Rules

This rule detects access decisions taken on request-supplied role, permission or identity values — the check runs, and passes for anyone who sets the field

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

This rule detects helmet options that switch a shipped security-header default off, leaving a mounted helmet with the exposure of no helmet at all

Disallow sending caught error objects, stack traces, or spreads of them in HTTP responses.

Identifies potential debug, administration, or testing endpoints that are often left exposed in production environmen...

This rule detects Regular Expression Denial of Service (ReDoS) vulnerabilities in Express route patterns

This rule detects GraphQL servers with introspection enabled in production

Disallow building absolute URLs (password-reset and verification links) from the Host or X-Forwarded-Host request header.

This rule detects a resource fetched by an identifier taken straight from the request inside a handler that never mentions the authenticated principal — the classic IDOR shape

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

Detects overly permissive CORS configurations in Express.js applications

This rule detects unconditional 'trust proxy' settings, which make req.ip whatever the caller says it is and hand rate limits, IP allowlists and audit logs to the client

Disallow reading sensitive-named parameters (password, token, secret, apiKey, ...) from req.query.

Disallow express.static() roots that expose the application directory and any serve-index usage

This rule detects Content-Security-Policy directives that hand back the protection the header exists to provide — unsafe-inline, unsafe-eval, wildcard sources, unrestricted framing, and dropped mixed-content upgrades

Disallow res.render() with locals or view names sourced wholesale from req.body / req.query / req.params

This rule detects path-based authorization guards that compare req.path case-sensitively, which case-insensitive Express routing bypasses

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

This rule detects Express.js applications that are missing the helmet middleware

This rule detects string methods called on req.query values without a type guard — Express query values can be arrays or objects, not just strings

This rule detects Express.js applications missing rate limiting middleware

This rule detects routes that expose a critical function — credentials, accounts, payments, configuration — with no authentication middleware and no principal read in the handler

This rule detects HSTS configurations that leave a downgrade window open — the header disabled, a max-age below the six-month floor, or subdomains excluded