fields with sensitive names have typeOptions.password = true',
+			description: 'Ensure fields with sensitive names have typeOptions.password = true',
 		},
 		messages: {
 			missingPasswordOption:
@@ -120,7 +84,7 @@ export const CredentialPasswordFieldRule = createRule({
 					const nameProperty = findObjectProperty(element, 'name');
 					const fieldName = nameProperty ? getStringLiteralValue(nameProperty.value) : null;
 
-					if (!fieldName || !isSensitiveFieldName(fieldName)) {
+					if (!fieldName || !isSensitiveName(fieldName)) {
 						continue;
 					}
 

package/src/rules/credential-unnecessary-password.test.ts

@@ -0,0 +1,105 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { CredentialUnnecessaryPasswordRule } from './credential-unnecessary-password.js';
+
+const ruleTester = new RuleTester();
+
+function createCredentialCode(properties: string[]): string {
+	return `
+import type { ICredentialType, INodeProperties } from 'n8n-workflow';
+
+export class TestCredential implements ICredentialType {
+	name = 'testApi';
+	displayName = 'Test API';
+
+	properties: INodeProperties[] = [
+${properties.map((prop) => `\t\t${prop}`).join(',\n')},
+	];
+}`;
+}
+
+function createProperty(
+	displayName: string,
+	name: string,
+	options: { password?: boolean } = {},
+): string {
+	const typeOptionsStr =
+		options.password !== undefined ? `\n\t\t\ttypeOptions: { password: ${options.password} },` : '';
+
+	return `{
+			displayName: '${displayName}',
+			name: '${name}',
+			type: 'string',
+			default: '',${typeOptionsStr}
+		}`;
+}
+
+function createRegularClass(): string {
+	return `
+export class RegularClass {
+	properties = [
+		{
+			name: 'region',
+			type: 'string',
+			typeOptions: { password: true },
+		},
+	];
+}`;
+}
+
+ruleTester.run('credential-unnecessary-password', CredentialUnnecessaryPasswordRule, {
+	valid: [
+		{
+			name: 'non-sensitive field without password option',
+			code: createCredentialCode([createProperty('Region', 'region')]),
+		},
+		{
+			name: 'non-sensitive field with password: false',
+			code: createCredentialCode([createProperty('Base URL', 'baseUrl', { password: false })]),
+		},
+		{
+			name: 'sensitive field correctly masked',
+			code: createCredentialCode([createProperty('API Key', 'apiKey', { password: true })]),
+		},
+		{
+			name: 'masked field with a sensitive marker is left alone even when its name contains a non-sensitive substring',
+			code: createCredentialCode([
+				// 'androidToken' contains the non-sensitive substring 'id' but is a real secret
+				createProperty('Android Token', 'androidToken', { password: true }),
+				createProperty('Token URL', 'tokenUrl', { password: true }),
+			]),
+		},
+		{
+			name: 'class does not implement ICredentialType',
+			code: createRegularClass(),
+		},
+	],
+	invalid: [
+		{
+			name: 'region field should not use password option',
+			code: createCredentialCode([createProperty('Region', 'region', { password: true })]),
+			errors: [{ messageId: 'unnecessaryPasswordOption', data: { fieldName: 'region' } }],
+		},
+		{
+			name: 'URL field should not use password option',
+			code: createCredentialCode([createProperty('Base URL', 'baseUrl', { password: true })]),
+			errors: [{ messageId: 'unnecessaryPasswordOption', data: { fieldName: 'baseUrl' } }],
+		},
+		{
+			name: 'ID field should not use password option',
+			code: createCredentialCode([createProperty('Client ID', 'clientId', { password: true })]),
+			errors: [{ messageId: 'unnecessaryPasswordOption', data: { fieldName: 'clientId' } }],
+		},
+		{
+			name: 'multiple non-sensitive masked fields are each flagged',
+			code: createCredentialCode([
+				createProperty('Region', 'region', { password: true }),
+				createProperty('Host', 'host', { password: true }),
+			]),
+			errors: [
+				{ messageId: 'unnecessaryPasswordOption', data: { fieldName: 'region' } },
+				{ messageId: 'unnecessaryPasswordOption', data: { fieldName: 'host' } },
+			],
+		},
+	],
+});

