# Documentation

- [Benchmarks](/docs/benchmarks): How we measure rule quality — edge-case accuracy, scope correctness, and autofix coverage across 1.5M lines of real OSS code.
- [Configuration](/docs/getting-started/configuration): Configure ESLint Interlace plugins for your project
- [Editor Integration](/docs/getting-started/editor-integration): Set up ESLint Interlace with VS Code, Cursor AI, and other editors
- [Flat Config Migration](/docs/getting-started/flat-config): Migrate from .eslintrc to ESLint 9.x flat config
- [Getting Started](/docs/getting-started): Enterprise-grade security & quality linting for JavaScript
- [Installation](/docs/getting-started/installation): Install ESLint Interlace plugins in your project
- [Migrate from eslint-plugin-security-node](/docs/getting-started/migrate-from-security-node): Rule-by-rule mapping from eslint-plugin-security-node (last published Jan 2024) to maintained Interlace equivalents
- [Troubleshooting](/docs/getting-started/troubleshooting): Common issues and solutions for ESLint Interlace
- [Use Interlace with Claude Code](/docs/integrations/claude-code): Wire Interlace rules into Claude Code via the official ESLint MCP server. Local install, no remote server. ~2 minutes from zero to "Claude can lint your code".
- [Use Interlace with Cursor](/docs/integrations/cursor): Wire Interlace rules into Cursor via the official ESLint MCP server. Local install, no remote server. ~2 minutes.
- [Integrations](/docs/integrations): Wire Interlace rules into AI coding agents via the official ESLint MCP server
- [Learn](/docs/learn): How ESLint plugins, AST traversal, taint analysis, and oxlint compatibility work — from the inside
- [Quality & Architecture Plugins](/docs/quality): ESLint plugins for code quality, maintainability, modularity, and developer experience
- [Security Plugins](/docs/security): Security-focused ESLint plugins for protecting your applications
- [Changelog](/docs/getting-started/advanced/changelog): Version history for all Interlace plugins
- [CI/CD Integration](/docs/getting-started/advanced/ci-cd): Add security linting to your CI/CD pipeline
- [Contributing](/docs/getting-started/advanced/contributing): How to contribute security rules to the Interlace ecosystem
- [Advanced Topics](/docs/getting-started/advanced): Deep integration and contribution guides
- [AI Integration](/docs/getting-started/concepts/ai-integration): How structured metadata enables AI agents to fix vulnerabilities accurately
- [AST Fundamentals](/docs/getting-started/concepts/ast-fundamentals): How ESLint reads and analyzes your code
- [Benchmarks](/docs/getting-started/concepts/benchmarks): Performance comparisons and feature matrix
- [Interlace vs. CodeQL vs. Semgrep vs. Snyk Code](/docs/getting-started/concepts/compare): Honest comparison of JavaScript / TypeScript static-analysis tools — when to pick each, where they overlap, where they diverge.
- [Compatibility](/docs/getting-started/concepts/compatibility): Which lint engines, ESLint majors, and Node.js versions Interlace supports — and the policy that decides what stays in the matrix.
- [Test Coverage](/docs/getting-started/concepts/coverage): Live ecosystem health metrics from Codecov
- [CWE Compatibility](/docs/getting-started/concepts/cwe-compatibility): How Interlace exposes MITRE CWE Identifiers — for security review, compliance reporting, and SARIF-based tooling.
- [Detect → Understand → Fix](/docs/getting-started/concepts/detect-understand-fix): The 3-step workflow that defines the Interlace experience
- [Ecosystem Landscape](/docs/getting-started/concepts/ecosystem): Where each Interlace plugin sits in the JavaScript / TypeScript lint ecosystem — neighbors doing strong work, where we specialize, and how we measure ourselves against the field.
- [Understanding Interlace](/docs/getting-started/concepts): Core concepts behind AI-native security linting
- [Philosophy](/docs/getting-started/concepts/philosophy): Why we built an ecosystem of specialized ESLint plugins
- [Runtime Portability](/docs/getting-started/concepts/runtime-portability): One rule, multiple engines — ESLint today, oxlint now, TSC plugin host eventually. How Interlace makes the engine an implementation detail.
- [Security Metadata](/docs/getting-started/concepts/security-metadata): Understanding CWE, OWASP, and CVSS standards
- [Transparency Dashboard](/docs/getting-started/concepts/transparency): The dimensions Interlace measures itself on — peer health, CVE-to-rule latency, API-surface coverage, per-rule p95 budgets, and resource profile — and where to find the live data.
