eslint-plugin-secure-coding 3.0.1 → 3.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (130) hide show
  1. package/AGENTS.md +1 -1
  2. package/README.md +60 -226
  3. package/package.json +6 -5
  4. package/src/index.d.ts +2 -2
  5. package/src/index.js +29 -263
  6. package/src/rules/detect-non-literal-regexp/index.d.ts +3 -1
  7. package/src/rules/detect-object-injection/index.d.ts +3 -1
  8. package/src/rules/detect-weak-password-validation/index.d.ts +3 -1
  9. package/src/rules/no-directive-injection/index.d.ts +3 -1
  10. package/src/rules/no-electron-security-issues/index.d.ts +3 -1
  11. package/src/rules/no-format-string-injection/index.d.ts +3 -1
  12. package/src/rules/no-graphql-injection/index.d.ts +3 -1
  13. package/src/rules/no-hardcoded-credentials/index.d.ts +3 -1
  14. package/src/rules/no-hardcoded-session-tokens/index.d.ts +3 -1
  15. package/src/rules/no-improper-sanitization/index.d.ts +3 -1
  16. package/src/rules/no-improper-type-validation/index.d.ts +3 -1
  17. package/src/rules/no-insecure-comparison/index.d.ts +3 -1
  18. package/src/rules/no-ldap-injection/index.d.ts +3 -1
  19. package/src/rules/no-missing-authentication/index.d.ts +3 -1
  20. package/src/rules/no-missing-authentication/index.js +0 -1
  21. package/src/rules/no-pii-in-logs/index.d.ts +3 -1
  22. package/src/rules/no-privilege-escalation/index.d.ts +3 -1
  23. package/src/rules/no-redos-vulnerable-regex/index.d.ts +3 -1
  24. package/src/rules/no-sensitive-data-exposure/index.d.ts +3 -1
  25. package/src/rules/no-unchecked-loop-condition/index.d.ts +3 -1
  26. package/src/rules/no-unlimited-resource-allocation/index.d.ts +3 -1
  27. package/src/rules/no-unsafe-deserialization/index.d.ts +3 -1
  28. package/src/rules/no-unsafe-regex-construction/index.d.ts +3 -1
  29. package/src/rules/no-weak-password-recovery/index.d.ts +3 -1
  30. package/src/rules/no-xpath-injection/index.d.ts +3 -1
  31. package/src/rules/no-xxe-injection/index.d.ts +3 -1
  32. package/src/rules/require-backend-authorization/index.d.ts +3 -1
  33. package/src/rules/require-secure-defaults/index.d.ts +3 -1
  34. package/src/types/index.d.ts +5 -52
  35. package/src/rules/detect-child-process/index.d.ts +0 -28
  36. package/src/rules/detect-child-process/index.js +0 -534
  37. package/src/rules/detect-eval-with-expression/index.d.ts +0 -26
  38. package/src/rules/detect-eval-with-expression/index.js +0 -397
  39. package/src/rules/detect-mixed-content/index.d.ts +0 -10
  40. package/src/rules/detect-mixed-content/index.js +0 -45
  41. package/src/rules/detect-non-literal-fs-filename/index.d.ts +0 -24
  42. package/src/rules/detect-non-literal-fs-filename/index.js +0 -459
  43. package/src/rules/detect-suspicious-dependencies/index.d.ts +0 -10
  44. package/src/rules/detect-suspicious-dependencies/index.js +0 -76
  45. package/src/rules/no-allow-arbitrary-loads/index.d.ts +0 -10
  46. package/src/rules/no-allow-arbitrary-loads/index.js +0 -48
  47. package/src/rules/no-arbitrary-file-access/index.d.ts +0 -10
  48. package/src/rules/no-arbitrary-file-access/index.js +0 -200
  49. package/src/rules/no-buffer-overread/index.d.ts +0 -37
  50. package/src/rules/no-buffer-overread/index.js +0 -611
  51. package/src/rules/no-clickjacking/index.d.ts +0 -34
  52. package/src/rules/no-clickjacking/index.js +0 -401
  53. package/src/rules/no-client-side-auth-logic/index.d.ts +0 -10
  54. package/src/rules/no-client-side-auth-logic/index.js +0 -74
  55. package/src/rules/no-credentials-in-query-params/index.d.ts +0 -10
  56. package/src/rules/no-credentials-in-query-params/index.js +0 -62
  57. package/src/rules/no-data-in-temp-storage/index.d.ts +0 -10
  58. package/src/rules/no-data-in-temp-storage/index.js +0 -69
  59. package/src/rules/no-debug-code-in-production/index.d.ts +0 -10
  60. package/src/rules/no-debug-code-in-production/index.js +0 -54
  61. package/src/rules/no-disabled-certificate-validation/index.d.ts +0 -10
  62. package/src/rules/no-disabled-certificate-validation/index.js +0 -66
  63. package/src/rules/no-dynamic-dependency-loading/index.d.ts +0 -10
  64. package/src/rules/no-dynamic-dependency-loading/index.js +0 -54
  65. package/src/rules/no-exposed-debug-endpoints/index.d.ts +0 -10
  66. package/src/rules/no-exposed-debug-endpoints/index.js +0 -67
  67. package/src/rules/no-exposed-sensitive-data/index.d.ts +0 -28
  68. package/src/rules/no-exposed-sensitive-data/index.js +0 -345
  69. package/src/rules/no-http-urls/index.d.ts +0 -15
  70. package/src/rules/no-http-urls/index.js +0 -119
  71. package/src/rules/no-insecure-redirects/index.d.ts +0 -24
  72. package/src/rules/no-insecure-redirects/index.js +0 -221
  73. package/src/rules/no-insecure-websocket/index.d.ts +0 -10
  74. package/src/rules/no-insecure-websocket/index.js +0 -66
  75. package/src/rules/no-missing-cors-check/index.d.ts +0 -26
  76. package/src/rules/no-missing-cors-check/index.js +0 -404
  77. package/src/rules/no-missing-csrf-protection/index.d.ts +0 -28
  78. package/src/rules/no-missing-csrf-protection/index.js +0 -185
  79. package/src/rules/no-missing-security-headers/index.d.ts +0 -24
  80. package/src/rules/no-missing-security-headers/index.js +0 -223
  81. package/src/rules/no-password-in-url/index.d.ts +0 -10
  82. package/src/rules/no-password-in-url/index.js +0 -55
  83. package/src/rules/no-permissive-cors/index.d.ts +0 -10
  84. package/src/rules/no-permissive-cors/index.js +0 -74
  85. package/src/rules/no-sensitive-data-in-analytics/index.d.ts +0 -10
  86. package/src/rules/no-sensitive-data-in-analytics/index.js +0 -66
  87. package/src/rules/no-sensitive-data-in-cache/index.d.ts +0 -10
  88. package/src/rules/no-sensitive-data-in-cache/index.js +0 -53
  89. package/src/rules/no-toctou-vulnerability/index.d.ts +0 -24
  90. package/src/rules/no-toctou-vulnerability/index.js +0 -213
  91. package/src/rules/no-tracking-without-consent/index.d.ts +0 -10
  92. package/src/rules/no-tracking-without-consent/index.js +0 -72
  93. package/src/rules/no-unencrypted-transmission/index.d.ts +0 -28
  94. package/src/rules/no-unencrypted-transmission/index.js +0 -241
  95. package/src/rules/no-unescaped-url-parameter/index.d.ts +0 -26
  96. package/src/rules/no-unescaped-url-parameter/index.js +0 -360
  97. package/src/rules/no-unsafe-dynamic-require/index.d.ts +0 -17
  98. package/src/rules/no-unsafe-dynamic-require/index.js +0 -111
  99. package/src/rules/no-unvalidated-deeplinks/index.d.ts +0 -10
  100. package/src/rules/no-unvalidated-deeplinks/index.js +0 -67
  101. package/src/rules/no-unvalidated-user-input/index.d.ts +0 -26