package/src/rules/credential-unnecessary-password.ts

@@ -0,0 +1,72 @@
+import { TSESTree } from '@typescript-eslint/utils';
+
+import {
+	isCredentialTypeClass,
+	findClassProperty,
+	findObjectProperty,
+	getStringLiteralValue,
+	isSensitiveName,
+	hasPasswordTypeOption,
+	createRule,
+} from '../utils/index.js';
+
+export const CredentialUnnecessaryPasswordRule = createRule({
+	name: 'credential-unnecessary-password',
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description:
+				'Warn when a credential field with no sensitive name uses typeOptions.password = true',
+		},
+		messages: {
+			unnecessaryPasswordOption:
+				"Field '{{ fieldName }}' does not appear to be sensitive but uses 'typeOptions: { password: true }'. Remove it unless the field holds a secret",
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		return {
+			ClassDeclaration(node) {
+				if (!isCredentialTypeClass(node)) {
+					return;
+				}
+
+				const propertiesProperty = findClassProperty(node, 'properties');
+				if (
+					!propertiesProperty?.value ||
+					propertiesProperty.value.type !== TSESTree.AST_NODE_TYPES.ArrayExpression
+				) {
+					return;
+				}
+
+				for (const element of propertiesProperty.value.elements) {
+					if (element?.type !== TSESTree.AST_NODE_TYPES.ObjectExpression) {
+						continue;
+					}
+
+					const nameProperty = findObjectProperty(element, 'name');
+					const fieldName = nameProperty ? getStringLiteralValue(nameProperty.value) : null;
+
+					if (!fieldName || !hasPasswordTypeOption(element)) {
+						continue;
+					}
+
+					// Only flag a masked field when its name carries no sensitive marker at all.
+					// We check with `exclusions: []` (raw patterns, no URL/ID/pub exclusions) so a
+					// real secret like `androidToken` — non-sensitive under the default exclusions
+					// only because it contains the substring `id` — is not wrongly flagged.
+					// Reported without a fix: removing masking could still be wrong for an
+					// unlisted secret name, so the author confirms.
+					if (!isSensitiveName(fieldName, { exclusions: [] })) {
+						context.report({
+							node: element,
+							messageId: 'unnecessaryPasswordOption',
+							data: { fieldName },
+						});
+					}
+				}
+			},
+		};
+	},
+});

package/src/rules/index.ts

@@ -6,6 +6,7 @@ import { CredClassOAuth2NamingRule } from './cred-class-oauth2-naming.js';
 import { CredentialDocumentationUrlRule } from './credential-documentation-url.js';
 import { CredentialPasswordFieldRule } from './credential-password-field.js';
 import { CredentialTestRequiredRule } from './credential-test-required.js';
+import { CredentialUnnecessaryPasswordRule } from './credential-unnecessary-password.js';
 import { IconPreferThemedVariantsRule } from './icon-prefer-themed-variants.js';
 import { IconValidationRule } from './icon-validation.js';
 import { MissingPairedItemRule } from './missing-paired-item.js';
@@ -13,20 +14,25 @@ import { N8nObjectValidationRule } from './n8n-object-validation.js';
 import { NoBuilderHintLeakageRule } from './no-builder-hint-leakage.js';
 import { NoCredentialReuseRule } from './no-credential-reuse.js';
 import { NoDangerousFunctionsRule } from './no-dangerous-functions.js';
+import { NoDeadFilesRule } from './no-dead-files.js';
 import { NoDeprecatedWorkflowFunctionsRule } from './no-deprecated-workflow-functions.js';
 import { NoEmojiInOptionsRule } from './no-emoji-in-options.js';
 import { NoForbiddenLifecycleScriptsRule } from './no-forbidden-lifecycle-scripts.js';
+import { NoHardcodedSecretsRule } from './no-hardcoded-secrets.js';
 import { NoHttpRequestWithManualAuthRule } from './no-http-request-with-manual-auth.js';
 import { NoOverridesFieldRule } from './no-overrides-field.js';
 import { NoRestrictedGlobalsRule } from './no-restricted-globals.js';
 import { NoRestrictedImportsRule } from './no-restricted-imports.js';
 import { NoRuntimeDependenciesRule } from './no-runtime-dependencies.js';
+import { NoSilentErrorSwallowingRule } from './no-silent-error-swallowing.js';
 import { NoTemplatePlaceholdersRule } from './no-template-placeholders.js';
 import { NodeClassDescriptionIconMissingRule } from './node-class-description-icon-missing.js';
 import { NodeConnectionTypeLiteralRule } from './node-connection-type-literal.js';
 import { NodeRegistrationCompleteRule } from './node-registration-complete.js';
 import { NodeUsableAsToolRule } from './node-usable-as-tool.js';
 import { PackageNameConventionRule } from './package-name-convention.js';
+import { RequireFilesArrayRule } from './require-files-array.js';
+import { RequireHomepageRule } from './require-homepage.js';
 import { RequireNodeApiErrorRule } from './require-node-api-error.js';
 import { RequireNodeDescriptionFieldsRule } from './require-node-description-fields.js';
 import { RequireVersionRule } from './require-version.js';
@@ -48,12 +54,16 @@ export const rules = {
 	'node-usable-as-tool': NodeUsableAsToolRule,
 	'package-name-convention': PackageNameConventionRule,
 	'credential-test-required': CredentialTestRequiredRule,
+	'credential-unnecessary-password': CredentialUnnecessaryPasswordRule,
 	'no-credential-reuse': NoCredentialReuseRule,
 	'no-dangerous-functions': NoDangerousFunctionsRule,
+	'no-dead-files': NoDeadFilesRule,
 	'no-forbidden-lifecycle-scripts': NoForbiddenLifecycleScriptsRule,
+	'no-hardcoded-secrets': NoHardcodedSecretsRule,
 	'no-http-request-with-manual-auth': NoHttpRequestWithManualAuthRule,
 	'no-overrides-field': NoOverridesFieldRule,
 	'no-runtime-dependencies': NoRuntimeDependenciesRule,
+	'no-silent-error-swallowing': NoSilentErrorSwallowingRule,
 	'no-template-placeholders': NoTemplatePlaceholdersRule,
 	'icon-validation': IconValidationRule,
 	'icon-prefer-themed-variants': IconPreferThemedVariantsRule,
@@ -68,6 +78,8 @@ export const rules = {
 	'missing-paired-item': MissingPairedItemRule,
 	'no-builder-hint-leakage': NoBuilderHintLeakageRule,
 	'n8n-object-validation': N8nObjectValidationRule,
+	'require-files-array': RequireFilesArrayRule,
+	'require-homepage': RequireHomepageRule,
 	'require-node-api-error': RequireNodeApiErrorRule,
 	'require-node-description-fields': RequireNodeDescriptionFieldsRule,
 	'require-version': RequireVersionRule,

