Rules

Detects RegExp(variable), which might allow an attacker to DOS your server with a long-running regular expression

Detects variable[key] as a left- or right-hand assignment operand (prototype pollution)

Detects weak password length requirements (less than 8 characters) in validation code.

Detects directive injection vulnerabilities in template systems

Detects Electron security vulnerabilities and insecure configurations

Detects format string injection vulnerabilities

Detects GraphQL injection vulnerabilities and DoS attacks

Detects hardcoded passwords, API keys, tokens, and other sensitive credentials in source code

This rule detects hardcoded JWT tokens (starting with eyJ), Bearer tokens, and session identifiers

Detects improper sanitization of user input

Detects improper type validation in user input handling

Detects insecure comparison operators (==, !=) that can lead to type coercion vulnerabilities

Detects LDAP injection vulnerabilities

CWE: [CWE-287](https://cwe.mitre.org/data/definitions/287.html)

Prevent personally identifiable information (PII) — emails, SSNs, credit cards, phone numbers — from reaching console / logger output.

Detects potential privilege escalation vulnerabilities where user input is used to assign roles or permissions withou...

ESLint Rule: no-redos-vulnerable-regex

ESLint Rule: no-sensitive-data-exposure

Detects unchecked loop conditions that could cause DoS

Detects unlimited resource allocation that could cause DoS

Detects unsafe deserialization of untrusted data

ESLint Rule: no-unsafe-regex-construction with LLM-optimized suggestions and auto-fix capabilities

ESLint Rule: no-weak-password-recovery with LLM-optimized suggestions and auto-fix capabilities

Detects XPath injection vulnerabilities

Detects XML External Entity (XXE) injection vulnerabilities

CWE: [CWE-602](https://cwe.mitre.org/data/definitions/602.html)

CWE: [CWE-1188](https://cwe.mitre.org/data/definitions/1188.html)