eslint-plugin-anthropic-security 0.3.0 → 0.3.2

package/README.md

@@ -16,6 +16,7 @@
   <a href="https://www.npmjs.com/package/eslint-plugin-anthropic-security" target="_blank"><img src="https://img.shields.io/npm/v/eslint-plugin-anthropic-security.svg" alt="NPM Version" /></a>
   <a href="https://www.npmjs.com/package/eslint-plugin-anthropic-security" target="_blank"><img src="https://img.shields.io/npm/dm/eslint-plugin-anthropic-security.svg" alt="NPM Downloads" /></a>
   <a href="https://opensource.org/licenses/MIT" target="_blank"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="Package License" /></a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/ofri-peretz/eslint" target="_blank"><img src="https://api.securityscorecards.dev/projects/github.com/ofri-peretz/eslint/badge" alt="OpenSSF Scorecard" /></a>
 </p>
 
 > ⭐ If this plugin caught a real bug for you, [**star the repo**](https://github.com/ofri-peretz/eslint) — it's the signal that keeps these rules maintained.
@@ -30,6 +31,45 @@ Every rule gates on the SDK actually being imported, so the plugin stays silent
 
 **Interlace** fosters **strength through integration**. Instead of stacking isolated rules, we **interlace** security directly into your workflow to create a resilient fabric of code. We believe tools should **guide rather than gatekeep**, providing educational feedback that strengthens the developer with every interaction.
 
+<!-- AUTO-GENERATED:DOCTRINE:START - Do not edit manually -->
+
+## Why these rules are quiet
+
+**Noise creates apathy, and apathy is not a security posture.** A linter that reports
+a thousand things a week gets switched off in a month, and the real finding goes with
+it. So every rule here is built to be worth reading: we would rather miss a finding
+than spend your attention on one that was never real.
+
+That is a trade, and it is made deliberately. It costs recall, and we measure what it
+costs rather than assuming it is free.
+
+## How the rules decide
+
+**Evidence, not names.** A rule fires on what the code *does*, resolved through the
+AST and ESLint's own scope analysis — not on an identifier that happens to contain
+`query`, a method called `setItem`, or a file whose path contains `key`. Every one of
+those was a real false positive in this ecosystem, found by reading our own output on
+open-source projects and fixed with a test that fails on the unfixed rule.
+
+Where a rule has known false-positive shapes, its page carries a **Not a finding**
+section: what it deliberately stays quiet on, and what to check first when it fires
+and you disagree.
+
+## What you get
+
+The rules below. Security rules carry a CWE mapping and, where one is assigned, a
+CVSS score; every rule carries a fix on its message — in prose for a human and as
+structured JSON for an agent. Install it, enable
+`recommended`, and read the findings. If one of them is wrong,
+[open an issue](https://github.com/ofri-peretz/eslint/issues) — a false positive is a
+bug here, not a tuning exercise for you.
+
+How that is measured, on which projects, and where it falls short:
+[benchmark methodology](https://github.com/ofri-peretz/eslint/blob/main/BENCHMARK-METHODOLOGY.md)
+and [results](https://github.com/ofri-peretz/eslint/blob/main/BENCHMARK-RESULTS.md).
+
+<!-- AUTO-GENERATED:DOCTRINE:END -->
+
 ## Getting Started
 
 - To check out the [guide](https://eslint.interlace.tools/docs/security/plugin-anthropic-security?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security), visit [eslint.interlace.tools](https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security). 📚
@@ -96,10 +136,13 @@ See the [ESLint Version Support Policy](../../docs/ESLINT_VERSION_SUPPORT.md) fo
 | 🟡 | **Type-aware (refining)**: pure-AST primary path; types refine precision. |
 | 🟠 | **Type-aware (graceful)**: requires TS program; silent without it. |
 
+<!-- AUTO-GENERATED:RULES_TABLE:START - Do not edit manually -->
 | Rule | CWE | OWASP | CVSS | Description | 🧠 | 💼 | ⚠️ | 🔧 | 💡 | 🚫 |
-| :--- | :--- | :--- | :--- | :--- | :---: | :---: | :---: | :---: | :---: | :---: |
-| [no-hardcoded-api-key](./docs/rules/no-hardcoded-api-key.md) | CWE-798 | A07:2021 | 9.1 | Forbid a literal API key in the Anthropic client options | 🟢 | 💼 |  |  |  |  |
-
+| :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: | :---: |
+| [no-browser-api-key-exposure](https://eslint.interlace.tools/docs/security/plugin-anthropic-security/rules/no-browser-api-key-exposure?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security) | CWE-522 | A07:2021 |  | Forbid dangerouslyAllowBrowser, which exposes the Anthropic API key to the client | 🟢 |  |  |  |  |  |
+| [no-hardcoded-api-key](https://eslint.interlace.tools/docs/security/plugin-anthropic-security/rules/no-hardcoded-api-key?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security) | CWE-798 | A07:2021 |  | Forbid a literal API key in the Anthropic client options | 🟢 |  |  |  |  |  |
+| [no-untrusted-content-in-prompt](https://eslint.interlace.tools/docs/security/plugin-anthropic-security/rules/no-untrusted-content-in-prompt?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-anthropic-security) | CWE-1427 | A03:2021 |  | Disallow untrusted content built into the Anthropic system prompt | 🟢 |  |  |  |  |  |
+<!-- AUTO-GENERATED:RULES_TABLE:END -->
 <!-- INTERLACE:STAR_CTA:START -->
 ## ⭐ Support & follow
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-anthropic-security",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "ESLint plugin for Anthropic SDK security — catches hardcoded Claude API keys, the browser escape hatch that ships them to every visitor, and system prompts assembled from untrusted input.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -62,7 +62,7 @@
     "node": ">=18.0.0"
   },
   "peerDependencies": {
-    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0",
+    "eslint": "^8.40.0 || ^9.0.0 || ^10.0.0",
     "@anthropic-ai/sdk": ">=0.1.0 <1.0.0",
     "@anthropic-ai/claude-agent-sdk": ">=0.1.0 <1.0.0"
   },
@@ -75,7 +75,7 @@
     }
   },
   "dependencies": {
-    "@interlace/eslint-devkit": "^1.10.0"
+    "@interlace/eslint-devkit": "^1.17.3"
   },
   "funding": {
     "type": "github",