package/src/rules/no-dead-files.test.ts

@@ -0,0 +1,128 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { isDeadFileName, NoDeadFilesRule } from './no-dead-files.js';
+import * as fileUtils from '../utils/file-utils.js';
+
+vi.mock('../utils/file-utils.js', async () => {
+	const actual = await vi.importActual('../utils/file-utils.js');
+	return {
+		...actual,
+		findFilesInPackageDirs: vi.fn(),
+	};
+});
+
+const mockFindFilesInPackageDirs = vi.mocked(fileUtils.findFilesInPackageDirs);
+
+const packageJsonPath = '/tmp/package.json';
+
+const ruleTester = new RuleTester();
+
+function setup(deadFiles: string[]): void {
+	mockFindFilesInPackageDirs.mockReturnValue(deadFiles);
+}
+
+afterEach(() => {
+	vi.clearAllMocks();
+});
+
+// Default: no dead files on disk.
+setup([]);
+
+ruleTester.run('no-dead-files', NoDeadFilesRule, {
+	valid: [
+		{
+			name: 'package with no dead files',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example", "n8n": { "nodes": ["dist/nodes/Foo/Foo.node.js"] } }',
+		},
+		{
+			name: 'non-package.json file is ignored',
+			filename: 'some-config.json',
+			code: '{ "name": "n8n-nodes-example" }',
+			before() {
+				setup(['/tmp/nodes/Foo/Foo.node.ts.bak']);
+			},
+		},
+	],
+	invalid: [
+		{
+			name: 'single backup file is reported',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example" }',
+			before() {
+				setup(['/tmp/nodes/Foo/Foo.node.ts.bak']);
+			},
+			errors: [
+				{
+					messageId: 'deadFileFound',
+					data: { file: 'nodes/Foo/Foo.node.ts.bak' },
+				},
+			],
+		},
+		{
+			name: 'multiple dead files are each reported',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example" }',
+			before() {
+				setup([
+					'/tmp/nodes/Foo/Foo.node.ts.backup',
+					'/tmp/nodes/Foo/test.js',
+					'/tmp/nodes/Bar/Bar.node.ts:Zone.Identifier',
+				]);
+			},
+			errors: [
+				{ messageId: 'deadFileFound', data: { file: 'nodes/Foo/Foo.node.ts.backup' } },
+				{ messageId: 'deadFileFound', data: { file: 'nodes/Foo/test.js' } },
+				{ messageId: 'deadFileFound', data: { file: 'nodes/Bar/Bar.node.ts:Zone.Identifier' } },
+			],
+		},
+		{
+			name: 'stray test.ts file is reported',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example" }',
+			before() {
+				setup(['/tmp/nodes/test.ts']);
+			},
+			errors: [{ messageId: 'deadFileFound', data: { file: 'nodes/test.ts' } }],
+		},
+		{
+			name: 'dead file in credentials directory is reported',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example" }',
+			before() {
+				setup(['/tmp/credentials/MyApi.credentials.ts.bak']);
+			},
+			errors: [
+				{ messageId: 'deadFileFound', data: { file: 'credentials/MyApi.credentials.ts.bak' } },
+			],
+		},
+	],
+});
+
+describe('isDeadFileName', () => {
+	it.each([
+		'Foo.node.ts.backup',
+		'notes.backup',
+		'Foo.node.ts.bak',
+		'archive.bak',
+		'Zone.Identifier',
+		'Foo.node.ts:Zone.Identifier',
+		'test.js',
+		'test.ts',
+	])('flags %s as a dead file', (fileName) => {
+		expect(isDeadFileName(fileName)).toBe(true);
+	});
+
+	it.each([
+		'Foo.node.ts',
+		'Foo.node.js',
+		'index.ts',
+		'test.json',
+		'mytest.js',
+		'backup.ts',
+		'GenericFunctions.ts',
+	])('does not flag %s', (fileName) => {
+		expect(isDeadFileName(fileName)).toBe(false);
+	});
+});

