eslint-plugin-jwt-security 2.3.0 → 2.3.1

package/README.md

@@ -1,11 +1,11 @@
 <p align="center">
-  <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security" target="blank"><img src="https://eslint.interlace.tools/icon-light.svg" alt="Interlace" height="90" /></a>
+  <a href="https://eslint.interlace.tools/?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security" target="blank"><img src="https://eslint.interlace.tools/logos/interlace.svg" alt="Interlace" height="90" /></a>
   &nbsp;&nbsp;
-  <a href="https://eslint.org" target="_blank"><img src="https://eslint.interlace.tools/eslint-logo.svg" alt="ESLint" height="90" /></a>
+  <a href="https://jwt.io" target="_blank"><img src="https://eslint.interlace.tools/logos/jwt.svg" alt="JSON Web Tokens" height="90" /></a>
   &nbsp;&nbsp;
-  <a href="https://oxc.rs" target="_blank"><img src="https://eslint.interlace.tools/oxlint-logo.svg" alt="oxlint" height="90" /></a>
+  <a href="https://oxc.rs" target="_blank"><img src="https://eslint.interlace.tools/logos/oxlint.svg" alt="oxlint" height="90" /></a>
   &nbsp;&nbsp;
-  <a href="https://www.npmjs.com/package/jsonwebtoken" target="_blank"><img src="https://eslint.interlace.tools/jwt-logo.svg" alt="JSON Web Tokens" height="90" /></a>
+  <a href="https://eslint.org" target="_blank"><img src="https://eslint.interlace.tools/logos/eslint.svg" alt="ESLint" height="90" /></a>
 </p>
 
 <p align="center">
@@ -150,7 +150,7 @@ If this plugin caught a real bug for you, **[star the repo](https://github.com/o
 MIT © [Ofri Peretz](https://github.com/ofri-peretz)
 
 <p align="center">
-  <a href="https://eslint.interlace.tools/docs/security/plugin-jwt?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security"><img src="https://eslint.interlace.tools/images/og-jwt.png" alt="ESLint Interlace Plugin" width="100%" /></a>
+  <a href="https://eslint.interlace.tools/docs/security/plugin-jwt?utm_source=github&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security"><img src="https://eslint.interlace.tools/images/og-jwt-security.png" alt="ESLint Interlace Plugin" width="100%" /></a>
 </p>
 
 <p align="center">

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "eslint-plugin-jwt-security",
-  "version": "2.3.0",
-  "description": "ESLint plugin for JWT security \u2014 detects algorithm confusion (CVE-2022-23540), alg:none, weak or hardcoded secrets, and decode-without-verify.",
+  "version": "2.3.1",
+  "description": "ESLint plugin for JWT security — detects algorithm confusion (CVE-2022-23540), alg:none, weak or hardcoded secrets, and decode-without-verify.",
   "type": "commonjs",
-  "main": "./dist/src/index.js",
-  "types": "./dist/src/index.d.ts",
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
   "exports": {
     ".": {
-      "types": "./dist/src/index.d.ts",
-      "default": "./dist/src/index.js"
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
     },
     "./types": {
       "types": "./src/types/index.d.ts",
@@ -24,7 +24,7 @@
   "homepage": "https://eslint.interlace.tools/docs/security/plugin-jwt-security?utm_source=npm&utm_medium=referral&utm_campaign=eslint-plugin-jwt-security-security",
   "repository": {
     "type": "git",
-    "url": "https://github.com/ofri-peretz/eslint",
+    "url": "git+https://github.com/ofri-peretz/eslint.git",
     "directory": "packages/eslint-plugin-jwt-security"
   },
   "bugs": {
@@ -35,11 +35,8 @@
   },
   "files": [
     "src/",
-    "dist/",
     "README.md",
-    "LICENSE",
-    "CHANGELOG.md",
-    "AGENTS.md"
+    "LICENSE"
   ],
   "keywords": [
     "eslint",
@@ -82,11 +79,16 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "tslib": "^2.3.0",
-    "@interlace/eslint-devkit": "^1.4.3"
+    "@interlace/eslint-devkit": "^1.8.0"
   },
   "peerDependencies": {
-    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"
+    "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0",
+    "jsonwebtoken": "^8.0.0 || ^9.0.0",
+    "@nestjs/jwt": "^9.0.0 || ^10.0.0 || ^11.0.0",
+    "express-jwt": "^7.0.0 || ^8.0.0",
+    "jose": "^4.0.0 || ^5.0.0 || ^6.0.0",
+    "jwks-rsa": "^3.0.0 || ^4.0.0",
+    "jwt-decode": "^3.0.0 || ^4.0.0"
   },
   "peerDependenciesMeta": {
     "jsonwebtoken": {
@@ -108,16 +110,6 @@
       "optional": true
     }
   },
-  "devDependencies": {
-    "@typescript-eslint/parser": "^8.46.2",
-    "@typescript-eslint/rule-tester": "^8.46.2"
-  },
-  "scripts": {
-    "build": "tsx ../../scripts/build-package.ts",
-    "test": "vitest run",
-    "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc -p tsconfig.lib.json --noEmit"
-  },
   "funding": {
     "type": "github",
     "url": "https://github.com/ofri-peretz/eslint"