  102. package/src/rules/no-unvalidated-user-input/index.js +0 -425
  103. package/src/rules/no-verbose-error-messages/index.d.ts +0 -10
  104. package/src/rules/no-verbose-error-messages/index.js +0 -73
  105. package/src/rules/no-zip-slip/index.d.ts +0 -33
  106. package/src/rules/no-zip-slip/index.js +0 -450
  107. package/src/rules/require-code-minification/index.d.ts +0 -10
  108. package/src/rules/require-code-minification/index.js +0 -48
  109. package/src/rules/require-csp-headers/index.d.ts +0 -10
  110. package/src/rules/require-csp-headers/index.js +0 -69
  111. package/src/rules/require-data-minimization/index.d.ts +0 -10
  112. package/src/rules/require-data-minimization/index.js +0 -55
  113. package/src/rules/require-dependency-integrity/index.d.ts +0 -10
  114. package/src/rules/require-dependency-integrity/index.js +0 -69
  115. package/src/rules/require-https-only/index.d.ts +0 -10
  116. package/src/rules/require-https-only/index.js +0 -67
  117. package/src/rules/require-mime-type-validation/index.d.ts +0 -10
  118. package/src/rules/require-mime-type-validation/index.js +0 -71
  119. package/src/rules/require-network-timeout/index.d.ts +0 -10
  120. package/src/rules/require-network-timeout/index.js +0 -57
  121. package/src/rules/require-package-lock/index.d.ts +0 -10
  122. package/src/rules/require-package-lock/index.js +0 -64
  123. package/src/rules/require-secure-credential-storage/index.d.ts +0 -10
  124. package/src/rules/require-secure-credential-storage/index.js +0 -53
  125. package/src/rules/require-secure-deletion/index.d.ts +0 -10
  126. package/src/rules/require-secure-deletion/index.js +0 -45
  127. package/src/rules/require-storage-encryption/index.d.ts +0 -10
  128. package/src/rules/require-storage-encryption/index.js +0 -53
  129. package/src/rules/require-url-validation/index.d.ts +0 -10
  130. package/src/rules/require-url-validation/index.js +0 -77
package/AGENTS.md CHANGED
@@ -6,7 +6,7 @@
6
6
 
7
7
  ```bash
8
8
  # Install dependencies (from monorepo root)
9
- pnpm install
9
+ npm install
10
10
 
11
11
  # Build this package
12
12
  nx build eslint-plugin-secure-coding
package/README.md CHANGED
@@ -16,7 +16,8 @@
16
16
 
17
17
  ## Description
18
18
 
19
- This plugin provides a comprehensive set of security rules for JavaScript and TypeScript, ensuring alignment with OWASP compliance standards. It covers a wide range of vulnerabilities, from injection attacks to insecure data handling, offering a solid foundation for secure application development. By using this plugin, you can proactively identify and mitigate security risks across your entire codebase.
19
+ This plugin provides General secure coding practices and OWASP compliance for JavaScript/TypeScript.
20
+ By using this plugin, you can proactively identify and mitigate security risks across your entire codebase.
20
21
 
21
22
  ## Philosophy
22
23
 
@@ -24,19 +25,18 @@ This plugin provides a comprehensive set of security rules for JavaScript and Ty
24
25
 
25
26
  ## Getting Started
26
27
 
27
- - To check out the [guide](https://eslint.interlace.tools/docs/secure-coding), visit [eslint.interlace.tools](https://eslint.interlace.tools). 📚
28
- - 要查看中文 [指南](https://eslint.interlace.tools/docs/secure-coding), 请访问 [eslint.interlace.tools](https://eslint.interlace.tools). 📚
29
- - [가이드](https://eslint.interlace.tools/docs/secure-coding) 문서는 [eslint.interlace.tools](https://eslint.interlace.tools)에서 확인하실 수 있습니다. 📚
30
- - [ガイド](https://eslint.interlace.tools/docs/secure-coding)は [eslint.interlace.tools](https://eslint.interlace.tools)でご確認ください。 📚
31
- - Para ver la [guía](https://eslint.interlace.tools/docs/secure-coding), visita [eslint.interlace.tools](https://eslint.interlace.tools). 📚
32
- - للاطلاع على [الدليل](https://eslint.interlace.tools/docs/secure-coding)، قم بزيارة [eslint.interlace.tools](https://eslint.interlace.tools). 📚
28
+ - To check out the [guide](https://eslint.interlace.tools/docs/security/plugin-secure-coding), visit [eslint.interlace.tools](https://eslint.interlace.tools). 📚
29
+ - 要查看中文 [指南](https://eslint.interlace.tools/docs/security/plugin-secure-coding), 请访问 [eslint.interlace.tools](https://eslint.interlace.tools). 📚
30
+ - [가이드](https://eslint.interlace.tools/docs/security/plugin-secure-coding) 문서는 [eslint.interlace.tools](https://eslint.interlace.tools)에서 확인하실 수 있습니다. 📚
31
+ - [ガイド](https://eslint.interlace.tools/docs/security/plugin-secure-coding)は [eslint.interlace.tools](https://eslint.interlace.tools)でご確認ください。 📚
32
+ - Para ver la [guía](https://eslint.interlace.tools/docs/security/plugin-secure-coding), visita [eslint.interlace.tools](https://eslint.interlace.tools). 📚
33
+ - للاطلاع على [الدليل](https://eslint.interlace.tools/docs/security/plugin-secure-coding)، قم بزيارة [eslint.interlace.tools](https://eslint.interlace.tools). 📚
33
34
 
34
35
  ```bash
35
36
  npm install eslint-plugin-secure-coding --save-dev
36
37
  ```
37
38
 
38
39
  ## ⚙️ Configuration Presets
39
-
40
40
  | Preset | Description |
41
41
  | :-------------------- | :-------------------------------------------------------------- |
42
42
  | `recommended` | Balanced security for most projects (Web + key Mobile security) |
@@ -46,236 +46,70 @@ npm install eslint-plugin-secure-coding --save-dev
46
46
 
47
47
  ---
48
48
 
49
- ## 🏢 Enterprise Integration Example
50
-
51
- ```bash
52
- # Install once at the repo root
53
- pnpm add -D eslint-plugin-secure-coding
54
-
55
- # eslint.config.js (org-standard)
56
- import secureCoding from 'eslint-plugin-secure-coding';
57
-
58
- export default [
59
- // Baseline for all services (balanced)
60
- secureCoding.configs.recommended,
61
-
62
- // Add OWASP Top 10 enforcement for internet-facing apps
63
- {
64
- files: ['apps/web/**'],
65
- ...secureCoding.configs['owasp-top-10'],
66
- },
67
-
68
- // Add OWASP Mobile Top 10 for mobile/native apps
69
- {
70
- files: ['apps/mobile/**'],
71
- ...secureCoding.configs['owasp-mobile-top-10'],
72
- },
73
-
74
- // Force strict mode for critical backend services
75
- {
76
- files: ['services/payments/**', 'services/auth/**'],
77
- ...secureCoding.configs.strict,
78
- },
79
- ];
80
- ```
81
-
82
- What this gives organizations:
83
-
84
- - OWASP/CWE/CVSS metadata in every finding for compliance mapping
85
- - Consistent, LLM-ready fixes that teammates and AI can apply safely
86
- - Tiered policies (baseline, OWASP-focused, strict) per surface area
87
-
88
- ---
89
-
90
- ## 🧭 Type-safe rule configuration (eslint.config.ts)
91
-
92
- This package ships rule option types to keep flat configs type-safe.
