Rules

Detects Mongoose operations that bypass middleware hooks (pre/post hooks).

Detects Mongoose debug mode that could expose sensitive query information in production.

Detects hardcoded MongoDB connection strings containing credentials in source code.

Detects hardcoded MongoDB authentication credentials in connection options.

Detects MongoDB operator injection attacks where user input is passed directly as query values, allowing attackers to...

Detects queries that may return sensitive fields like passwords, tokens, or API keys.

Requires limit() on find queries to prevent resource exhaustion from unbounded result sets.

Detects user-controlled populate() paths that could lead to data exposure or injection.

Prevents NoSQL injection by detecting direct use of user input in MongoDB query objects.

Detects user input in MongoDB $regex operators that could cause ReDoS (Regular Expression Denial of Service) or infor...

Prevents use of the dangerous $where operator which executes JavaScript on the MongoDB server, enabling Remote Code E...

Requires explicit authentication mechanism specification for MongoDB connections.

Suggests using .lean() for read-only Mongoose queries to reduce memory usage.

Requires field projection on queries to minimize data exposure.

Requires validation options on Mongoose schema fields to prevent invalid or malicious data.

Requires TLS/SSL encryption for MongoDB connections in production environments.