eslint-plugin-anthropic-security 0.1.0 → 0.2.0

package/README.md

@@ -1,7 +1,11 @@
 <p align="center">
-  <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security" target="blank"><img src="https://eslint.interlace.tools/icon-light.svg" alt="Interlace" height="90" /></a>
+  <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security" target="blank"><img src="https://eslint.interlace.tools/logos/interlace.svg" alt="Interlace" height="90" /></a>
   &nbsp;&nbsp;
-  <a href="https://eslint.org" target="_blank"><img src="https://eslint.interlace.tools/eslint-logo.svg" alt="ESLint" height="90" /></a>
+  <a href="https://docs.anthropic.com" target="_blank"><img src="https://eslint.interlace.tools/logos/claude.svg" alt="Anthropic Claude SDK" height="90" /></a>
+  &nbsp;&nbsp;
+  <a href="https://oxc.rs" target="_blank"><img src="https://eslint.interlace.tools/logos/oxlint.svg" alt="oxlint" height="90" /></a>
+  &nbsp;&nbsp;
+  <a href="https://eslint.org" target="_blank"><img src="https://eslint.interlace.tools/logos/eslint.svg" alt="ESLint" height="90" /></a>
 </p>
 
 <p align="center">
@@ -22,12 +26,31 @@ Security rules for [`@anthropic-ai/sdk`](https://www.npmjs.com/package/@anthropi
 
 Every rule gates on the SDK actually being imported, so the plugin stays silent in files that don't use it.
 
-## Installation
+## Philosophy
+
+**Interlace** fosters **strength through integration**. Instead of stacking isolated rules, we **interlace** security directly into your workflow to create a resilient fabric of code. We believe tools should **guide rather than gatekeep**, providing educational feedback that strengthens the developer with every interaction.
+
+## Getting Started
+
+- To check out the [guide](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security), visit [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security). 📚
+- 要查看中文 [指南](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security), 请访问 [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security). 📚
+- [가이드](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security) 문서는 [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security)에서 확인하실 수 있습니다. 📚
+- [ガイド](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security)は [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security)でご確認ください。 📚
+- Para ver la [guía](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security), visita [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security). 📚
+- للاطلاع على [الدليل](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security)، قم بزيارة [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security). 📚
 
 ```bash
-npm install --save-dev eslint-plugin-anthropic-security
+npm install eslint-plugin-anthropic-security --save-dev
 ```
 
+## ⚙️ Configuration Presets
+
+| Preset | Description |
+| :--- | :--- |
+| `recommended` | Enables every rule at `error`. |
+| `strict` | Same set as `recommended`; reserved for rules that are not yet safe by default. |
+| `minimal` | Same set as `recommended`; reserved for a reduced high-signal subset. |
+
 ## Usage
 
 ```js
@@ -47,16 +70,67 @@ Every rule runs on [oxlint](https://oxc.rs) as well as ESLint:
 { "jsPlugins": ["eslint-plugin-anthropic-security/oxlint"] }
 ```
 
+## 📦 Compatibility
+
+| Package | Version |
+| :--- | :--- |
+| `@anthropic-ai/sdk` | [![npm](https://img.shields.io/npm/v/@anthropic-ai/sdk.svg?style=flat-square)](https://www.npmjs.com/package/@anthropic-ai/sdk) |
+| `@anthropic-ai/claude-agent-sdk` | [![npm](https://img.shields.io/npm/v/@anthropic-ai/claude-agent-sdk.svg?style=flat-square)](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk) |
+| ESLint | [![npm](https://img.shields.io/npm/v/eslint.svg?style=flat-square)](https://www.npmjs.com/package/eslint) |
+| Node.js | [![node](https://img.shields.io/badge/node-%5E18.0.0-green?style=flat-square)](https://nodejs.org/) |
+
+See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md) for the full matrix.
+
 ## Rules
 