93
-
94
- ```ts
95
- import type { Linter } from 'eslint';
96
- import type { AllSecurityRulesOptions } from 'eslint-plugin-secure-coding/types';
97
- import secureCoding from 'eslint-plugin-secure-coding';
98
-
99
- const secureCodingRuleOptions: AllSecurityRulesOptions = {
100
- 'no-sql-injection': { strategy: 'parameterize' },
101
- 'no-unsafe-deserialization': { allowJSON: false },
102
- };
103
-
104
- export default [
105
- {
106
- ...secureCoding.configs.recommended,
107
- rules: {
108
- ...secureCoding.configs.recommended.rules,
109
- 'secure-coding/no-sql-injection': [
110
- 'error',
111
- secureCodingRuleOptions['no-sql-injection'],
112
- ],
113
- 'secure-coding/no-unsafe-deserialization': [
114
- 'error',
115
- secureCodingRuleOptions['no-unsafe-deserialization'],
116
- ],
117
- },
118
- },
119
- secureCoding.configs['owasp-top-10'],
120
- secureCoding.configs.strict,
121
- ] satisfies Linter.FlatConfig[];
122
- ```
123
-
124
- ---
125
-
126
- ## AI-Optimized Messages
127
-
128
- This plugin is optimized for ESLint's [Model Context Protocol (MCP)](https://eslint.org/docs/latest/use/mcp), enabling AI assistants like **Cursor**, **GitHub Copilot**, and **Claude** to:
129
-
130
- - Understand the exact vulnerability type via CWE references
131
- - Apply the correct fix using structured guidance
132
- - Provide educational context to developers
133
-
134
- ```bash
135
- src/api.ts
136
- 42:15 error 🔒 CWE-89 OWASP:A03-Injection CVSS:9.8 | SQL Injection detected | CRITICAL [SOC2,PCI-DSS,HIPAA]
137
- Fix: Use parameterized query: db.query("SELECT * FROM users WHERE id = ?", [userId]) | https://owasp.org/...
138
- ```
139
-
140
- ```json
141
- // .cursor/mcp.json
142
- {
143
- "mcpServers": {
144
- "eslint": {
145
- "command": "npx",
146
- "args": ["@eslint/mcp@latest"]
147
- }
148
- }
149
- }
150
- ```
151
-
152
- By providing this structured context (CWE, OWASP, Fix), we enable AI tools to **reason** about the security flaw rather than hallucinating. This allows Copilot/Cursor to suggest the _exact_ correct fix immediately.
153
-
154
- ---
155
-
156
- ## 🔒 Privacy
157
-
158
- This plugin runs **100% locally**. No data ever leaves your machine.
159
-
160
- ---
161
-
162
- **Q: Does it work with ESLint 9 flat config?**
163
- A: Yes, fully compatible.
164
-
165
49
  ## Rules
166
50
 
167
51
  **Legend**
168
52
 
169
- | Icon | Description |
170
- | :--: | :----------------------------------------------------------------- |
171
- | 💼 | **Recommended**: Included in the recommended preset. |
172
- | ⚠️ | **Warns**: Set towarn in recommended preset. |
173
- | 🔧 | **Auto-fixable**: Automatically fixable by the `--fix` CLI option. |
174
- | 💡 | **Suggestions**: Providing code suggestions in IDE. |
175
- | 🚫 | **Deprecated**: This rule is deprecated. |
176
-
177
- | Rule | CWE | OWASP | CVSS | Description | 💼 | ⚠️ | 🔧 | 💡 | 🚫 |
178
- | :--------------------------------------------------------------------------------------------------------------------------------------- | :------: | :---: | :--: | :----------------------------------------------------------------------------------------------- | :-: | :-: | :-: | :-: | :-: |
179
- | [no-sql-injection](https://eslint.interlace.tools/docs/secure-coding/rules/no-sql-injection) | CWE-89 | | 9.8 | [no-sql-injection](./docs/rules/no-sql-injection.md) | 💼 | | | | |
180
- | [database-injection](https://eslint.interlace.tools/docs/secure-coding/rules/database-injection) | CWE-89 | | 9.8 | [database-injection](./docs/rules/database-injection.md) | 💼 | | | | |
181
- | [detect-eval-with-expression](https://eslint.interlace.tools/docs/secure-coding/rules/detect-eval-with-expression) | CWE-95 | | 9.8 | [detect-eval-with-expression](./docs/rules/detect-eval-with-expression.md) | 💼 | | | | |
182
- | [detect-child-process](https://eslint.interlace.tools/docs/secure-coding/rules/detect-child-process) | CWE-78 | | 9.8 | [detect-child-process](./docs/rules/detect-child-process.md) | 💼 | | | | |
183
- | [no-unsafe-dynamic-require](https://eslint.interlace.tools/docs/secure-coding/rules/no-unsafe-dynamic-require) | CWE-95 | | 7.5 | [no-unsafe-dynamic-require](./docs/rules/no-unsafe-dynamic-require.md) | 💼 | | | | |
184
- | [no-graphql-injection](https://eslint.interlace.tools/docs/secure-coding/rules/no-graphql-injection) | CWE-943 | | 8.6 | [no-graphql-injection](./docs/rules/no-graphql-injection.md) | 💼 | | | | |
185
- | [no-xxe-injection](https://eslint.interlace.tools/docs/secure-coding/rules/no-xxe-injection) | CWE-611 | | 9.1 | [no-xxe-injection](./docs/rules/no-xxe-injection.md) | 💼 | | | | |
186
- | [no-xpath-injection](https://eslint.interlace.tools/docs/secure-coding/rules/no-xpath-injection) | CWE-643 | | 9.8 | [no-xpath-injection](./docs/rules/no-xpath-injection.md) | 💼 | | | | |
187
- | [no-ldap-injection](https://eslint.interlace.tools/docs/secure-coding/rules/no-ldap-injection) | CWE-90 | | 9.8 | [no-ldap-injection](./docs/rules/no-ldap-injection.md) | 💼 | | | | |
188
- | [no-directive-injection](https://eslint.interlace.tools/docs/secure-coding/rules/no-directive-injection) | CWE-94 | | 8.8 | [no-directive-injection](./docs/rules/no-directive-injection.md) | 💼 | | | | |
189
- | [no-format-string-injection](https://eslint.interlace.tools/docs/secure-coding/rules/no-format-string-injection) | CWE-134 | | 9.8 | [no-format-string-injection](./docs/rules/no-format-string-injection.md) | 💼 | | | | |
190
- | [no-http-urls](https://eslint.interlace.tools/docs/secure-coding/rules/no-http-urls) | CWE-319 | | 7.5 | [no-http-urls](./docs/rules/no-http-urls.md) | 💼 | | | | |
191
- | [no-hardcoded-credentials](https://eslint.interlace.tools/docs/secure-coding/rules/no-hardcoded-credentials) | CWE-798 | | 7.5 | [no-hardcoded-credentials](./docs/rules/no-hardcoded-credentials.md) | 💼 | | 🔧 | 💡 | |
192