package/src/rules/no-dead-files.ts

@@ -0,0 +1,71 @@
+import type { TSESTree } from '@typescript-eslint/utils';
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import * as path from 'node:path';
+
+import { createRule, findFilesInPackageDirs } from '../utils/index.js';
+
+// Package subdirectories that ship in the published artifact and should stay clean.
+const SCAN_DIRS = ['nodes', 'credentials'];
+
+const DEAD_FILE_MATCHERS: Array<(fileName: string) => boolean> = [
+	(fileName) => fileName.endsWith('.backup'),
+	(fileName) => fileName.endsWith('.bak'),
+	// Windows "mark of the web" ADS files, extracted as literal filenames on
+	// filesystems without alternate data streams (e.g. `Foo.node.ts:Zone.Identifier`).
+	(fileName) => fileName.endsWith('Zone.Identifier'),
+	(fileName) => fileName === 'test.js',
+	(fileName) => fileName === 'test.ts',
+];
+
+/**
+ * Returns true if the given filename looks like a leftover backup, editor, or
+ * test-artifact file that should not ship with a community node.
+ */
+export function isDeadFileName(fileName: string): boolean {
+	return DEAD_FILE_MATCHERS.some((matches) => matches(fileName));
+}
+
+export const NoDeadFilesRule = createRule({
+	name: 'no-dead-files',
+	meta: {
+		type: 'problem',
+		docs: {
+			description:
+				'Disallow leftover backup, editor, and test-artifact files in the `nodes/` and `credentials/` directories of a community node package',
+		},
+		messages: {
+			deadFileFound:
+				'Remove the leftover file "{{ file }}". Backup, editor, and test-artifact files should not be published with a community node.',
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		if (!context.filename.endsWith('package.json')) {
+			return {};
+		}
+
+		return {
+			ObjectExpression(node: TSESTree.ObjectExpression) {
+				// Only inspect the root object of the package.json file, so the scan runs once.
+				if (node.parent?.type !== AST_NODE_TYPES.ExpressionStatement) {
+					return;
+				}
+
+				const packageDir = path.dirname(context.filename);
+
+				for (const deadFile of findFilesInPackageDirs(
+					context.filename,
+					SCAN_DIRS,
+					isDeadFileName,
+				)) {
+					context.report({
+						node,
+						messageId: 'deadFileFound',
+						data: { file: path.relative(packageDir, deadFile) },
+					});
+				}
+			},
+		};
+	},
+});