- [How ESLint plugins work](/docs/learn/how-eslint-plugins-work): The pipeline from source text to a finding — lexer, AST, visitor, rule, fixer — with the source-file links so you can read past my words
- [Changelog](/docs/quality/plugin-conventions/changelog): Release history and version updates for eslint-plugin-conventions
- [eslint-plugin-conventions](/docs/quality/plugin-conventions): ESLint rules for team-specific disciplinary patterns and code conventions
- [Changelog](/docs/quality/plugin-import-next/changelog): Release history and version updates for eslint-plugin-import-next
- [eslint-plugin-import-next](/docs/quality/plugin-import-next): Drop-in replacement for eslint-plugin-import with 8x faster cycle detection
- [Changelog](/docs/quality/plugin-maintainability/changelog): Release history and version updates for eslint-plugin-maintainability
- [eslint-plugin-maintainability](/docs/quality/plugin-maintainability): ESLint rules for reducing cognitive load and ensuring code readability
- [Changelog](/docs/quality/plugin-modularity/changelog): Release history and version updates for eslint-plugin-modularity
- [eslint-plugin-modularity](/docs/quality/plugin-modularity): ESLint rules for clean module boundaries and dependency management
- [Changelog](/docs/quality/plugin-modernization/changelog): Release history and version updates for eslint-plugin-modernization
- [eslint-plugin-modernization](/docs/quality/plugin-modernization): ESLint rules for modernizing JavaScript to ES2022+ syntax
- [Changelog](/docs/quality/plugin-operability/changelog): Release history and version updates for eslint-plugin-operability
- [eslint-plugin-operability](/docs/quality/plugin-operability): ESLint rules for operational excellence and deployment readiness
- [Changelog](/docs/quality/plugin-react-a11y/changelog): Release history for eslint-plugin-react-a11y
- [eslint-plugin-react-a11y](/docs/quality/plugin-react-a11y): React accessibility rules for WCAG compliance.
- [Changelog](/docs/quality/plugin-react-features/changelog): Release history for eslint-plugin-react-features
- [eslint-plugin-react-features](/docs/quality/plugin-react-features): React best practices and feature rules.
- [Changelog](/docs/quality/plugin-reliability/changelog): Release history and version updates for eslint-plugin-reliability
- [eslint-plugin-reliability](/docs/quality/plugin-reliability): ESLint rules for code reliability and error prevention
- [Changelog](/docs/security/plugin-anthropic-security/changelog): Release history and version updates for eslint-plugin-anthropic-security
- [eslint-plugin-anthropic-security](/docs/security/plugin-anthropic-security): Anthropic SDK security — API-key exposure and untrusted prompt content
- [Changelog](/docs/security/plugin-browser-security/changelog): Release history and version updates for eslint-plugin-browser-security
- [eslint-plugin-browser-security](/docs/security/plugin-browser-security): XSS, cookie, and DOM security rules for client-side JavaScript
- [Changelog](/docs/security/plugin-drizzle-security/changelog): Release history and version updates for eslint-plugin-drizzle-security
- [eslint-plugin-drizzle-security](/docs/security/plugin-drizzle-security): Drizzle security — SQL injection in raw queries
- [Changelog](/docs/security/plugin-express-security/changelog): Release history and version updates for eslint-plugin-express-security
- [eslint-plugin-express-security](/docs/security/plugin-express-security): Express.js security hardening - cookies, CORS, CSRF, rate limiting, and Helmet
- [Changelog](/docs/security/plugin-jwt-security/changelog): Release history and version updates for eslint-plugin-jwt-security
- [eslint-plugin-jwt-security](/docs/security/plugin-jwt-security): JSON Web Token security patterns and validation rules
- [Changelog](/docs/security/plugin-gemini-security/changelog): Release history and version updates for eslint-plugin-gemini-security
- [eslint-plugin-gemini-security](/docs/security/plugin-gemini-security): Google Gemini SDK security — API-key exposure and untrusted prompt content
- [Changelog](/docs/security/plugin-knex-security/changelog): Release history and version updates for eslint-plugin-knex-security
- [eslint-plugin-knex-security](/docs/security/plugin-knex-security): Knex security — SQL injection in raw queries
- [Changelog](/docs/security/plugin-lambda-security/changelog): Release history and version updates for eslint-plugin-lambda-security
- [eslint-plugin-lambda-security](/docs/security/plugin-lambda-security): AWS Lambda and Middy security rules for serverless applications
- [Changelog](/docs/security/plugin-mcp-sdk-security/changelog): Release history and version updates for eslint-plugin-mcp-sdk-security