- | [no-credentials-in-storage-api](https://eslint.interlace.tools/docs/secure-coding/rules/no-credentials-in-storage-api) | CWE-522 | | 7.5 | [no-credentials-in-storage-api](./docs/rules/no-credentials-in-storage-api.md) | 💼 | | | | |
193
- | [no-credentials-in-query-params](https://eslint.interlace.tools/docs/secure-coding/rules/no-credentials-in-query-params) | CWE-598 | | 7.5 | [no-credentials-in-query-params](./docs/rules/no-credentials-in-query-params.md) | 💼 | | | | |
194
- | [no-allow-arbitrary-loads](https://eslint.interlace.tools/docs/secure-coding/rules/no-allow-arbitrary-loads) | CWE-295 | | 7.5 | [no-allow-arbitrary-loads](./docs/rules/no-allow-arbitrary-loads.md) | | | | | |
195
- | [no-disabled-certificate-validation](https://eslint.interlace.tools/docs/secure-coding/rules/no-disabled-certificate-validation) | CWE-295 | | 7.5 | [no-disabled-certificate-validation](./docs/rules/no-disabled-certificate-validation.md) | | | | | |
196
- | [require-https-only](https://eslint.interlace.tools/docs/secure-coding/rules/require-https-only) | CWE-319 | | 7.5 | [require-https-only](./docs/rules/require-https-only.md) | 💼 | | | | |
197
- | [require-network-timeout](https://eslint.interlace.tools/docs/secure-coding/rules/require-network-timeout) | CWE-400 | | 7.5 | [require-network-timeout](./docs/rules/require-network-timeout.md) | | | | | |
198
- | [detect-weak-password-validation](https://eslint.interlace.tools/docs/secure-coding/rules/detect-weak-password-validation) | CWE-521 | | 7.5 | [detect-weak-password-validation](./docs/rules/detect-weak-password-validation.md) | | | | | |
199
- | [no-client-side-auth-logic](https://eslint.interlace.tools/docs/secure-coding/rules/no-client-side-auth-logic) | CWE-602 | | 7.5 | [no-client-side-auth-logic](./docs/rules/no-client-side-auth-logic.md) | | | | | |
200
- | [no-hardcoded-session-tokens](https://eslint.interlace.tools/docs/secure-coding/rules/no-hardcoded-session-tokens) | CWE-798 | | 9.8 | [no-hardcoded-session-tokens](./docs/rules/no-hardcoded-session-tokens.md) | 💼 | | | | |
201
- | [no-unvalidated-deeplinks](https://eslint.interlace.tools/docs/secure-coding/rules/no-unvalidated-deeplinks) | CWE-939 | | 7.5 | [no-unvalidated-deeplinks](./docs/rules/no-unvalidated-deeplinks.md) | 💼 | | | | |
202
- | [require-url-validation](https://eslint.interlace.tools/docs/secure-coding/rules/require-url-validation) | CWE-601 | | 7.5 | [require-url-validation](./docs/rules/require-url-validation.md) | | | | | |
203
- | [require-mime-type-validation](https://eslint.interlace.tools/docs/secure-coding/rules/require-mime-type-validation) | CWE-434 | | 7.5 | [require-mime-type-validation](./docs/rules/require-mime-type-validation.md) | | | | | |
204
- | [no-arbitrary-file-access](https://eslint.interlace.tools/docs/secure-coding/rules/no-arbitrary-file-access) | CWE-22 | | 7.5 | [no-arbitrary-file-access](./docs/rules/no-arbitrary-file-access.md) | | | | | |
205
- | [no-pii-in-logs](https://eslint.interlace.tools/docs/secure-coding/rules/no-pii-in-logs) | CWE-532 | | 7.5 | [no-pii-in-logs](./docs/rules/no-pii-in-logs.md) | | ⚠️ | | | |
206
- | [no-tracking-without-consent](https://eslint.interlace.tools/docs/secure-coding/rules/no-tracking-without-consent) | CWE-359 | | 7.5 | [no-tracking-without-consent](./docs/rules/no-tracking-without-consent.md) | | | | | |
207
- | [no-sensitive-data-in-analytics](https://eslint.interlace.tools/docs/secure-coding/rules/no-sensitive-data-in-analytics) | CWE-359 | | 7.5 | [no-sensitive-data-in-analytics](./docs/rules/no-sensitive-data-in-analytics.md) | | | | | |
208
- | [require-data-minimization](https://eslint.interlace.tools/docs/secure-coding/rules/require-data-minimization) | CWE-213 | | 7.5 | [require-data-minimization](./docs/rules/require-data-minimization.md) | | | | | |
209
- | [no-debug-code-in-production](https://eslint.interlace.tools/docs/secure-coding/rules/no-debug-code-in-production) | CWE-489 | | 7.5 | [no-debug-code-in-production](./docs/rules/no-debug-code-in-production.md) | | | | | |
210
- | [require-code-minification](https://eslint.interlace.tools/docs/secure-coding/rules/require-code-minification) | CWE-656 | | 7.5 | [require-code-minification](./docs/rules/require-code-minification.md) | | | | | |
211
- | [no-verbose-error-messages](https://eslint.interlace.tools/docs/secure-coding/rules/no-verbose-error-messages) | CWE-209 | | 7.5 | [no-verbose-error-messages](./docs/rules/no-verbose-error-messages.md) | | ⚠️ | | | |
212
- | [require-secure-defaults](https://eslint.interlace.tools/docs/secure-coding/rules/require-secure-defaults) | CWE-276 | | 7.5 | [require-secure-defaults](./docs/rules/require-secure-defaults.md) | | | | | |
213
- | [no-sensitive-data-in-cache](https://eslint.interlace.tools/docs/secure-coding/rules/no-sensitive-data-in-cache) | CWE-524 | | 7.5 | [no-sensitive-data-in-cache](./docs/rules/no-sensitive-data-in-cache.md) | | | | | |
214
- | [no-data-in-temp-storage](https://eslint.interlace.tools/docs/secure-coding/rules/no-data-in-temp-storage) | CWE-312 | | 7.5 | [no-data-in-temp-storage](./docs/rules/no-data-in-temp-storage.md) | | | | | |
215
- | [require-secure-deletion](https://eslint.interlace.tools/docs/secure-coding/rules/require-secure-deletion) | CWE-459 | | 7.5 | [require-secure-deletion](./docs/rules/require-secure-deletion.md) | | | | | |
216
- | [require-storage-encryption](https://eslint.interlace.tools/docs/secure-coding/rules/require-storage-encryption) | CWE-311 | | 7.5 | [require-storage-encryption](./docs/rules/require-storage-encryption.md) | | | | | |
217
- | [no-unencrypted-local-storage](https://eslint.interlace.tools/docs/secure-coding/rules/no-unencrypted-local-storage) | CWE-312 | | 7.5 | [no-unencrypted-local-storage](./docs/rules/no-unencrypted-local-storage.md) | | | | | |
218