package/src/rules/no-hardcoded-secrets.test.ts

@@ -0,0 +1,124 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { NoHardcodedSecretsRule } from './no-hardcoded-secrets.js';
+
+const ruleTester = new RuleTester();
+
+// A 40-char hex string (SHA-1 shaped) — a realistic hardcoded secret value.
+const HEX_SECRET = 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0';
+// A base64/token-shaped value with mixed case, digits and punctuation.
+const TOKEN_SECRET = 'sk-1a2B3c4D5e6F7g8H9i0J-kLmNoP';
+
+ruleTester.run('no-hardcoded-secrets', NoHardcodedSecretsRule, {
+	valid: [
+		// Non-secret variable names are never inspected.
+		{ name: 'non-secret variable name', code: `const label = '${HEX_SECRET}';` },
+		{ name: 'unrelated name with long value', code: `const description = '${TOKEN_SECRET}';` },
+
+		// Secret-named variables with short values are ignored (< 16 chars).
+		{ name: 'short secret value', code: "const apiKey = 'short';" },
+		{ name: '15 chars, below minimum', code: "const token = 'abcdef012345678';" },
+
+		// Secret-named variables holding prose / human-readable strings.
+		{
+			name: 'secret name with human text',
+			code: "const passwordHint = 'Enter your account password here';",
+		},
+		{
+			name: 'secret name with spaces in value',
+			code: "const secretNote = 'this is not a secret';",
+		},
+
+		// Plain long camelCase word is not token-shaped (no digits/punctuation).
+		{ name: 'long word without digits', code: "const tokenName = 'anExtraordinarilyLongName';" },
+
+		// Dotted / hyphenated / snake_case constants without a digit+letter mix
+		// are common (scopes, paths, ids) and must not be treated as secrets.
+		{ name: 'dotted scope string', code: "const authScope = 'read.write.admin.profile.email';" },
+		{ name: 'hyphenated slug', code: "const secretName = 'my-very-long-descriptive-slug';" },
+		{ name: 'snake_case constant', code: "const tokenType = 'refresh_token_grant_type_value';" },
+
+		// Secret-shaped name but non-secret value: the value gate, not the name,
+		// is what decides. `tokenId` no longer benefits from a name exclusion, so
+		// this proves a benign value still passes on its own merits.
+		{
+			name: 'tokenId with human-readable value',
+			code: "const tokenId = 'primary-session-reference';",
+		},
+
+		// Obvious placeholders are skipped.
+		{ name: 'placeholder value', code: "const apiKey = 'your-api-key-goes-here-xxxx';" },
+		{ name: 'example placeholder', code: `const secret = 'example-secret-${HEX_SECRET}';` },
+
+		// Not a static string literal.
+		{ name: 'value from env', code: 'const apiKey = process.env.API_KEY;' },
+		// The payload must itself contain `${` to be a real template literal.
+		// eslint-disable-next-line n8n-local-rules/no-interpolation-in-regular-string
+		{ name: 'template literal with expression', code: 'const token = `${suffix}`;' },
+		{ name: 'computed member assignment', code: `obj[key] = '${HEX_SECRET}';` },
+	],
+	invalid: [
+		{
+			name: 'SECURITY: exactly 16 chars is flagged (minimum length)',
+			code: "const token = 'abcdef0123456789';",
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'token' } }],
+		},
+		{
+			name: 'SECURITY: hex secret in variable',
+			code: `const apiKey = '${HEX_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'apiKey' } }],
+		},
+		{
+			name: 'SECURITY: token-shaped secret in variable',
+			code: `const accessToken = '${TOKEN_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'accessToken' } }],
+		},
+		{
+			name: 'SECURITY: secret in object property (identifier key)',
+			code: `const config = { clientSecret: '${HEX_SECRET}' };`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'clientSecret' } }],
+		},
+		{
+			name: 'SECURITY: secret in object property (string key)',
+			code: `const config = { 'api_key': '${HEX_SECRET}' };`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'api_key' } }],
+		},
+		{
+			name: 'SECURITY: secret in class field',
+			code: `class C { private password = '${TOKEN_SECRET}'; }`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'password' } }],
+		},
+		{
+			name: 'SECURITY: secret in member assignment',
+			code: `this.authToken = '${HEX_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'authToken' } }],
+		},
+		{
+			name: 'SECURITY: secret in identifier assignment',
+			code: `secretKey = '${TOKEN_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'secretKey' } }],
+		},
+		{
+			name: 'SECURITY: secret in no-expression template literal',
+			code: `const apiKey = \`${HEX_SECRET}\`;`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'apiKey' } }],
+		},
+		// No name exclusions: a secret-shaped value is flagged even when the name
+		// also contains a normally-"non-sensitive" fragment (url/pub/id).
+		{
+			name: 'SECURITY: secret on name containing "pub"',
+			code: `const publicKey = '${HEX_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'publicKey' } }],
+		},
+		{
+			name: 'SECURITY: secret on name containing "id"',
+			code: `const tokenId = '${HEX_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'tokenId' } }],
+		},
+		{
+			name: 'SECURITY: secret on name containing "url"',
+			code: `const tokenUrl = '${TOKEN_SECRET}';`,
+			errors: [{ messageId: 'hardcodedSecret', data: { name: 'tokenUrl' } }],
+		},
+	],
+});