package/src/index.d.ts

@@ -0,0 +1,17 @@
+// Minimal declaration written by scripts/build-package.ts.
+//
+// tsc's generated entry declaration inlined every inferred rule-option type
+// (up to 166 kB per plugin) for an API no consumer calls directly. This types
+// what a flat config actually touches. Per-rule option types remain available
+// from the "./types" subpath export where a plugin provides one.
+import type { Linter, Rule } from 'eslint';
+
+export declare const rules: Record<string, Rule.RuleModule>;
+export declare const configs: Record<string, Linter.Config>;
+export declare const plugin: {
+  meta: { name: string; version: string };
+  rules: Record<string, Rule.RuleModule>;
+};
+
+declare const _default: typeof plugin;
+export default _default;

package/{dist/src → src}/index.js

@@ -1,12 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noSensitivePayload = exports.requireMaxAge = exports.noTimestampManipulation = exports.requireAudienceValidation = exports.requireIssuerValidation = exports.requireIssuedAt = exports.noHardcodedSecret = exports.requireExpiration = exports.noWeakSecret = exports.noDecodeWithoutVerify = exports.requireAlgorithmWhitelist = exports.noAlgorithmConfusion = exports.noAlgorithmNone = exports.configs = exports.plugin = exports.rules = void 0;
-// Import rules - Core Security
 const no_algorithm_none_1 = require("./rules/no-algorithm-none");
 Object.defineProperty(exports, "noAlgorithmNone", { enumerable: true, get: function () { return no_algorithm_none_1.noAlgorithmNone; } });
 const no_algorithm_confusion_1 = require("./rules/no-algorithm-confusion");
@@ -21,7 +15,6 @@ const require_expiration_1 = require("./rules/require-expiration");
 Object.defineProperty(exports, "requireExpiration", { enumerable: true, get: function () { return require_expiration_1.requireExpiration; } });
 const no_hardcoded_secret_1 = require("./rules/no-hardcoded-secret");
 Object.defineProperty(exports, "noHardcodedSecret", { enumerable: true, get: function () { return no_hardcoded_secret_1.noHardcodedSecret; } });
-// Import rules - 2025 Vulnerability Research
 const require_issued_at_1 = require("./rules/require-issued-at");
 Object.defineProperty(exports, "requireIssuedAt", { enumerable: true, get: function () { return require_issued_at_1.requireIssuedAt; } });
 const require_issuer_validation_1 = require("./rules/require-issuer-validation");
@@ -34,60 +27,41 @@ const require_max_age_1 = require("./rules/require-max-age");
 Object.defineProperty(exports, "requireMaxAge", { enumerable: true, get: function () { return require_max_age_1.requireMaxAge; } });
 const no_sensitive_payload_1 = require("./rules/no-sensitive-payload");
 Object.defineProperty(exports, "noSensitivePayload", { enumerable: true, get: function () { return no_sensitive_payload_1.noSensitivePayload; } });
-/**
- * Collection of all JWT security ESLint rules (13 rules)
- */
 exports.rules = {
-    // Core Security Rules
-    'no-algorithm-none': no_algorithm_none_1.noAlgorithmNone,
-    'no-algorithm-confusion': no_algorithm_confusion_1.noAlgorithmConfusion,
-    'require-algorithm-whitelist': require_algorithm_whitelist_1.requireAlgorithmWhitelist,
-    'no-decode-without-verify': no_decode_without_verify_1.noDecodeWithoutVerify,
-    'no-weak-secret': no_weak_secret_1.noWeakSecret,
-    'require-expiration': require_expiration_1.requireExpiration,
-    'no-hardcoded-secret': no_hardcoded_secret_1.noHardcodedSecret,
-    // 2025 Vulnerability Research - "Back to the Future" & Replay Prevention
-    'require-issued-at': require_issued_at_1.requireIssuedAt,
-    'require-issuer-validation': require_issuer_validation_1.requireIssuerValidation,
-    'require-audience-validation': require_audience_validation_1.requireAudienceValidation,
-    'no-timestamp-manipulation': no_timestamp_manipulation_1.noTimestampManipulation,
-    'require-max-age': require_max_age_1.requireMaxAge,
-    'no-sensitive-payload': no_sensitive_payload_1.noSensitivePayload,
+    get 'no-algorithm-none'() { return require("./rules/no-algorithm-none").noAlgorithmNone; },
+    get 'no-algorithm-confusion'() { return require("./rules/no-algorithm-confusion").noAlgorithmConfusion; },
+    get 'require-algorithm-whitelist'() { return require("./rules/require-algorithm-whitelist").requireAlgorithmWhitelist; },
