Rules

Detects RegExp(variable), which might allow an attacker to DOS your server with a long-running regular expression

Detects variable[key] as a left- or right-hand assignment operand (prototype pollution)

Detects weak password length requirements (less than 8 characters) in validation code.

Disallows Unicode bidirectional control characters, which let source render differently than it compiles (Trojan Source, CWE-1007)

Detects directive injection vulnerabilities in template systems

Detects Electron security vulnerabilities and insecure configurations

Detects authentication and authorization checks whose catch block fails open

Detects format string injection vulnerabilities

Detects GraphQL injection vulnerabilities and DoS attacks

Detects hardcoded passwords, API keys, tokens, and other sensitive credentials in source code

This rule detects hardcoded JWT tokens (starting with eyJ), Bearer tokens, and session identifiers

Detects homoglyph identifiers and invisible characters that hide what the code actually does

Detects improper sanitization of user input

Detects improper type validation in user input handling

Detects insecure comparison operators (==, !=) that can lead to type coercion vulnerabilities

Detects LDAP injection vulnerabilities

Detects request data concatenated into a log message, which lets an attacker forge log records

CWE: [CWE-287](https://cwe.mitre.org/data/definitions/287.html)

Prevent personally identifiable information (PII) — emails, SSNs, credit cards, phone numbers — from reaching console / logger output.

Detects potential privilege escalation vulnerabilities where user input is used to assign roles or permissions withou...

ESLint Rule: no-redos-vulnerable-regex

ESLint Rule: no-sensitive-data-exposure

Detects SQL statements built from attacker-controlled input in files that import no SQL driver

Disallow dynamic strings as template arguments to server-side template engines (CWE-94)

Detects unchecked loop conditions that could cause DoS

Detects unlimited resource allocation that could cause DoS

Detects unsafe deserialization of untrusted data

ESLint Rule: no-unsafe-regex-construction with LLM-optimized suggestions and auto-fix capabilities

ESLint Rule: no-weak-password-recovery with LLM-optimized suggestions and auto-fix capabilities

Detects XPath injection vulnerabilities

Detects XML External Entity (XXE) injection vulnerabilities

CWE: [CWE-602](https://cwe.mitre.org/data/definitions/602.html)

CWE: [CWE-1188](https://cwe.mitre.org/data/definitions/1188.html)