-| Rule | Description | CWE | Recommended |
-| --- | --- | --- | --- |
-| [no-hardcoded-api-key](./docs/rules/no-hardcoded-api-key.md) | Forbid a literal API key in the Anthropic client options | CWE-798 | ✅ error |
+**Legend**
+
+| Icon | Description |
+| :---: | :--- |
+| 💼 | **Recommended**: Included in the recommended preset. |
+| ⚠️ | **Warns**: Set to warn in recommended preset. |
+| 🔧 | **Auto-fixable**: Automatically fixable by the `--fix` CLI option. |
+| 💡 | **Suggestions**: Providing code suggestions in IDE. |
+| 🚫 | **Deprecated**: This rule is deprecated. |
+| 🟢 | **Type-unaware**: AST-only, runs in oxlint JS-plugin tier. |
+| 🟡 | **Type-aware (refining)**: pure-AST primary path; types refine precision. |
+| 🟠 | **Type-aware (graceful)**: requires TS program; silent without it. |
+
+| Rule | CWE | OWASP | CVSS | Description | 🧠 | 💼 | ⚠️ | 🔧 | 💡 | 🚫 |
+| :--- | :--- | :--- | :--- | :--- | :---: | :---: | :---: | :---: | :---: | :---: |
+| [no-hardcoded-api-key](./docs/rules/no-hardcoded-api-key.md) | CWE-798 | A07:2021 | 9.1 | Forbid a literal API key in the Anthropic client options | 🟢 | 💼 |  |  |  |  |
+
+<!-- INTERLACE:STAR_CTA:START -->
+## ⭐ Support & follow
+
+If this plugin caught a real bug for you, **[star the repo](https://github.com/ofri-peretz/eslint)** — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and **[follow the writeups on Dev.to](https://dev.to/ofri-peretz)** for the benchmarks and security research behind these rules.
+
+[![GitHub stars](https://img.shields.io/github/stars/ofri-peretz/eslint?style=social)](https://github.com/ofri-peretz/eslint)
+
+<!-- INTERLACE:STAR_CTA:END -->
+
+## 🔗 Related ESLint Plugins
+
+Part of the **Interlace ESLint Ecosystem** — AI-native security plugins with LLM-optimized error messages:
+
+| Plugin | Downloads | Description |
+| :--- | :---: | :--- |
+| [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-vercel-ai-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security — prompt injection, output handling. |
+| [`eslint-plugin-openai-security`](https://www.npmjs.com/package/eslint-plugin-openai-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-openai-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-openai-security) | OpenAI SDK security. |
+| [`eslint-plugin-anthropic-security`](https://www.npmjs.com/package/eslint-plugin-anthropic-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-anthropic-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-anthropic-security) | Anthropic SDK and Claude Agent SDK security. |
+| [`eslint-plugin-gemini-security`](https://www.npmjs.com/package/eslint-plugin-gemini-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-gemini-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-gemini-security) | Google Gemini SDK security. |
+| [`eslint-plugin-mcp-sdk-security`](https://www.npmjs.com/package/eslint-plugin-mcp-sdk-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-mcp-sdk-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-mcp-sdk-security) | Model Context Protocol SDK security. |
+| [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-secure-coding.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-secure-coding) | General security rules & OWASP guidelines. |
+| [`eslint-plugin-node-security`](https://www.npmjs.com/package/eslint-plugin-node-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-node-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-node-security) | Node.js core-module security (fs, child_process, vm, crypto, Buffer). |
 
 ## 📄 License
 
 MIT © [Ofri Peretz](https://github.com/ofri-peretz)
 
+<p align="center">
+  <a href="https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security"><img src="https://eslint.interlace.tools/images/og-anthropic-security.png" alt="ESLint Interlace Plugin" width="100%" /></a>
+</p>
+
 <p align="center">
   <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security" target="blank"><img src="https://eslint.interlace.tools/icon-light.svg" alt="Interlace" height="70" /></a>
 </p>

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "eslint-plugin-anthropic-security",
-  "version": "0.1.0",
-  "description": "ESLint plugin for Anthropic SDK security \u2014 catches hardcoded API keys in the Claude client options.",
+  "version": "0.2.0",
+  "description": "ESLint plugin for Anthropic SDK security — catches hardcoded API keys in the Claude client options.",
   "type": "commonjs",
-  "main": "./dist/src/index.js",
-  "types": "./dist/src/index.d.ts",
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
   "exports": {
     ".": {
-      "types": "./dist/src/index.d.ts",
-      "default": "./dist/src/index.js"
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
     },
     "./oxlint": {
       "types": "./src/oxlint.d.ts",
@@ -20,7 +20,7 @@
   "homepage": "https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=npm&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security",
   "repository": {
     "type": "git",
-    "url": "https://github.com/ofri-peretz/eslint",
+    "url": "git+https://github.com/ofri-peretz/eslint.git",
     "directory": "packages/eslint-plugin-anthropic-security"
   },
   "bugs": {
@@ -31,10 +31,8 @@
   },
   "files": [
     "src/",
-    "dist/",
     "README.md",
-    "LICENSE",
-    "CHANGELOG.md"
+    "LICENSE"
   ],
   "keywords": [
     "eslint",
@@ -64,7 +62,9 @@
     "node": ">=18.0.0"
   },
   "peerDependencies": {
-    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"
+    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0",
+    "@anthropic-ai/sdk": ">=0.1.0 <1.0.0",
+    "@anthropic-ai/claude-agent-sdk": ">=0.1.0 <1.0.0"
   },
   "peerDependenciesMeta": {
     "@anthropic-ai/sdk": {
@@ -75,18 +75,7 @@
     }
   },
   "dependencies": {
-    "tslib": "^2.3.0",
-    "@interlace/eslint-devkit": "^1.4.4"
-  },
-  "devDependencies": {
-    "@typescript-eslint/parser": "^8.46.2",
-    "@typescript-eslint/rule-tester": "^8.46.2"
-  },
-  "scripts": {
-    "build": "tsx ../../scripts/build-package.ts",
-    "test": "vitest run",
-    "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc -p tsconfig.lib.json --noEmit"
+    "@interlace/eslint-devkit": "^1.9.0"
   },
   "funding": {
     "type": "github",