+    get 'no-decode-without-verify'() { return require("./rules/no-decode-without-verify").noDecodeWithoutVerify; },
+    get 'no-weak-secret'() { return require("./rules/no-weak-secret").noWeakSecret; },
+    get 'require-expiration'() { return require("./rules/require-expiration").requireExpiration; },
+    get 'no-hardcoded-secret'() { return require("./rules/no-hardcoded-secret").noHardcodedSecret; },
+    get 'require-issued-at'() { return require("./rules/require-issued-at").requireIssuedAt; },
+    get 'require-issuer-validation'() { return require("./rules/require-issuer-validation").requireIssuerValidation; },
+    get 'require-audience-validation'() { return require("./rules/require-audience-validation").requireAudienceValidation; },
+    get 'no-timestamp-manipulation'() { return require("./rules/no-timestamp-manipulation").noTimestampManipulation; },
+    get 'require-max-age'() { return require("./rules/require-max-age").requireMaxAge; },
+    get 'no-sensitive-payload'() { return require("./rules/no-sensitive-payload").noSensitivePayload; },
+
 };
-/**
- * ESLint Plugin object
- */
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-jwt-security',
-        version: '2.2.9',
+        version: '2.3.1',
     },
     rules: exports.rules,
 };
-/**
- * Recommended configuration - baseline security
- * Critical rules as errors, high as warnings
- */
 const recommendedRules = {
-    // CRITICAL - Algorithm attacks
     'jwt/no-algorithm-none': 'error',
     'jwt/no-algorithm-confusion': 'error',
-    // HIGH - Verification and secrets
     'jwt/require-algorithm-whitelist': 'error',
     'jwt/no-decode-without-verify': 'error',
     'jwt/no-weak-secret': 'error',
     'jwt/no-hardcoded-secret': 'error',
-    'jwt/no-timestamp-manipulation': 'error', // LightSEC 2025
-    // MEDIUM - Best practices
+    'jwt/no-timestamp-manipulation': 'error',
     'jwt/require-expiration': 'error',
     'jwt/no-sensitive-payload': 'warn',
 };
-/**
- * Strict configuration - maximum security (2025 research)
- * All rules as errors - includes replay attack prevention
- */
 const strictRules = {
-    // All core rules as errors
     'jwt/no-algorithm-none': 'error',
     'jwt/no-algorithm-confusion': 'error',
     'jwt/require-algorithm-whitelist': 'error',
@@ -95,7 +69,6 @@ const strictRules = {
     'jwt/no-weak-secret': 'error',
     'jwt/no-hardcoded-secret': 'error',
     'jwt/require-expiration': 'error',
-    // 2025 Research - Full replay attack prevention
     'jwt/require-issued-at': 'error',
     'jwt/require-issuer-validation': 'error',
     'jwt/require-audience-validation': 'error',
@@ -103,25 +76,12 @@ const strictRules = {
     'jwt/require-max-age': 'error',
     'jwt/no-sensitive-payload': 'error',
 };
-/**
- * Legacy configuration - migration mode
- * Only critical rules enabled
- */
 const legacyRules = {
-    // Only most critical rules
     'jwt/no-algorithm-none': 'error',
     'jwt/no-algorithm-confusion': 'error',
     'jwt/no-hardcoded-secret': 'warn',
 };
-/**
- * Configuration presets for flat config
- */
 exports.configs = {
-    /**
-     * Flagship preset — the rule from this plugin in the ecosystem-wide
-     * flagship list (`.agent/flagship-rules.md`). Use this when you want
-     * the highest-signal JWT subset shippable in CI gates.
-     */
     flagship: {
         plugins: {
             jwt: exports.plugin,
@@ -130,36 +90,24 @@ exports.configs = {
             'jwt/no-algorithm-none': 'error',
         },
     },
-    /**
-     * Recommended preset - balanced security
-     */
     recommended: {
         plugins: {
             jwt: exports.plugin,
         },
         rules: recommendedRules,
     },
-    /**
-     * Strict preset - maximum security (includes 2025 research)
-     */
     strict: {
         plugins: {
             jwt: exports.plugin,
         },
         rules: strictRules,
     },
-    /**
-     * Legacy preset - migration mode
-     */
     legacy: {
         plugins: {
             jwt: exports.plugin,
         },
         rules: legacyRules,
     },
-    /**
-     * All rules preset
-     */
     all: {
         plugins: {
             jwt: exports.plugin,
@@ -167,5 +115,4 @@ exports.configs = {
         rules: strictRules,
     },
 };
-// Default export for flat config usage
 exports.default = exports.plugin;

