Rules

45 Security Rules

Comprehensive coverage of XSS, cookie security, DOM protection, and client-side vulnerabilities.

All Rules

Legend:RecommendedFixableSuggestionsWarns

Rule	💼	🔧	💡	⚠️	Docs
detect-mixed-content Detects HTTP URLs in code that should use HTTPS, preventing mixed content vulnerabilities.
no-allow-arbitrary-loads Prevents disabling App Transport Security (ATS) by detecting allowArbitraryLoads: true in configuration.
no-clickjacking Detects clickjacking vulnerabilities and missing frame protections
no-client-side-auth-logic Prevent client-side authentication logic that can be bypassed. This rule is part of eslint-plugin-browser-security and provides LLM-optimized error messages.
no-cookie-auth-tokens Prevent storing authentication tokens in JavaScript-accessible cookies.
no-credentials-in-query-params CWE: [CWE-598](https://cwe.mitre.org/data/definitions/598.html)
no-disabled-certificate-validation CWE: [CWE-295](https://cwe.mitre.org/data/definitions/295.html)
no-dynamic-service-worker-url Prevent dynamic URLs in service worker registration.
no-eval Detects dangerous eval() and similar code execution patterns
no-filereader-innerhtml The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
no-http-urls CWE: [CWE-319](https://cwe.mitre.org/data/definitions/319.html)
no-innerhtml Detects dangerous innerHTML/outerHTML assignments that can lead to Cross-Site Scripting (XSS)
no-insecure-redirects ESLint Rule: no-insecure-redirects
no-insecure-websocket CWE: [CWE-319](https://cwe.mitre.org/data/definitions/319.html)
no-jwt-in-storage This rule prevents storing JWT tokens in browser storage (localStorage/sessionStorage)
no-missing-cors-check Detects missing CORS validation (wildcard CORS, missing origin check) that can allow unauthorized cross-origin requests
no-missing-csrf-protection Detects missing CSRF token validation in POST/PUT/DELETE requests
no-missing-security-headers ESLint Rule: no-missing-security-headers
no-password-in-url This rule detects when URLs contain password-related query parameters or URL fragments
no-permissive-cors CWE: [CWE-942](https://cwe.mitre.org/data/definitions/942.html)
no-postmessage-innerhtml The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
no-postmessage-wildcard-origin This rule prevents using \"\" as the targetOrigin parameter in postMessage() calls
no-sensitive-cookie-js The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
no-sensitive-data-in-analytics This rule detects when sensitive user data (email, SSN, credit card, password, phone, address) is passed to analytics...
no-sensitive-data-in-cache CWE: [CWE-200](https://cwe.mitre.org/data/definitions/200.html)
no-sensitive-indexeddb Prevent storing sensitive data in IndexedDB.
no-sensitive-localstorage Detects storage of sensitive data (tokens, passwords, PII) in localStorage
no-sensitive-sessionstorage Prevent storing sensitive data in sessionStorage.
no-tracking-without-consent CWE: [CWE-359](https://cwe.mitre.org/data/definitions/359.html)
no-unencrypted-transmission Detects unencrypted data transmission (HTTP vs HTTPS, plain text protocols)
no-unescaped-url-parameter Detects unescaped URL parameters that can lead to Cross-Site Scripting (XSS) or open redirect vulnerabilities
no-unsafe-eval-csp Disallow 'unsafe-eval' in Content Security Policy directives.
no-unsafe-inline-csp Disallow 'unsafe-inline' in Content Security Policy directives.
no-unvalidated-deeplinks This rule detects when deep link URLs are opened without validation in React Native or mobile web apps
no-websocket-eval The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
no-websocket-innerhtml The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
no-worker-message-innerhtml Disallow using innerHTML with Web Worker message data.
require-blob-url-revocation Require revoking Blob URLs after use to prevent memory leaks.
require-cookie-secure-attrs Require Secure and SameSite attributes on cookies.
require-csp-headers CWE: [CWE-1021](https://cwe.mitre.org/data/definitions/1021.html)
require-https-only This rule detects HTTP (unencrypted) URLs in fetch() and axios requests
require-mime-type-validation CWE: [CWE-434](https://cwe.mitre.org/data/definitions/434.html)
require-postmessage-origin-check Detects postMessage event handlers without origin validation
require-url-validation CWE: [CWE-601](https://cwe.mitre.org/data/definitions/601.html)
require-websocket-wss This rule enforces the use of wss:// (WebSocket Secure) protocol instead of ws:// (unencrypted WebSocket)