package/src/index.d.ts

@@ -0,0 +1,17 @@
+// Minimal declaration written by scripts/build-package.ts.
+//
+// tsc's generated entry declaration inlined every inferred rule-option type
+// (up to 166 kB per plugin) for an API no consumer calls directly. This types
+// what a flat config actually touches. Per-rule option types remain available
+// from the "./types" subpath export where a plugin provides one.
+import type { Linter, Rule } from 'eslint';
+
+export declare const rules: Record<string, Rule.RuleModule>;
+export declare const configs: Record<string, Linter.Config>;
+export declare const plugin: {
+  meta: { name: string; version: string };
+  rules: Record<string, Rule.RuleModule>;
+};
+
+declare const _default: typeof plugin;
+export default _default;

package/{dist/src → src}/index.js

@@ -1,22 +1,19 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.configs = exports.plugin = exports.rules = exports.noHardcodedApiKey = void 0;
-const no_hardcoded_api_key_1 = require("./rules/no-hardcoded-api-key");
+exports.configs = exports.plugin = exports.rules = exports.noHardcodedApiKey = exports.noBrowserApiKeyExposure = void 0;
+var no_browser_api_key_exposure_2 = require("./rules/no-browser-api-key-exposure");
+Object.defineProperty(exports, "noBrowserApiKeyExposure", { enumerable: true, get: function () { return no_browser_api_key_exposure_2.noBrowserApiKeyExposure; } });
 var no_hardcoded_api_key_2 = require("./rules/no-hardcoded-api-key");
 Object.defineProperty(exports, "noHardcodedApiKey", { enumerable: true, get: function () { return no_hardcoded_api_key_2.noHardcodedApiKey; } });
 exports.rules = {
-    // CWE-798
-    'no-hardcoded-api-key': no_hardcoded_api_key_1.noHardcodedApiKey,
+    get 'no-browser-api-key-exposure'() { return require("./rules/no-browser-api-key-exposure").noBrowserApiKeyExposure; },
+    get 'no-hardcoded-api-key'() { return require("./rules/no-hardcoded-api-key").noHardcodedApiKey; },
+
 };
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-anthropic-security',
-        version: '0.1.0',
+        version: '0.2.0',
     },
     rules: exports.rules,
 };
@@ -25,6 +22,7 @@ const enabled = {
         'anthropic-security': exports.plugin,
     },
     rules: {
+        'anthropic-security/no-browser-api-key-exposure': 'error',
         'anthropic-security/no-hardcoded-api-key': 'error',
     },
 };

package/src/oxlint.d.ts

@@ -0,0 +1,17 @@
+// Minimal declaration written by scripts/build-package.ts.
+//
+// tsc's generated entry declaration inlined every inferred rule-option type
+// (up to 166 kB per plugin) for an API no consumer calls directly. This types
+// what a flat config actually touches. Per-rule option types remain available
+// from the "./types" subpath export where a plugin provides one.
+import type { Linter, Rule } from 'eslint';
+
+export declare const rules: Record<string, Rule.RuleModule>;
+export declare const configs: Record<string, Linter.Config>;
+export declare const plugin: {
+  meta: { name: string; version: string };
+  rules: Record<string, Rule.RuleModule>;
+};
+
+declare const _default: typeof plugin;
+export default _default;

package/src/oxlint.js

@@ -0,0 +1,3 @@
+"use strict";
+const index_1 = require("./index");
+module.exports = index_1.plugin;

package/src/rules/no-browser-api-key-exposure/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noBrowserApiKeyExposure = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+exports.noBrowserApiKeyExposure = (0, eslint_devkit_1.createBrowserEscapeHatchRule)({
+    ruleName: 'no-browser-api-key-exposure',
+    vendor: 'Anthropic',
+    modules: ['@anthropic-ai'],
+    docsUrl: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-browser-api-key-exposure.md',
+    documentationLink: 'https://docs.anthropic.com/en/api/getting-started',
+});

package/src/rules/no-hardcoded-api-key/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noHardcodedApiKey = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+exports.noHardcodedApiKey = (0, eslint_devkit_1.createSdkApiKeyRule)({
+    ruleName: 'no-hardcoded-api-key',
+    vendor: 'Anthropic',
+    modules: ['@anthropic-ai'],
+    keyProps: ['apiKey', 'authToken'],
+    fixTemplate: 'new Anthropic({ {{prop}}: process.env.ANTHROPIC_API_KEY })',
+    docsUrl: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-hardcoded-api-key.md',
+    documentationLink: 'https://docs.anthropic.com/en/api/getting-started',
+});

package/dist/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2024 Ofri Peretz
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/README.md