- [eslint-plugin-mcp-sdk-security](/docs/security/plugin-mcp-sdk-security): MCP SDK security — tool-input validation and transport hygiene
- [Changelog](/docs/security/plugin-mongodb-security/changelog): Release history and version updates for eslint-plugin-mongodb-security
- [eslint-plugin-mongodb-security](/docs/security/plugin-mongodb-security): NoSQL injection, operator attacks, and MongoDB/Mongoose security rules
- [Changelog](/docs/security/plugin-mysql-security/changelog): Release history and version updates for eslint-plugin-mysql-security
- [eslint-plugin-mysql-security](/docs/security/plugin-mysql-security): MySQL security — SQL injection in raw queries
- [Changelog](/docs/security/plugin-nestjs-security/changelog): Release history and version updates for eslint-plugin-nestjs-security
- [eslint-plugin-nestjs-security](/docs/security/plugin-nestjs-security): NestJS security rules for guards, validation pipes, throttling, and more
- [Changelog](/docs/security/plugin-node-security/changelog): Release history and version updates for eslint-plugin-node-security
- [eslint-plugin-node-security](/docs/security/plugin-node-security): Node.js security rules for fs, child_process, vm, and crypto modules
- [Changelog](/docs/security/plugin-openai-security/changelog): Release history and version updates for eslint-plugin-openai-security
- [eslint-plugin-openai-security](/docs/security/plugin-openai-security): OpenAI SDK security — API-key exposure and untrusted prompt content
- [Changelog](/docs/security/plugin-postgresql-security/changelog): Release history and version updates for eslint-plugin-postgresql-security
- [eslint-plugin-postgresql-security](/docs/security/plugin-postgresql-security): PostgreSQL security and best practices for the pg driver
- [Changelog](/docs/security/plugin-secure-coding/changelog): Release history and version updates for eslint-plugin-secure-coding
- [eslint-plugin-secure-coding](/docs/security/plugin-secure-coding): General secure coding practices and OWASP compliance for JavaScript/TypeScript
- [Changelog](/docs/security/plugin-prisma-security/changelog): Release history and version updates for eslint-plugin-prisma-security
- [eslint-plugin-prisma-security](/docs/security/plugin-prisma-security): Prisma security — SQL injection in raw queries
- [Changelog](/docs/security/plugin-sequelize-security/changelog): Release history and version updates for eslint-plugin-sequelize-security
- [eslint-plugin-sequelize-security](/docs/security/plugin-sequelize-security): Sequelize ORM security — SQL injection in raw queries
- [Changelog](/docs/security/plugin-sqlite-security/changelog): Release history and version updates for eslint-plugin-sqlite-security
- [eslint-plugin-sqlite-security](/docs/security/plugin-sqlite-security): SQLite security — SQL injection in raw queries
- [Changelog](/docs/security/plugin-supabase-security/changelog): Release history and version updates for eslint-plugin-supabase-security
- [eslint-plugin-supabase-security](/docs/security/plugin-supabase-security): Supabase security — service_role exposure, RPC names, auth errors, bucket visibility
- [Changelog](/docs/security/plugin-typeorm-security/changelog): Release history and version updates for eslint-plugin-typeorm-security
- [eslint-plugin-typeorm-security](/docs/security/plugin-typeorm-security): TypeORM security — SQL injection in raw queries
- [Changelog](/docs/security/plugin-vercel-ai-security/changelog): Release history and version updates for eslint-plugin-vercel-ai-security
- [eslint-plugin-vercel-ai-security](/docs/security/plugin-vercel-ai-security): Vercel AI SDK security rules for generateText, streamText, and LLM tools
- [analytics-event-naming](/docs/quality/plugin-conventions/rules/analytics-event-naming): Analytics event names (track/capture) must follow ANALYTICS_PHILOSOPHY.md principle 4: lowercase snake_case, category:object_action, fixed verb list
- [consistent-existence-index-check](/docs/quality/plugin-conventions/rules/consistent-existence-index-check): Enforce one form for checking whether an object has a property
- [expiring-todo-comments](/docs/quality/plugin-conventions/rules/expiring-todo-comments): Add expiration conditions to TODO comments to prevent forgotten tasks. This rule is part of eslint-plugin-conventions and provides LLM-optimized error messa
- [filename-case](/docs/quality/plugin-conventions/rules/filename-case): Enforce filename case conventions for consistency across your codebase
- [Rules](/docs/quality/plugin-conventions/rules): All ESLint rules provided by eslint-plugin-conventions
- [no-commented-code](/docs/quality/plugin-conventions/rules/no-commented-code): ESLint Rule: no-commented-code with LLM-optimized suggestions and auto-fix capabilities.
