Overview

⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides General secure coding practices and OWASP compliance for JavaScript/TypeScript.

Philosophy

Interlace fosters strength through integration. Instead of stacking isolated rules, we interlace security directly into your workflow to create a resilient fabric of code. We believe tools should guide rather than gatekeep, providing educational feedback that strengthens the developer with every interaction.

Getting Started

• To check out the guide, visit eslint.interlace.tools. 📚
• 要查看中文 指南, 请访问 eslint.interlace.tools. 📚
• 가이드 문서는 eslint.interlace.tools에서 확인하실 수 있습니다. 📚
• ガイドは eslint.interlace.toolsでご確認ください。 📚
• Para ver la guía, visita eslint.interlace.tools. 📚
• للاطلاع على الدليل، قم بزيارة eslint.interlace.tools. 📚

npm install eslint-plugin-secure-coding --save-dev

Add to your eslint.config.mjs — one line activates 16 security rules:

import securePlugin from 'eslint-plugin-secure-coding';

export default [
  // Balanced: catches critical issues as errors, lower-confidence rules as warnings
  ...securePlugin.configs.recommended,

  // Zero-tolerance: same 16 rules, all promoted to error (good for CI gates)
  // ...securePlugin.configs['recommended-strict'],
];

Or if you use a legacy .eslintrc.json:

{
  "extends": ["plugin:secure-coding/recommended"]
}

Using recommended already? Extend your coverage with domain-specific plugins: eslint-plugin-node-security (crypto, eval, buffer) · eslint-plugin-jwt (JWT auth) · eslint-plugin-express-security (Express middleware)

Benchmarks vs competitors (CWE-798 ground truth)

no-hardcoded-credentials is part of the ILB-Flagship benchmark suite. On the labeled CWE-798 fixture set (Juliet-style: 2 vulnerable + 2 safe files, ground-truthed):

The competitor's entropy-only detection catches the high-entropy API-key shape but misses the 15-character literal password assigned to password:. Our context-gated detection (structural patterns + credential-named-variable check + context-positive path) catches both for the right reasons.

On real OSS (vercel/ai), the competitor reports ~380 more findings than us. Those 380 are not catches we missed — they're entropy false-positives on TypeScript type literals ('experimental_onLanguageModelCallStart'), error class names ('AI_ToolCallNotFoundForApprovalError'), and documentation URLs. Sampling confirmed zero are actual credentials. The corpus number is the right one to weigh; the OSS finding-count is a noise metric.

⚙️ Configuration Presets

📦 Compatibility

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

🔗 Related ESLint Plugins

Part of the Interlace ESLint Ecosystem — AI-native security plugins with LLM-optimized error messages:

Plugin	Downloads	Description
eslint-plugin-secure-coding		General security rules & OWASP guidelines.
eslint-plugin-pg		PostgreSQL security & best practices.
eslint-plugin-node-security		Node.js core-module security (fs, child_process, vm, crypto, Buffer).
eslint-plugin-jwt		JWT security & best practices.
eslint-plugin-browser-security		Browser-specific security & XSS prevention.
eslint-plugin-express-security		Express.js security hardening rules.
eslint-plugin-lambda-security		AWS Lambda security best practices.
eslint-plugin-nestjs-security		NestJS security rules & patterns.
eslint-plugin-mongodb-security		MongoDB security best practices.
eslint-plugin-vercel-ai-security		Vercel AI SDK security hardening.
eslint-plugin-import-next		Next-gen import sorting & architecture.

⭐ Support & follow

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

MIT © Ofri Peretz