@@ -1,66 +0,0 @@
-<p align="center">
-  <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security" target="blank"><img src="https://eslint.interlace.tools/icon-light.svg" alt="Interlace" height="90" /></a>
-  &nbsp;&nbsp;
-  <a href="https://eslint.org" target="_blank"><img src="https://eslint.interlace.tools/eslint-logo.svg" alt="ESLint" height="90" /></a>
-  &nbsp;&nbsp;
-  <a href="https://oxc.rs" target="_blank"><img src="https://eslint.interlace.tools/oxlint-logo.svg" alt="oxlint" height="90" /></a>
-  &nbsp;&nbsp;
-  <a href="https://www.npmjs.com/package/@anthropic-ai/sdk" target="_blank"><img src="https://eslint.interlace.tools/anthropic-logo.svg" alt="Anthropic" height="90" /></a>
-</p>
-
-<p align="center">
-  Security rules for the Anthropic SDK and Claude Agent SDK.
-</p>
-
-<p align="center">
-  <a href="https://www.npmjs.com/package/eslint-plugin-anthropic-security" target="_blank"><img src="https://img.shields.io/npm/v/eslint-plugin-anthropic-security.svg" alt="NPM Version" /></a>
-  <a href="https://www.npmjs.com/package/eslint-plugin-anthropic-security" target="_blank"><img src="https://img.shields.io/npm/dm/eslint-plugin-anthropic-security.svg" alt="NPM Downloads" /></a>
-  <a href="https://opensource.org/licenses/MIT" target="_blank"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="Package License" /></a>
-</p>
-
-> ⭐ If this plugin caught a real bug for you, [**star the repo**](https://github.com/ofri-peretz/eslint) — it's the signal that keeps these rules maintained.
-
-## Description
-
-Security rules for [`@anthropic-ai/sdk`](https://www.npmjs.com/package/@anthropic-ai/sdk).
-
-Every rule gates on the SDK actually being imported, so the plugin stays silent in files that don't use it.
-
-## Installation
-
-```bash
-npm install --save-dev eslint-plugin-anthropic-security
-```
-
-## Usage
-
-```js
-// eslint.config.js
-import anthropicSecurity from 'eslint-plugin-anthropic-security';
-
-export default [
-  anthropicSecurity.configs.recommended,
-];
-```
-
-### oxlint
-
-Every rule runs on [oxlint](https://oxc.rs) as well as ESLint:
-
-```json
-{ "jsPlugins": ["eslint-plugin-anthropic-security/oxlint"] }
-```
-
-## Rules
-
-| Rule | Description | CWE | Recommended |
-| --- | --- | --- | --- |
-| [no-hardcoded-api-key](./docs/rules/no-hardcoded-api-key.md) | Forbid a literal API key in the Anthropic client options | CWE-798 | ✅ error |
-
-## 📄 License
-
-MIT © [Ofri Peretz](https://github.com/ofri-peretz)
-
-<p align="center">
-  <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security" target="blank"><img src="https://eslint.interlace.tools/icon-light.svg" alt="Interlace" height="70" /></a>
-</p>

package/dist/package.json

@@ -1,95 +0,0 @@
-{
-  "name": "eslint-plugin-anthropic-security",
-  "version": "0.1.0",
-  "description": "ESLint plugin for Anthropic SDK security — catches hardcoded API keys in the Claude client options.",
-  "type": "commonjs",
-  "main": "./src/index.js",
-  "types": "./src/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./src/index.d.ts",
-      "default": "./src/index.js"
-    },
-    "./oxlint": {
-      "types": "./src/oxlint.d.ts",
-      "default": "./src/oxlint.js"
-    }
-  },
-  "author": "Ofri Peretz <ofriperetzdev@gmail.com>",
-  "license": "MIT",
-  "homepage": "https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=npm&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/ofri-peretz/eslint",
-    "directory": "packages/eslint-plugin-anthropic-security"
-  },
-  "bugs": {
-    "url": "https://github.com/ofri-peretz/eslint/issues"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "files": [
-    "src/",
-    "dist/",
-    "README.md",
-    "LICENSE",
-    "CHANGELOG.md"
-  ],
-  "keywords": [
-    "eslint",
-    "eslintplugin",
-    "eslint-plugin",
-    "static-analysis",
-    "linting",
-    "code-quality",
-    "security",
-    "sast",
-    "appsec",
-    "vulnerability",
-    "owasp",
-    "cwe",
-    "interlace-security",
-    "ai-security",
-    "llm",
-    "llm-security",
-    "typescript",
-    "anthropic",
-    "claude",
-    "anthropic-sdk",
-    "claude-agent-sdk",
-    "agents"
-  ],
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "peerDependencies": {
-    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"
-  },
-  "peerDependenciesMeta": {
-    "@anthropic-ai/sdk": {
-      "optional": true
-    },
-    "@anthropic-ai/claude-agent-sdk": {
-      "optional": true
-    }
-  },
-  "dependencies": {
-    "tslib": "^2.3.0",
-    "@interlace/eslint-devkit": "^1.4.4"
-  },
-  "devDependencies": {
-    "@typescript-eslint/parser": "^8.46.2",
-    "@typescript-eslint/rule-tester": "^8.46.2"
-  },
-  "scripts": {
-    "build": "tsx ../../scripts/build-package.ts",
-    "test": "vitest run",
-    "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc -p tsconfig.lib.json --noEmit"
-  },
-  "funding": {
-    "type": "github",
-    "url": "https://github.com/ofri-peretz/eslint"
-  }
-}