- | [require-credential-storage](https://eslint.interlace.tools/docs/secure-coding/rules/require-credential-storage) | CWE-522 | | 7.5 | [require-credential-storage](./docs/rules/require-credential-storage.md) | | | | | |
219
- | [no-exposed-debug-endpoints](https://eslint.interlace.tools/docs/secure-coding/rules/no-exposed-debug-endpoints) | CWE-489 | | 7.5 | [no-exposed-debug-endpoints](./docs/rules/no-exposed-debug-endpoints.md) | | | | | |
220
- | [detect-non-literal-fs-filename](https://eslint.interlace.tools/docs/secure-coding/rules/detect-non-literal-fs-filename) | CWE-22 | | 7.5 | [detect-non-literal-fs-filename](./docs/rules/detect-non-literal-fs-filename.md) | 💼 | | | | |
221
- | [no-zip-slip](https://eslint.interlace.tools/docs/secure-coding/rules/no-zip-slip) | CWE-22 | | 8.1 | [no-zip-slip](./docs/rules/no-zip-slip.md) | 💼 | | | | |
222
- | [no-toctou-vulnerability](https://eslint.interlace.tools/docs/secure-coding/rules/no-toctou-vulnerability) | CWE-367 | | 7.0 | [no-toctou-vulnerability](./docs/rules/no-toctou-vulnerability.md) | 💼 | | | 💡 | |
223
- | [detect-non-literal-regexp](https://eslint.interlace.tools/docs/secure-coding/rules/detect-non-literal-regexp) | CWE-400 | | 7.5 | [detect-non-literal-regexp](./docs/rules/detect-non-literal-regexp.md) | | ⚠️ | | | |
224
- | [no-redos-vulnerable-regex](https://eslint.interlace.tools/docs/secure-coding/rules/no-redos-vulnerable-regex) | CWE-1333 | | 7.5 | [no-redos-vulnerable-regex](./docs/rules/no-redos-vulnerable-regex.md) | 💼 | | | 💡 | |
225
- | [no-unsafe-regex-construction](https://eslint.interlace.tools/docs/secure-coding/rules/no-unsafe-regex-construction) | CWE-400 | | 7.5 | [no-unsafe-regex-construction](./docs/rules/no-unsafe-regex-construction.md) | | ⚠️ | | 💡 | |
226
- | [detect-object-injection](https://eslint.interlace.tools/docs/secure-coding/rules/detect-object-injection) | CWE-915 | | 7.3 | [detect-object-injection](./docs/rules/detect-object-injection.md) | | ⚠️ | | | |
227
- | [no-unsafe-deserialization](https://eslint.interlace.tools/docs/secure-coding/rules/no-unsafe-deserialization) | CWE-502 | | 9.8 | [no-unsafe-deserialization](./docs/rules/no-unsafe-deserialization.md) | 💼 | | | | |
228
- | [no-weak-crypto](https://eslint.interlace.tools/docs/secure-coding/rules/no-weak-crypto) | CWE-327 | | 7.5 | [no-weak-crypto](./docs/rules/no-weak-crypto.md) | 💼 | | | | 🚫 |
229
- | [no-insufficient-random](https://eslint.interlace.tools/docs/secure-coding/rules/no-insufficient-random) | CWE-330 | | 5.3 | [no-insufficient-random](./docs/rules/no-insufficient-random.md) | | ⚠️ | | | 🚫 |
230
- | [no-timing-attack](https://eslint.interlace.tools/docs/secure-coding/rules/no-timing-attack) | CWE-208 | | 5.9 | [no-timing-attack](./docs/rules/no-timing-attack.md) | 💼 | | | | 🚫 |
231
- | [no-insecure-comparison](https://eslint.interlace.tools/docs/secure-coding/rules/no-insecure-comparison) | CWE-697 | | 5.3 | [no-insecure-comparison](./docs/rules/no-insecure-comparison.md) | | ⚠️ | 🔧 | | 🚫 |
232
- | [no-insecure-jwt](https://eslint.interlace.tools/docs/secure-coding/rules/no-insecure-jwt) | CWE-347 | | 7.5 | [no-insecure-jwt](./docs/rules/no-insecure-jwt.md) | 💼 | | | | 🚫 |
233
- | [no-unvalidated-user-input](https://eslint.interlace.tools/docs/secure-coding/rules/no-unvalidated-user-input) | CWE-20 | | 8.6 | [no-unvalidated-user-input](./docs/rules/no-unvalidated-user-input.md) | | ⚠️ | | | |
234
- | [no-unsanitized-html](https://eslint.interlace.tools/docs/secure-coding/rules/no-unsanitized-html) | CWE-79 | | 6.1 | [no-unsanitized-html](./docs/rules/no-unsanitized-html.md) | 💼 | | | | |
235
- | [no-unescaped-url-parameter](https://eslint.interlace.tools/docs/secure-coding/rules/no-unescaped-url-parameter) | CWE-79 | | 6.1 | [no-unescaped-url-parameter](./docs/rules/no-unescaped-url-parameter.md) | | ⚠️ | | | |
236
- | [no-improper-sanitization](https://eslint.interlace.tools/docs/secure-coding/rules/no-improper-sanitization) | CWE-116 | | 7.5 | [no-improper-sanitization](./docs/rules/no-improper-sanitization.md) | 💼 | | | | |
237
- | [no-improper-type-validation](https://eslint.interlace.tools/docs/secure-coding/rules/no-improper-type-validation) | CWE-20 | | 5.3 | [no-improper-type-validation](./docs/rules/no-improper-type-validation.md) | | ⚠️ | | | |
238
- | [no-missing-authentication](https://eslint.interlace.tools/docs/secure-coding/rules/no-missing-authentication) | CWE-306 | | 9.8 | [no-missing-authentication](./docs/rules/no-missing-authentication.md) | | ⚠️ | | | |
239
- | [no-privilege-escalation](https://eslint.interlace.tools/docs/secure-coding/rules/no-privilege-escalation) | CWE-269 | | 8.8 | [no-privilege-escalation](./docs/rules/no-privilege-escalation.md) | | ⚠️ | | | |
240
- | [no-weak-password-recovery](https://eslint.interlace.tools/docs/secure-coding/rules/no-weak-password-recovery) | CWE-640 | | 9.8 | [no-weak-password-recovery](./docs/rules/no-weak-password-recovery.md) | 💼 | | | | |
241
- | [no-insecure-cookie-settings](https://eslint.interlace.tools/docs/secure-coding/rules/no-insecure-cookie-settings) | CWE-614 | | 5.3 | [no-insecure-cookie-settings](./docs/rules/no-insecure-cookie-settings.md) | | ⚠️ | | | 🚫 |
242
- | [no-missing-csrf-protection](https://eslint.interlace.tools/docs/secure-coding/rules/no-missing-csrf-protection) | CWE-352 | | 8.8 | [no-missing-csrf-protection](./docs/rules/no-missing-csrf-protection.md) | | ⚠️ | | | 🚫 |
243
- | [no-document-cookie](https://eslint.interlace.tools/docs/secure-coding/rules/no-document-cookie) | CWE-565 | | 4.3 | [no-document-cookie](./docs/rules/no-document-cookie.md) | | ⚠️ | | 💡 | |
244
- | [no-missing-cors-check](https://eslint.interlace.tools/docs/secure-coding/rules/no-missing-cors-check) | CWE-942 | | 7.5 | [no-missing-cors-check](./docs/rules/no-missing-cors-check.md) | | ⚠️ | | | 🚫 |
245
- | [no-missing-security-headers](https://eslint.interlace.tools/docs/secure-coding/rules/no-missing-security-headers) | CWE-693 | | 5.3 | [no-missing-security-headers](./docs/rules/no-missing-security-headers.md) | | ⚠️ | | 💡 | 🚫 |