package/src/oxlint.d.ts

@@ -0,0 +1,17 @@
+// Minimal declaration written by scripts/build-package.ts.
+//
+// tsc's generated entry declaration inlined every inferred rule-option type
+// (up to 166 kB per plugin) for an API no consumer calls directly. This types
+// what a flat config actually touches. Per-rule option types remain available
+// from the "./types" subpath export where a plugin provides one.
+import type { Linter, Rule } from 'eslint';
+
+export declare const rules: Record<string, Rule.RuleModule>;
+export declare const configs: Record<string, Linter.Config>;
+export declare const plugin: {
+  meta: { name: string; version: string };
+  rules: Record<string, Rule.RuleModule>;
+};
+
+declare const _default: typeof plugin;
+export default _default;

package/src/oxlint.js

@@ -0,0 +1,3 @@
+"use strict";
+const index_1 = require("./index");
+module.exports = index_1.plugin;

package/{dist/src → src}/rules/no-algorithm-confusion/index.js

@@ -1,14 +1,8 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noAlgorithmConfusion = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const utils_1 = require("../../utils");
-// Patterns that indicate a public key
 const PUBLIC_KEY_PATTERNS = [
     /public/i,
     /\.pub$/,
@@ -101,16 +95,10 @@ exports.noAlgorithmConfusion = (0, eslint_devkit_1.createRule)({
         const options = context.options[0] ?? {};
         const symmetricAlgSet = new Set(options.symmetricAlgorithms ?? ['HS256', 'HS384', 'HS512']);
         const sourceCode = context.sourceCode;
-        /**
-         * Check if a node looks like a public key reference
-         */
         const looksLikePublicKey = (node) => {
             const text = sourceCode.getText(node);
             return PUBLIC_KEY_PATTERNS.some((pattern) => pattern.test(text));
         };
-        /**
-         * Check if algorithms include symmetric algorithms
-         */
         const hasSymmetricAlgorithm = (algorithms) => {
             for (const alg of algorithms) {
                 if (symmetricAlgSet.has(alg)) {
@@ -121,26 +109,21 @@ exports.noAlgorithmConfusion = (0, eslint_devkit_1.createRule)({
         };
         return {
             CallExpression(node) {
-                // Only check verify operations
                 if (!(0, utils_1.isVerifyOperation)(node)) {
                     return;
                 }
-                // Need at least 2 arguments: token, key
                 if (node.arguments.length < 2) {
                     return;
                 }
                 const keyArg = node.arguments[1];
                 const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // Check if key looks like a public key
                 if (!looksLikePublicKey(keyArg)) {
                     return;
                 }
-                // If there are options, check the algorithms
                 if (optionsArg) {
                     const algorithms = (0, utils_1.extractAlgorithms)(optionsArg);
                     const symmetricAlg = hasSymmetricAlgorithm(algorithms);
                     if (symmetricAlg) {
-                        // Find the algorithm node for precise error location
                         for (const prop of optionsArg.properties) {
                             if (prop.type === 'Property' &&
                                 prop.key.type === 'Identifier' &&
@@ -155,9 +138,6 @@ exports.noAlgorithmConfusion = (0, eslint_devkit_1.createRule)({
                         }
                     }
                 }
-                // If no options specified but key looks like public key,
-                // and we're in verify, flag as potential issue
-                // (verification without explicit algorithm with public key is risky)
             },
         };
     },