package/dist/src/index.d.ts

@@ -1,33 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * eslint-plugin-anthropic-security
- *
- * Security rules for the Anthropic SDK and Claude Agent SDK.
- *
- * Scope promise: every rule gates on the SDK being imported, so the plugin
- * stays silent in files that do not use it.
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-export { noHardcodedApiKey } from './rules/no-hardcoded-api-key';
-export declare const rules: Record<string, TSESLint.RuleModule<string, readonly unknown[]>>;
-export declare const plugin: TSESLint.FlatConfig.Plugin;
-export declare const configs: {
-    minimal: TSESLint.FlatConfig.Config;
-    recommended: TSESLint.FlatConfig.Config;
-    strict: TSESLint.FlatConfig.Config;
-};
-declare const _default: {
-    configs: {
-        minimal: TSESLint.FlatConfig.Config;
-        recommended: TSESLint.FlatConfig.Config;
-        strict: TSESLint.FlatConfig.Config;
-    };
-    meta?: { [K in keyof TSESLint.FlatConfig.PluginMeta]?: TSESLint.FlatConfig.PluginMeta[K] | undefined; };
-    processors?: Partial<Record<string, TSESLint.FlatConfig.Processor>> | undefined;
-    rules?: Record<string, TSESLint.LooseRuleDefinition> | undefined;
-};
-export default _default;

package/dist/src/oxlint.d.ts

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * oxlint sub-export.
- *
- * Consumers wire oxlint to this entry via:
- *   { "jsPlugins": ["eslint-plugin-anthropic-security/oxlint"] }
- *
- * oxlint's JS plugin loader does `require('eslint-plugin-anthropic-security/oxlint')` and reads
- * `.rules` off the result. The compiled output of `export = plugin` is
- * `module.exports = plugin`, which gives oxlint the plugin object directly
- * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
- *
- * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
- */
-import { plugin } from './index';
-export = plugin;

package/dist/src/oxlint.js

@@ -1,21 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * oxlint sub-export.
- *
- * Consumers wire oxlint to this entry via:
- *   { "jsPlugins": ["eslint-plugin-anthropic-security/oxlint"] }
- *
- * oxlint's JS plugin loader does `require('eslint-plugin-anthropic-security/oxlint')` and reads
- * `.rules` off the result. The compiled output of `export = plugin` is
- * `module.exports = plugin`, which gives oxlint the plugin object directly
- * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
- *
- * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
- */
-const index_1 = require("./index");
-module.exports = index_1.plugin;

package/dist/src/rules/no-hardcoded-api-key/index.d.ts

@@ -1,8 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-export declare const noHardcodedApiKey: import("@typescript-eslint/utils/ts-eslint").RuleModule<"hardcodedApiKey", [], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
-    name: string;
-};

