Rules
All ESLint security rules provided by eslint-plugin-postgresql-security
13 Security Rules
Comprehensive coverage of PostgreSQL security and best practices for the pg driver.
All Rules
| Rule | 🧠 | 💼 | 🔧 | 💡 | ⚠️ | Docs |
|---|---|---|---|---|---|---|
| check-query-params Ensure the number of query parameters matches the arguments array. | 🟢 | |||||
| no-batch-insert-loop Prevent executing database queries within loops (N+1 problem). | 🟢 | |||||
| no-floating-query Ensure all queries are awaited or returned to prevent unhandled promise rejections. | 🟢 | |||||
| no-hardcoded-credentials Detect hardcoded credentials in pg Client or Pool initialization. | 🟢 | |||||
| no-insecure-ssl Prevent the use of insecure SSL configurations (rejectUnauthorized: false). | 🟢 | |||||
| no-missing-client-release Ensure pg client is released after use to prevent pool exhaustion. | 🟢 | |||||
| no-select-all Prevent using * in SELECT statements (implicit columns). | 🟢 | |||||
| no-transaction-on-pool Prevent starting transactions directly on the Pool, which is unsafe due to lack of client affinity. | 🟢 | |||||
| no-unsafe-copy-from Prevent unsafe COPY FROM usage with dynamic file paths, which can lead to arbitrary file read/RCE. | 🟢 | |||||
| no-unsafe-query Prevent SQL injection by disallowing string concatenation or unsafe template literals in queries. | 🟢 | |||||
| no-unsafe-search-path Prevent unsafe SET search_path usage with dynamic values, which can lead to schema hijacking. | 🟢 | |||||
| prefer-pool-query Prefer pool.query() over client.query() for single-shot queries. | 🟢 | |||||
| prevent-double-release Prevent releasing a pg client multiple times. | 🟢 |
Rule Categories
SQL Injection Prevention
Rules detecting unsafe queries and requiring parameterized queries.
Credential Security
Rules preventing hardcoded credentials and insecure SSL configurations.
Connection Management
Rules enforcing proper client release and preventing double-release issues.
Query Best Practices
Rules for efficient query patterns and preventing common mistakes.
Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.