package/{dist/src → src}/rules/no-algorithm-none/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noAlgorithmNone = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -107,20 +102,12 @@ exports.noAlgorithmNone = (0, eslint_devkit_1.createRule)({
         const options = context.options[0] ?? {};
         const { allowInTests = false } = options;
         const filename = context.filename;
-        // Skip test files if configured
         if (allowInTests && (0, utils_1.isTestFile)(filename)) {
             return {};
         }
-        /**
-         * Check if an algorithm value is 'none' (case insensitive)
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         const isNoneAlgorithm = (value) => {
             return value.toLowerCase() === 'none';
         };
-        /**
-         * Check options object for 'none' algorithm
-         */
         const checkOptionsForNone = (optionsNode) => {
             for (const prop of optionsNode.properties) {
                 if (prop.type !== 'Property' || prop.key.type !== 'Identifier') {
@@ -132,7 +119,6 @@ exports.noAlgorithmNone = (0, eslint_devkit_1.createRule)({
                     keyName !== 'alg') {
                     continue;
                 }
-                // Single algorithm: { algorithm: 'none' }
                 if (prop.value.type === 'Literal' &&
                     typeof prop.value.value === 'string') {
                     if (isNoneAlgorithm(prop.value.value)) {
@@ -142,9 +128,7 @@ exports.noAlgorithmNone = (0, eslint_devkit_1.createRule)({
                         });
                     }
                 }
-                // Array of algorithms: { algorithms: ['none'] } or { algorithms: [] }
                 if (prop.value.type === 'ArrayExpression') {
-                    // Check for empty array
                     if (prop.value.elements.length === 0) {
                         context.report({
                             node: prop.value,
@@ -152,7 +136,6 @@ exports.noAlgorithmNone = (0, eslint_devkit_1.createRule)({
                         });
                         continue;
                     }
-                    // Check each element for 'none'
                     for (const elem of prop.value.elements) {
                         if (elem &&
                             elem.type === 'Literal' &&
@@ -167,20 +150,6 @@ exports.noAlgorithmNone = (0, eslint_devkit_1.createRule)({
                 }
             }
         };
-        /**
-         * Detect `jwt.decode()` calls — closes the audit FN where
-         * `jwt.decode(token)` followed by trusting the decoded payload was
-         * silent, despite being functionally equivalent to algorithm:"none".
-         * See benchmarks/AUDIT_PATTERNS.md §3.8 ("verify-then-trust mismatch").
-         *
-         * The check is conservative: we flag every `jwt.decode()` call. In
-         * the rare case where `decode` is used legitimately (e.g. logging
-         * the issuer of an inbound token without authentication semantics),
-         * the user can disable the rule on that line. The default-on
-         * behaviour is correct — most production uses of `jwt.decode` are
-         * authentication mistakes.
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         function isDecodeCall(node) {