package/dist/src/rules/no-hardcoded-api-key/index.js

@@ -1,113 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.noHardcodedApiKey = void 0;
-/**
- * @fileoverview Forbid a literal API key in the Anthropic client options
- * @description A key written into source is committed, pushed, mirrored into
- * every clone and CI cache, and is billable by anyone who reads it. Rotating it
- * means a code change, so leaked keys tend to stay live.
- * @see https://docs.anthropic.com/en/api/getting-started
- */
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-/** Covers the base SDK and the agent SDK, which share the client options. */
-const ANTHROPIC_MODULE_PREFIX = '@anthropic-ai/';
-const KEY_PROPS = new Set(['apiKey', 'authToken']);
-/**
- * Whether the client options literal carries an inline credential.
- *
- * `process.env.ANTHROPIC_API_KEY` and any other non-literal expression are
- * `safe` — reading a key from the environment is the correct pattern. A spread
- * is `unreadable`: the key may be in the spread source, and guessing there
- * would flag correct code.
- */
-function readCredential(options) {
-    for (const prop of options.properties) {
-        if (prop.type === 'SpreadElement')
-            return 'unreadable';
-        if (prop.computed)
-            continue;
-        const isCredential = (prop.key.type === 'Identifier' && KEY_PROPS.has(prop.key.name)) ||
-            (prop.key.type === 'Literal' && KEY_PROPS.has(String(prop.key.value)));
-        if (!isCredential)
-            continue;
-        if (prop.value.type !== 'Literal')
-            return 'safe';
-        // An empty string is a placeholder, not a credential.
-        if (typeof prop.value.value === 'string' && prop.value.value.length > 0)
-            return 'literal';
-        return 'safe';
-    }
-    return 'safe';
-}
-exports.noHardcodedApiKey = (0, eslint_devkit_1.createRule)({
-    name: 'no-hardcoded-api-key',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-hardcoded-api-key.md',
-            description: 'Forbid a literal API key in the Anthropic client options',
-            cwe: 'CWE-798',
-            cvss: 9.1,
-        },
-        messages: {
-            hardcodedApiKey: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Hardcoded Anthropic Credential',
-                cwe: 'CWE-798',
-                owasp: 'A07:2021',
-                cvss: 9.1,
-                description: '{{prop}} is a string literal, so the credential is committed to source control and readable by anyone with repository access',
-                severity: 'CRITICAL',
-                compliance: ['SOC2', 'PCI-DSS'],
-                fix: 'Read it from the environment: new Anthropic({ {{prop}}: process.env.ANTHROPIC_API_KEY })',
-                documentationLink: 'https://docs.anthropic.com/en/api/getting-started',
-            }),
-        },
-        schema: [],
-    },
-    defaultOptions: [],
-    create(context) {
-        let importsAnthropic = false;
-        const candidates = [];
-        function inspect(node, args) {
-            const options = args[0];
-            if (options?.type !== 'ObjectExpression')
-                return;
-            if (readCredential(options) === 'literal') {
-                candidates.push({ node, prop: 'apiKey' });
-            }
-        }
-        return {
-            ImportDeclaration(node) {
-                if (node.source.value.startsWith(ANTHROPIC_MODULE_PREFIX))
-                    importsAnthropic = true;
-            },
-            NewExpression(node) {
-                inspect(node, [...node.arguments]);
-            },
-            CallExpression(node) {
-                if (node.callee.type === 'Identifier' &&
-                    node.callee.name === 'require' &&
-                    node.arguments[0]?.type === 'Literal' &&
-                    typeof node.arguments[0].value === 'string' &&
-                    node.arguments[0].value.startsWith(ANTHROPIC_MODULE_PREFIX)) {
-                    importsAnthropic = true;
-                    return;
-                }
-                inspect(node, [...node.arguments]);
-            },
-            'Program:exit'() {
-                if (!importsAnthropic)
-                    return;
-                for (const { node, prop } of candidates) {
-                    context.report({ node, messageId: 'hardcodedApiKey', data: { prop } });
-                }
-            },
-        };
-    },
-});

package/src/index.test.ts

@@ -1,32 +0,0 @@
-/**
- * @fileoverview Plugin surface lock for eslint-plugin-anthropic-security.
- */
-
-import { describe, it, expect } from 'vitest';
-
-import plugin, { rules, configs, plugin as namedPlugin, noHardcodedApiKey } from './index';
-
-describe('eslint-plugin-anthropic-security', () => {
-  it('exposes every rule under its documented id', () => {
-    expect(Object.keys(rules).sort()).toEqual(['no-hardcoded-api-key']);
-    expect(rules['no-hardcoded-api-key']).toBe(noHardcodedApiKey);
-  });
-
-  it('names itself for the oxlint loader', () => {
-    expect(namedPlugin.meta?.name).toBe('eslint-plugin-anthropic-security');
-    expect(namedPlugin.rules).toBe(rules);
-  });
-
-  it('ships minimal, recommended and strict configs', () => {
-    expect(Object.keys(configs).sort()).toEqual(['minimal', 'recommended', 'strict']);
-    for (const config of Object.values(configs)) {
-      expect(config.plugins).toHaveProperty('anthropic-security');
-      expect(config.rules?.['anthropic-security/no-hardcoded-api-key']).toBe('error');
-    }
-  });
-
-  it('default-exports the plugin with its configs attached', () => {
-    expect(plugin.rules).toBe(rules);
-    expect(plugin.configs).toBe(configs);
-  });
-});

package/src/index.ts

@@ -1,53 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * eslint-plugin-anthropic-security
- *
- * Security rules for the Anthropic SDK and Claude Agent SDK.
- *
- * Scope promise: every rule gates on the SDK being imported, so the plugin
- * stays silent in files that do not use it.
- */
-
-import type { TSESLint } from '@interlace/eslint-devkit';
-
-import { noHardcodedApiKey } from './rules/no-hardcoded-api-key';
-
-export { noHardcodedApiKey } from './rules/no-hardcoded-api-key';
-
-export const rules: Record<string, TSESLint.RuleModule<string, readonly unknown[]>> = {
-  // CWE-798
-  'no-hardcoded-api-key': noHardcodedApiKey,
-} satisfies Record<string, TSESLint.RuleModule<string, readonly unknown[]>>;
-
-export const plugin: TSESLint.FlatConfig.Plugin = {
-  meta: {
-    name: 'eslint-plugin-anthropic-security',
-    version: '0.1.0',
-  },
-  rules,
-} satisfies TSESLint.FlatConfig.Plugin;
-
-const enabled: TSESLint.FlatConfig.Config = {
-  plugins: {
-    'anthropic-security': plugin,
-  },
-  rules: {
-    'anthropic-security/no-hardcoded-api-key': 'error',
-  },
-} satisfies TSESLint.FlatConfig.Config;
-
-export const configs = {
-  minimal: enabled,
-  recommended: enabled,
-  strict: enabled,
-};
-
-export default {
-  ...plugin,
-  configs,
-};