246
- | [no-insecure-redirects](https://eslint.interlace.tools/docs/secure-coding/rules/no-insecure-redirects) | CWE-601 | | 6.1 | [no-insecure-redirects](./docs/rules/no-insecure-redirects.md) | | ⚠️ | | 💡 | |
247
- | [no-unencrypted-transmission](https://eslint.interlace.tools/docs/secure-coding/rules/no-unencrypted-transmission) | CWE-319 | | 7.5 | [no-unencrypted-transmission](./docs/rules/no-unencrypted-transmission.md) | | ⚠️ | | | |
248
- | [no-clickjacking](https://eslint.interlace.tools/docs/secure-coding/rules/no-clickjacking) | CWE-1021 | | 6.1 | [no-clickjacking](./docs/rules/no-clickjacking.md) | 💼 | | | | 🚫 |
249
- | [no-exposed-sensitive-data](https://eslint.interlace.tools/docs/secure-coding/rules/no-exposed-sensitive-data) | CWE-200 | | 7.5 | [no-exposed-sensitive-data](./docs/rules/no-exposed-sensitive-data.md) | 💼 | | | | |
250
- | [no-sensitive-data-exposure](https://eslint.interlace.tools/docs/secure-coding/rules/no-sensitive-data-exposure) | CWE-532 | | 5.5 | [no-sensitive-data-exposure](./docs/rules/no-sensitive-data-exposure.md) | | ⚠️ | | 💡 | |
251
- | [no-buffer-overread](https://eslint.interlace.tools/docs/secure-coding/rules/no-buffer-overread) | CWE-126 | | 7.5 | [no-buffer-overread](./docs/rules/no-buffer-overread.md) | 💼 | | | | |
252
- | [no-unlimited-resource-allocation](https://eslint.interlace.tools/docs/secure-coding/rules/no-unlimited-resource-allocation) | CWE-770 | | 7.5 | [no-unlimited-resource-allocation](./docs/rules/no-unlimited-resource-allocation.md) | 💼 | | | | |
253
- | [no-unchecked-loop-condition](https://eslint.interlace.tools/docs/secure-coding/rules/no-unchecked-loop-condition) | CWE-835 | | 7.5 | [no-unchecked-loop-condition](./docs/rules/no-unchecked-loop-condition.md) | 💼 | | | | |
254
- | [no-electron-security-issues](https://eslint.interlace.tools/docs/secure-coding/rules/no-electron-security-issues) | CWE-693 | | 8.8 | [no-electron-security-issues](./docs/rules/no-electron-security-issues.md) | 💼 | | | | |
255
- | [no-insufficient-postmessage-validation](https://eslint.interlace.tools/docs/secure-coding/rules/no-insufficient-postmessage-validation) | CWE-346 | | 8.8 | [no-insufficient-postmessage-validation](./docs/rules/no-insufficient-postmessage-validation.md) | 💼 | | | | |
256
- | [Deprecated](https://eslint.interlace.tools/docs/secure-coding/rules/Deprecated) | | | | Deprecated Rules | | | | | |
53
+ | Icon | Description |
54
+ | :---: | :--- |
55
+ | 💼 | **Recommended**: Included in the recommended preset. |
56
+ | ⚠️ | **Warns**: Set towarn in recommended preset. |
57
+ | 🔧 | **Auto-fixable**: Automatically fixable by the `--fix` CLI option. |
58
+ | 💡 | **Suggestions**: Providing code suggestions in IDE. |
59
+ | 🚫 | **Deprecated**: This rule is deprecated. |
60
+
61
+ | Rule | CWE | OWASP | CVSS | Description | 💼 | ⚠️ | 🔧 | 💡 | 🚫 |
62
+ | :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: |
63
+ | [detect-non-literal-regexp](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/detect-non-literal-regexp) | CWE-400 | | 7.5 | ESLint security rule documentation for detect-non-literal-regexp | | ⚠️ | | | |
64
+ | [detect-object-injection](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/detect-object-injection) | CWE-915 | | 7.3 | ESLint security rule documentation for detect-object-injection | | ⚠️ | | | |
65
+ | [detect-weak-password-validation](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/detect-weak-password-validation) | CWE-521 | | 7.5 | ESLint security rule documentation for detect-weak-password-validation | | | | | |
66
+ | [no-directive-injection](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-directive-injection) | CWE-94 | | 8.8 | ESLint security rule documentation for no-directive-injection | 💼 | | | | |
67
+ | [no-electron-security-issues](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-electron-security-issues) | CWE-693 | | 8.8 | ESLint security rule documentation for no-electron-security-issues | 💼 | | | | |
68
+ | [no-format-string-injection](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-format-string-injection) | CWE-134 | | 9.8 | ESLint security rule documentation for no-format-string-injection | 💼 | | | | |
69
+ | [no-graphql-injection](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-graphql-injection) | CWE-943 | | 8.6 | ESLint security rule documentation for no-graphql-injection | 💼 | | | | |
70
+ | [no-hardcoded-credentials](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-hardcoded-credentials) | CWE-798 | | 7.5 | ESLint security rule documentation for no-hardcoded-credentials | 💼 | | 🔧 | 💡 | |
71
+ | [no-hardcoded-session-tokens](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-hardcoded-session-tokens) | CWE-798 | | 9.8 | ESLint security rule documentation for no-hardcoded-session-tokens | 💼 | | | | |
72
+ | [no-improper-sanitization](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-improper-sanitization) | CWE-116 | | 7.5 | ESLint security rule documentation for no-improper-sanitization | 💼 | | | | |
73
+ | [no-improper-type-validation](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-improper-type-validation) | CWE-20 | | 5.3 | ESLint security rule documentation for no-improper-type-validation | | ⚠️ | | | |
74
+ | [no-insecure-comparison](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-insecure-comparison) | CWE-697 | | 5.3 | ESLint security rule documentation for no-insecure-comparison | | ⚠️ | 🔧 | | 🚫 |
75
+ | [no-ldap-injection](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-ldap-injection) | CWE-90 | | 9.8 | ESLint security rule documentation for no-ldap-injection | 💼 | | | | |
76
+ | [no-missing-authentication](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-missing-authentication) | CWE-306 | | 9.8 | ESLint security rule documentation for no-missing-authentication | | ⚠️ | | | |