             const callee = node.callee;
             if (callee.type !== 'MemberExpression')
@@ -189,8 +158,6 @@ exports.noAlgorithmNone = (0, eslint_devkit_1.createRule)({
                 return false;
             if (callee.property.name !== 'decode')
                 return false;
-            // Object should be `jwt` (or imported as such). Check both
-            // `jwt.decode` and `JWT.decode` patterns.
             if (callee.object.type === 'Identifier') {
                 const name = callee.object.name.toLowerCase();
                 return name === 'jwt' || name === 'jsonwebtoken';
@@ -199,18 +166,13 @@ exports.noAlgorithmNone = (0, eslint_devkit_1.createRule)({
         }
         return {
             CallExpression(node) {
-                // Detect `jwt.decode(...)` — equivalent to algorithm:"none" if
-                // its result is trusted. We always flag (with critical severity)
-                // because the FN risk far outweighs the FP risk on real code.
                 if (isDecodeCall(node)) {
                     context.report({ node, messageId: 'decodeWithoutVerify' });
                     return;
                 }
-                // Check both verify and sign operations
                 if (!(0, utils_1.isVerifyOperation)(node) && !(0, utils_1.isSignOperation)(node)) {
                     return;
                 }
-                // Get options argument (usually 3rd argument)
                 const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
                 if (optionsArg) {
                     checkOptionsForNone(optionsArg);

package/{dist/src → src}/rules/no-decode-without-verify/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noDecodeWithoutVerify = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -87,12 +82,7 @@ exports.noDecodeWithoutVerify = (0, eslint_devkit_1.createRule)({
     create(context) {
         const options = context.options[0] ?? {};
         const { trustedAnnotations = [] } = options;
-        /**
-         * Check if this is a jwt-decode import usage
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         const isJwtDecodeLibrary = (node) => {
-            // Direct call: jwtDecode(token)
             if (node.callee.type === 'Identifier' &&
                 (node.callee.name === 'jwtDecode' || node.callee.name === 'jwt_decode')) {
                 return true;
@@ -101,9 +91,7 @@ exports.noDecodeWithoutVerify = (0, eslint_devkit_1.createRule)({
         };
         return {
             CallExpression(node) {
-                // Check for jwt.decode() pattern
                 if ((0, utils_1.isDecodeOperation)(node)) {
-                    // Check for safe annotations
                     if ((0, eslint_devkit_1.hasSafeAnnotation)(node, context, trustedAnnotations)) {
                         return;
                     }
@@ -113,9 +101,7 @@ exports.noDecodeWithoutVerify = (0, eslint_devkit_1.createRule)({
                     });
                     return;
                 }
-                // Check for jwt-decode library usage
                 if (isJwtDecodeLibrary(node)) {
-                    // Check for safe annotations
                     if ((0, eslint_devkit_1.hasSafeAnnotation)(node, context, trustedAnnotations)) {
                         return;
                     }