package/src/oxlint.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * oxlint sub-export.
- *
- * Consumers wire oxlint to this entry via:
- *   { "jsPlugins": ["eslint-plugin-anthropic-security/oxlint"] }
- *
- * oxlint's JS plugin loader does `require('eslint-plugin-anthropic-security/oxlint')` and reads
- * `.rules` off the result. The compiled output of `export = plugin` is
- * `module.exports = plugin`, which gives oxlint the plugin object directly
- * (`{ meta, rules }`) — no wrapper, no `.default` indirection.
- *
- * Generated by scripts/generate-oxlint-shims.mjs. Do not edit by hand.
- */
-
-import { plugin } from './index';
-
-export = plugin;

package/src/rules/no-hardcoded-api-key/index.ts

@@ -1,121 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * @fileoverview Forbid a literal API key in the Anthropic client options
- * @description A key written into source is committed, pushed, mirrored into
- * every clone and CI cache, and is billable by anyone who reads it. Rotating it
- * means a code change, so leaked keys tend to stay live.
- * @see https://docs.anthropic.com/en/api/getting-started
- */
-
-import { TSESTree, createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-
-type MessageIds = 'hardcodedApiKey';
-
-/** Covers the base SDK and the agent SDK, which share the client options. */
-const ANTHROPIC_MODULE_PREFIX = '@anthropic-ai/';
-
-const KEY_PROPS = new Set(['apiKey', 'authToken']);
-
-type KeyVerdict = 'literal' | 'safe' | 'unreadable';
-
-/**
- * Whether the client options literal carries an inline credential.
- *
- * `process.env.ANTHROPIC_API_KEY` and any other non-literal expression are
- * `safe` — reading a key from the environment is the correct pattern. A spread
- * is `unreadable`: the key may be in the spread source, and guessing there
- * would flag correct code.
- */
-function readCredential(options: TSESTree.ObjectExpression): KeyVerdict {
-  for (const prop of options.properties) {
-    if (prop.type === 'SpreadElement') return 'unreadable';
-    if (prop.computed) continue;
-    const isCredential =
-      (prop.key.type === 'Identifier' && KEY_PROPS.has(prop.key.name)) ||
-      (prop.key.type === 'Literal' && KEY_PROPS.has(String(prop.key.value)));
-    if (!isCredential) continue;
-    if (prop.value.type !== 'Literal') return 'safe';
-    // An empty string is a placeholder, not a credential.
-    if (typeof prop.value.value === 'string' && prop.value.value.length > 0) return 'literal';
-    return 'safe';
-  }
-  return 'safe';
-}
-
-export const noHardcodedApiKey = createRule<[], MessageIds>({
-  name: 'no-hardcoded-api-key',
-  meta: {
-    type: 'problem',
-    docs: {
-      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-anthropic-security/docs/rules/no-hardcoded-api-key.md',
-      description: 'Forbid a literal API key in the Anthropic client options',
-      cwe: 'CWE-798',
-      cvss: 9.1,
-    },
-    messages: {
-      hardcodedApiKey: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Hardcoded Anthropic Credential',
-        cwe: 'CWE-798',
-        owasp: 'A07:2021',
-        cvss: 9.1,
-        description:
-          '{{prop}} is a string literal, so the credential is committed to source control and readable by anyone with repository access',
-        severity: 'CRITICAL',
-        compliance: ['SOC2', 'PCI-DSS'],
-        fix: 'Read it from the environment: new Anthropic({ {{prop}}: process.env.ANTHROPIC_API_KEY })',
-        documentationLink: 'https://docs.anthropic.com/en/api/getting-started',
-      }),
-    },
-    schema: [],
-  },
-  defaultOptions: [],
-  create(context) {
-    let importsAnthropic = false;
-    const candidates: Array<{ node: TSESTree.Node; prop: string }> = [];
-
-    function inspect(node: TSESTree.Node, args: TSESTree.CallExpressionArgument[]): void {
-      const options = args[0];
-      if (options?.type !== 'ObjectExpression') return;
-      if (readCredential(options) === 'literal') {
-        candidates.push({ node, prop: 'apiKey' });
-      }
-    }
-
-    return {
-      ImportDeclaration(node: TSESTree.ImportDeclaration) {
-        if (node.source.value.startsWith(ANTHROPIC_MODULE_PREFIX)) importsAnthropic = true;
-      },
-
-      NewExpression(node: TSESTree.NewExpression) {
-        inspect(node, [...node.arguments]);
-      },
-
-      CallExpression(node: TSESTree.CallExpression) {
-        if (
-          node.callee.type === 'Identifier' &&
-          node.callee.name === 'require' &&
-          node.arguments[0]?.type === 'Literal' &&
-          typeof node.arguments[0].value === 'string' &&
-          node.arguments[0].value.startsWith(ANTHROPIC_MODULE_PREFIX)
-        ) {
-          importsAnthropic = true;
-          return;
-        }
-        inspect(node, [...node.arguments]);
-      },
-
-      'Program:exit'() {
-        if (!importsAnthropic) return;
-        for (const { node, prop } of candidates) {
-          context.report({ node, messageId: 'hardcodedApiKey', data: { prop } });
-        }
-      },
-    };
-  },
-});