package/src/index.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.configs=exports.plugin=exports.rules=exports.noUntrustedContentInPrompt=exports.noHardcodedApiKey=exports.noBrowserApiKeyExposure=void 0;var no_browser_api_key_exposure_2=require("./rules/no-browser-api-key-exposure");Object.defineProperty(exports,"noBrowserApiKeyExposure",{enumerable:true,get:function(){return no_browser_api_key_exposure_2.noBrowserApiKeyExposure}});var no_hardcoded_api_key_2=require("./rules/no-hardcoded-api-key");Object.defineProperty(exports,"noHardcodedApiKey",{enumerable:true,get:function(){return no_hardcoded_api_key_2.noHardcodedApiKey}});var no_untrusted_content_in_prompt_2=require("./rules/no-untrusted-content-in-prompt");Object.defineProperty(exports,"noUntrustedContentInPrompt",{enumerable:true,get:function(){return no_untrusted_content_in_prompt_2.noUntrustedContentInPrompt}});exports.rules={get"no-browser-api-key-exposure"(){return require("./rules/no-browser-api-key-exposure").noBrowserApiKeyExposure},get"no-hardcoded-api-key"(){return require("./rules/no-hardcoded-api-key").noHardcodedApiKey},get"no-untrusted-content-in-prompt"(){return require("./rules/no-untrusted-content-in-prompt").noUntrustedContentInPrompt}};exports.plugin={meta:{name:"eslint-plugin-anthropic-security",version:"0.3.0"},rules:exports.rules};const enabled={plugins:{"anthropic-security":exports.plugin},rules:{"anthropic-security/no-browser-api-key-exposure":"error","anthropic-security/no-hardcoded-api-key":"error"}};const strict={plugins:{"anthropic-security":exports.plugin},rules:{...enabled.rules,"anthropic-security/no-untrusted-content-in-prompt":"error"}};exports.configs={minimal:enabled,recommended:enabled,strict};exports.default={...exports.plugin,configs:exports.configs};
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.configs=exports.plugin=exports.rules=exports.noUntrustedContentInPrompt=exports.noHardcodedApiKey=exports.noBrowserApiKeyExposure=void 0;const eslint_devkit_1=require("@interlace/eslint-devkit");var no_browser_api_key_exposure_2=require("./rules/no-browser-api-key-exposure");Object.defineProperty(exports,"noBrowserApiKeyExposure",{enumerable:true,get:function(){return no_browser_api_key_exposure_2.noBrowserApiKeyExposure}});var no_hardcoded_api_key_2=require("./rules/no-hardcoded-api-key");Object.defineProperty(exports,"noHardcodedApiKey",{enumerable:true,get:function(){return no_hardcoded_api_key_2.noHardcodedApiKey}});var no_untrusted_content_in_prompt_2=require("./rules/no-untrusted-content-in-prompt");Object.defineProperty(exports,"noUntrustedContentInPrompt",{enumerable:true,get:function(){return no_untrusted_content_in_prompt_2.noUntrustedContentInPrompt}});exports.rules={get"no-browser-api-key-exposure"(){return require("./rules/no-browser-api-key-exposure").noBrowserApiKeyExposure},get"no-hardcoded-api-key"(){return require("./rules/no-hardcoded-api-key").noHardcodedApiKey},get"no-untrusted-content-in-prompt"(){return require("./rules/no-untrusted-content-in-prompt").noUntrustedContentInPrompt}};(0,eslint_devkit_1.withCanonicalDocsUrls)("plugin-anthropic-security",exports.rules);exports.plugin={meta:{name:"eslint-plugin-anthropic-security",version:"0.3.1"},rules:exports.rules};const enabled={plugins:{"anthropic-security":exports.plugin},rules:{"anthropic-security/no-browser-api-key-exposure":"error","anthropic-security/no-hardcoded-api-key":"error"}};const strict={plugins:{"anthropic-security":exports.plugin},rules:{...enabled.rules,"anthropic-security/no-untrusted-content-in-prompt":"error"}};exports.configs={minimal:enabled,recommended:enabled,strict};exports.default={...exports.plugin,configs:exports.configs};