77
+ | [no-pii-in-logs](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-pii-in-logs) | CWE-532 | | 7.5 | Enforce no pii in logs | | ⚠️ | | | |
78
+ | [no-privilege-escalation](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-privilege-escalation) | CWE-269 | | 8.8 | ESLint security rule documentation for no-privilege-escalation | | ⚠️ | | | |
79
+ | [no-redos-vulnerable-regex](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-redos-vulnerable-regex) | CWE-1333 | | 7.5 | ESLint security rule documentation for no-redos-vulnerable-regex | 💼 | | | 💡 | |
80
+ | [no-sensitive-data-exposure](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-sensitive-data-exposure) | CWE-532 | | 5.5 | ESLint security rule documentation for no-sensitive-data-exposure | | ⚠️ | | 💡 | |
81
+ | [no-unchecked-loop-condition](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-unchecked-loop-condition) | CWE-835 | | 7.5 | ESLint security rule documentation for no-unchecked-loop-condition | 💼 | | | | |
82
+ | [no-unlimited-resource-allocation](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-unlimited-resource-allocation) | CWE-770 | | 7.5 | ESLint security rule documentation for no-unlimited-resource-allocation | 💼 | | | | |
83
+ | [no-unsafe-deserialization](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-unsafe-deserialization) | CWE-502 | | 9.8 | ESLint security rule documentation for no-unsafe-deserialization | 💼 | | | | |
84
+ | [no-unsafe-regex-construction](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-unsafe-regex-construction) | CWE-400 | | 7.5 | ESLint security rule documentation for no-unsafe-regex-construction | | ⚠️ | | 💡 | |
85
+ | [no-weak-password-recovery](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-weak-password-recovery) | CWE-640 | | 9.8 | ESLint security rule documentation for no-weak-password-recovery | 💼 | | | | |
86
+ | [no-xpath-injection](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-xpath-injection) | CWE-643 | | 9.8 | ESLint security rule documentation for no-xpath-injection | 💼 | | | | |
87
+ | [no-xxe-injection](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/no-xxe-injection) | CWE-611 | | 9.1 | ESLint security rule documentation for no-xxe-injection | 💼 | | | | |
88
+ | [require-backend-authorization](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/require-backend-authorization) | | | | ESLint security rule documentation for require-backend-authorization | | | | | |
89
+ | [require-secure-defaults](https://eslint.interlace.tools/docs/security/plugin-secure-coding/rules/require-secure-defaults) | CWE-276 | | 7.5 | ESLint security rule documentation for require-secure-defaults | | | | | |
257
90
 
258
91
  ## 🔗 Related ESLint Plugins
259
92
 
260
93
  Part of the **Interlace ESLint Ecosystem** — AI-native security plugins with LLM-optimized error messages:
261
94
 
262
- | Plugin | Downloads | Description |
263
- | :--------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :------------------------------------------ |
264
- | [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-secure-coding.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-secure-coding) | General security rules & OWASP guidelines. |
265
- | [`eslint-plugin-pg`](https://www.npmjs.com/package/eslint-plugin-pg) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-pg.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-pg) | PostgreSQL security & best practices. |
266
- | [`eslint-plugin-crypto`](https://www.npmjs.com/package/eslint-plugin-crypto) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-crypto.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-crypto) | NodeJS Cryptography security rules. |
267
- | [`eslint-plugin-jwt`](https://www.npmjs.com/package/eslint-plugin-jwt) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-jwt.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-jwt) | JWT security & best practices. |
268
- | [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-browser-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-browser-security) | Browser-specific security & XSS prevention. |
269
- | [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-vercel-ai-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security rules. |
270
- | [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-express-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-express-security) | Express.js security hardening rules. |
271
- | [`eslint-plugin-lambda-security`](https://www.npmjs.com/package/eslint-plugin-lambda-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-lambda-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-lambda-security) | AWS Lambda security best practices. |
272
- | [`eslint-plugin-nestjs-security`](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-nestjs-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | NestJS security rules & patterns. |
273
- | [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-import-next.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-import-next) | Next-gen import sorting & architecture. |
95
+ | Plugin | Downloads | Description |
96
+ | :--- | :---: | :--- |
97
+ | [`eslint-plugin-secure-coding`](https://www.npmjs.com/package/eslint-plugin-secure-coding) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-secure-coding.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-secure-coding) | General security rules & OWASP guidelines. |
98
+ | [`eslint-plugin-pg`](https://www.npmjs.com/package/eslint-plugin-pg) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-pg.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-pg) | PostgreSQL security & best practices. |
99