package/src/rules/no-hardcoded-api-key/no-hardcoded-api-key.test.ts

@@ -1,74 +0,0 @@
-/**
- * @fileoverview Tests for no-hardcoded-api-key (Anthropic)
- */
-
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { noHardcodedApiKey } from './index';
-
-const ruleTester = new RuleTester({
-  languageOptions: { ecmaVersion: 2022, sourceType: 'module' },
-});
-
-const IMPORT = `import Anthropic from '@anthropic-ai/sdk';`;
-
-ruleTester.run('no-hardcoded-api-key', noHardcodedApiKey, {
-  valid: [
-    { code: `${IMPORT}\nconst c = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });` },
-    // Empty string is a placeholder, not a credential
-    { code: `${IMPORT}\nconst c = new Anthropic({ apiKey: '' });` },
-    // Non-string literal
-    { code: `${IMPORT}\nconst c = new Anthropic({ apiKey: null });` },
-    // Spread could carry the key
-    { code: `${IMPORT}\nconst c = new Anthropic({ ...opts });` },
-    // Computed key
-    { code: `${IMPORT}\nconst c = new Anthropic({ [k]: 'sk-ant-xxx' });` },
-    // Unrelated property holding a literal
-    { code: `${IMPORT}\nconst c = new Anthropic({ baseURL: 'https://api.anthropic.com' });` },
-    // No options / non-object options
-    { code: `${IMPORT}\nconst c = new Anthropic();` },
-    { code: `${IMPORT}\nconst c = new Anthropic(opts);` },
-    // Scope promise: no Anthropic import, no finding
-    { code: `const c = new Anthropic({ apiKey: 'sk-ant-hardcoded' });` },
-    // require of an unrelated module
-    { code: `const z = require('zod');\nnew Anthropic({ apiKey: 'sk-ant-hardcoded' });` },
-    // require with a non-string argument
-    { code: `const m = require(dyn);\nnew Anthropic({ apiKey: 'sk-ant-hardcoded' });` },
-    // Zero-argument call — the require gate must not choke on it
-    { code: `${IMPORT}\ninitialise();` },
-    // Quoted key that is not a credential
-    { code: `${IMPORT}\nnew Anthropic({ 'baseURL': 'https://api.anthropic.com' });` },
-    // An import of an unrelated module must not arm the rule
-    { code: `import { z } from 'zod';\nnew Anthropic({ apiKey: 'sk-ant-x' });` },
-  ],
-  invalid: [
-    {
-      code: `${IMPORT}\nconst c = new Anthropic({ apiKey: 'sk-ant-api03-hardcoded' });`,
-      errors: [{ messageId: 'hardcodedApiKey' }],
-    },
-    // authToken is the same class of credential
-    {
-      code: `${IMPORT}\nconst c = new Anthropic({ authToken: 'tok-live-123' });`,
-      errors: [{ messageId: 'hardcodedApiKey' }],
-    },
-    // Agent SDK shares the client options
-    {
-      code: `import { query } from '@anthropic-ai/claude-agent-sdk';\nnew Anthropic({ apiKey: 'sk-ant-x' });`,
-      errors: [{ messageId: 'hardcodedApiKey' }],
-    },
-    // require() arms it
-    {
-      code: `const Anthropic = require('@anthropic-ai/sdk');\nnew Anthropic({ apiKey: 'sk-ant-x' });`,
-      errors: [{ messageId: 'hardcodedApiKey' }],
-    },
-    // String-literal key
-    {
-      code: `${IMPORT}\nnew Anthropic({ 'apiKey': 'sk-ant-x' });`,
-      errors: [{ messageId: 'hardcodedApiKey' }],
-    },
-    // Factory-style call
-    {
-      code: `${IMPORT}\nconst c = createAnthropic({ apiKey: 'sk-ant-x' });`,
-      errors: [{ messageId: 'hardcodedApiKey' }],
-    },
-  ],
-});