package/{dist/src → src}/rules/no-hardcoded-secret/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noHardcodedSecret = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -77,29 +72,16 @@ exports.noHardcodedSecret = (0, eslint_devkit_1.createRule)({
         },
     ],
     create(context) {
-        /**
-         * Check if a node is a hardcoded string literal
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         const isHardcodedString = (node) => {
-            // String literal
             if (node.type === 'Literal' && typeof node.value === 'string') {
                 return true;
             }
-            // Template literal without expressions
             if (node.type === 'TemplateLiteral' &&
                 node.expressions.length === 0) {
                 return true;
             }
             return false;
         };
-        /**
-         * Resolve an Identifier node to its initializer (one frame of indirection).
-         * Closes the audit FN where `const SECRET = 'x'; jwt.sign(p, SECRET)`
-         * was treated as safe — the literal-via-const pattern hides the
-         * hardcoded secret behind one declaration. See benchmarks/AUDIT_PATTERNS.md
-         * §3.2 ("Indirection through one level of variable").
-         */
         const resolveConstLiteralValue = (node) => {
             if (node.type !== 'Identifier')
                 return null;
@@ -115,45 +97,28 @@ exports.noHardcodedSecret = (0, eslint_devkit_1.createRule)({
                 return null;
             return def.node.init ?? null;
         };
-        /**
-         * Check if node is a safe key source
-         */
         const isSafeKeySource = (node) => {
-            // Environment variable
             if ((0, utils_1.isEnvVariable)(node)) {
                 return true;
             }
-            // Function call (getSecret(), loadKey(), etc.)
             if (node.type === 'CallExpression') {
                 return true;
             }
-            // await expression (async key loading)
             if (node.type === 'AwaitExpression') {
                 return true;
             }
-            // Variable reference: resolve `const X = ...` one level. If X is a
-            // hardcoded literal, treat as unsafe — fall through to the
-            // hardcoded check. Otherwise (env var, call, identifier chain)
-            // it's safe.
             if (node.type === 'Identifier') {
                 const init = resolveConstLiteralValue(node);
                 if (init && isHardcodedString(init)) {
-                    // Unsafe — let the caller's `isHardcodedString` (with the
-                    // resolved init) flag it.
                     return false;
                 }
                 return true;
             }
-            // Member expression but not literal (config.secret, etc.)
             if (node.type === 'MemberExpression' && !isHardcodedString(node)) {
                 return true;
             }
             return false;
         };
-        /**
-         * Like isHardcodedString but resolves single-level `const X = '...'`
-         * indirection so the caller fires on `const SECRET = 'x'; jwt.sign(p, SECRET)`.
-         */
         const isHardcodedStringOrResolvedConst = (node) => {
             if (isHardcodedString(node))
                 return true;
@@ -162,20 +127,16 @@ exports.noHardcodedSecret = (0, eslint_devkit_1.createRule)({
         };
         return {
             CallExpression(node) {
-                // Check both sign and verify operations
                 if (!(0, utils_1.isSignOperation)(node) && !(0, utils_1.isVerifyOperation)(node)) {
                     return;
                 }
-                // Secret/key is the second argument
                 if (node.arguments.length < 2) {
                     return;
                 }
                 const secretArg = node.arguments[1];
-                // Skip if safe source
                 if (isSafeKeySource(secretArg)) {
                     return;
                 }
-                // Flag hardcoded strings (also follows single-frame `const X = '...'`).
                 if (isHardcodedStringOrResolvedConst(secretArg)) {
                     context.report({
                         node: secretArg,

package/{dist/src → src}/rules/no-sensitive-payload/index.js

@@ -1,9 +1,4 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.noSensitivePayload = void 0;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
@@ -81,7 +76,6 @@ exports.noSensitivePayload = (0, eslint_devkit_1.createRule)({
                     return;
                 }
                 const payloadArg = node.arguments[0];
-                // Check object literal payload
                 if (payloadArg.type === 'ObjectExpression') {
                     for (const prop of payloadArg.properties) {
                         if (prop.type === 'Property' && prop.key.type === 'Identifier') {