+ | [`eslint-plugin-crypto`](https://www.npmjs.com/package/eslint-plugin-crypto) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-crypto.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-crypto) | NodeJS Cryptography security rules. |
100
+ | [`eslint-plugin-jwt`](https://www.npmjs.com/package/eslint-plugin-jwt) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-jwt.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-jwt) | JWT security & best practices. |
101
+ | [`eslint-plugin-browser-security`](https://www.npmjs.com/package/eslint-plugin-browser-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-browser-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-browser-security) | Browser-specific security & XSS prevention. |
102
+ | [`eslint-plugin-express-security`](https://www.npmjs.com/package/eslint-plugin-express-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-express-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-express-security) | Express.js security hardening rules. |
103
+ | [`eslint-plugin-lambda-security`](https://www.npmjs.com/package/eslint-plugin-lambda-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-lambda-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-lambda-security) | AWS Lambda security best practices. |
104
+ | [`eslint-plugin-nestjs-security`](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-nestjs-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-nestjs-security) | NestJS security rules & patterns. |
105
+ | [`eslint-plugin-mongodb-security`](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-mongodb-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-mongodb-security) | MongoDB security best practices. |
106
+ | [`eslint-plugin-vercel-ai-security`](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-vercel-ai-security.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-vercel-ai-security) | Vercel AI SDK security hardening. |
107
+ | [`eslint-plugin-import-next`](https://www.npmjs.com/package/eslint-plugin-import-next) | [![downloads](https://img.shields.io/npm/dt/eslint-plugin-import-next.svg?style=flat-square)](https://www.npmjs.com/package/eslint-plugin-import-next) | Next-gen import sorting & architecture. |
274
108
 
275
109
  ## 📄 License
276
110
 
277
111
  MIT © [Ofri Peretz](https://github.com/ofri-peretz)
278
112
 
279
113
  <p align="center">
280
- <a href="https://eslint.interlace.tools/docs/secure-coding"><img src="https://eslint.interlace.tools/images/og-secure-coding.png" alt="ESLint Interlace Plugin" width="300" /></a>
281
- </p>
114
+ <a href="https://eslint.interlace.tools/docs/security/plugin-secure-coding"><img src="https://eslint.interlace.tools/images/og-secure-coding.png" alt="ESLint Interlace Plugin" width="100%" /></a>
115
+ </p>
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "eslint-plugin-secure-coding",
3
- "version": "3.0.1",
3
+ "version": "3.0.2",
4
4
  "description": "Security-focused ESLint plugin with 89 AI-parseable rules for detecting and preventing vulnerabilities. OWASP Top 10 2021 + Mobile Top 10 2024 coverage, CWE references, and AI-assisted fix guidance.",
5
5
  "type": "commonjs",
6
6
  "main": "./src/index.js",
@@ -17,10 +17,10 @@
17
17
  },
18
18
  "author": "Ofri Peretz <ofriperetzdev@gmail.com>",
19
19
  "license": "MIT",
20
- "homepage": "https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-secure-coding/README.md",
20
+ "homepage": "https://github.com/ofri-peretz/eslint/tree/main/packages/eslint-plugin-secure-coding#readme",
21
21
  "repository": {
22
22
  "type": "git",
23
- "url": "git+https://github.com/ofri-peretz/eslint.git",
23
+ "url": "https://github.com/ofri-peretz/eslint",
24
24
  "directory": "packages/eslint-plugin-secure-coding"
25
25
  },
26
26
  "bugs": {
@@ -41,6 +41,7 @@
41
41
  "eslint",
42
42
  "eslint-plugin",
43
43
  "eslintplugin",
44
+ "interlace-security",
44
45
  "security",
45
46
  "secure-coding",
46
47
  "owasp",
@@ -69,8 +70,8 @@
69
70
  "node": ">=18.0.0"
70
71
  },
71
72
  "dependencies": {
72
- "@interlace/eslint-devkit": "^1.2.1",
73
- "tslib": "^2.3.0"
73
+ "tslib": "^2.3.0",
74
+ "@interlace/eslint-devkit": "^1.2.1"
74
75
  },
75
76
  "devDependencies": {
76
77
  "@typescript-eslint/parser": "^8.46.2",
package/src/index.d.ts CHANGED
@@ -5,7 +5,7 @@
5
5
  */
6
6
  import { TSESLint } from '@interlace/eslint-devkit';
7
7
  /**
8
- * Collection of all security ESLint rules
8
+ * Collection of all core security ESLint rules
9
9
  */
10
10
  export declare const rules: Record<string, TSESLint.RuleModule<string, readonly unknown[]>>;
11
11
  /**
@@ -20,4 +20,4 @@ export default plugin;
20
20
  /**
21
21
  * Re-export all types from the types barrel
22
22
  */
23
- export type { DetectEvalWithExpressionOptions, DetectChildProcessOptions, NoUnsafeDynamicRequireOptions, NoGraphqlInjectionOptions, NoXxeInjectionOptions, NoXpathInjectionOptions, NoLdapInjectionOptions, NoDirectiveInjectionOptions, NoFormatStringInjectionOptions, DetectNonLiteralFsFilenameOptions, NoZipSlipOptions, NoToctouVulnerabilityOptions, DetectNonLiteralRegexpOptions, NoRedosVulnerableRegexOptions, NoUnsafeRegexConstructionOptions, DetectObjectInjectionOptions, NoUnsafeDeserializationOptions, NoHardcodedCredentialsOptions, NoInsecureComparisonOptions, NoUnvalidatedUserInputOptions, NoUnescapedUrlParameterOptions, NoImproperSanitizationOptions, NoImproperTypeValidationOptions, NoMissingAuthenticationOptions, NoPrivilegeEscalationOptions, NoWeakPasswordRecoveryOptions, NoMissingCsrfProtectionOptions, NoMissingCorsCheckOptions, NoMissingSecurityHeadersOptions, NoInsecureRedirectsOptions, NoUnencryptedTransmissionOptions, NoClickjackingOptions, NoExposedSensitiveDataOptions, NoSensitiveDataExposureOptions, NoBufferOverreadOptions, NoUnlimitedResourceAllocationOptions, NoUncheckedLoopConditionOptions, NoElectronSecurityIssuesOptions, AllSecurityRulesOptions, } from './types/index';
23
+ export type { AllSecurityRulesOptions, } from './types/index';