- [no-console-spaces](/docs/quality/plugin-conventions/rules/no-console-spaces): Disallow leading/trailing whitespace in console arguments. This rule is part of eslint-plugin-conventions.
- [no-deprecated-api](/docs/quality/plugin-conventions/rules/no-deprecated-api): Prevent usage of deprecated APIs with migration context and timeline. This rule is part of eslint-plugin-conventions and provides LLM-optimized error messag
- [no-json-schema-tags](/docs/quality/plugin-conventions/rules/no-json-schema-tags): Disallow JSON Schema keywords (e.g. @minimum, @maximum, @pattern, @format) used as JSDoc tags.
- [no-magic-numbers](/docs/quality/plugin-conventions/rules/no-magic-numbers): Disallow magic numbers (numeric literals without a named constant)
- [no-raw-cross-property-href](/docs/quality/plugin-conventions/rules/no-raw-cross-property-href): Forbid hand-written cross-property hrefs; use buildUtmHref() from lib/utm.ts
- [prefer-code-point](/docs/quality/plugin-conventions/rules/prefer-code-point): Prefer String.codePointAt() over String.charCodeAt(). This rule is part of eslint-plugin-conventions.
- [prefer-dependency-version-strategy](/docs/quality/plugin-conventions/rules/prefer-dependency-version-strategy): Enforce consistent version strategy (caret ^, tilde ~, exact, range, or any) for package.json dependencies. Pairs with a lockfile-alignment check to give complete dependency validation.
- [prefer-dom-node-text-content](/docs/quality/plugin-conventions/rules/prefer-dom-node-text-content): Prefer textContent over innerText. This rule is part of eslint-plugin-conventions.
- [require-data-testid](/docs/quality/plugin-conventions/rules/require-data-testid): Require stable data-testid attributes on interactive elements for end-to-end test reliability
- [utm-taxonomy](/docs/quality/plugin-conventions/rules/utm-taxonomy): Validate utm_source and utm_medium values against the fixed taxonomy in UTM_PHILOSOPHY.md
- [consistent-type-specifier-style](/docs/quality/plugin-import-next/rules/consistent-type-specifier-style): Enforce or ban the use of inline type-only markers for named imports
- [default](/docs/quality/plugin-import-next/rules/default): Ensure a default export is present, given a default import
- [dynamic-import-chunkname](/docs/quality/plugin-import-next/rules/dynamic-import-chunkname): Enforce a leading comment with the webpackChunkName for dynamic imports
- [enforce-dependency-direction](/docs/quality/plugin-import-next/rules/enforce-dependency-direction): Ensures dependencies flow in the correct architectural direction
- [enforce-import-order](/docs/quality/plugin-import-next/rules/enforce-import-order): Enforces a specific order for import statements
- [enforce-team-boundaries](/docs/quality/plugin-import-next/rules/enforce-team-boundaries): Prevent unauthorized cross-team imports in large codebases
- [export](/docs/quality/plugin-import-next/rules/export): Forbid any invalid exports, i.e. re-export of the same name
- [exports-last](/docs/quality/plugin-import-next/rules/exports-last): Ensure all exports appear after other statements
- [extensions](/docs/quality/plugin-import-next/rules/extensions): Ensure consistent use of file extensions in imports
- [first](/docs/quality/plugin-import-next/rules/first): Ensure all imports appear before other statements
- [group-exports](/docs/quality/plugin-import-next/rules/group-exports): Prefer named exports to be grouped together in a single export declaration
- [Rules](/docs/quality/plugin-import-next/rules): All ESLint rules provided by eslint-plugin-import-next
- [max-dependencies](/docs/quality/plugin-import-next/rules/max-dependencies): Enforce the maximum number of dependencies a module can have
- [named](/docs/quality/plugin-import-next/rules/named): Ensure named imports correspond to a named export in the remote file
- [namespace](/docs/quality/plugin-import-next/rules/namespace): Ensure imported namespaces contain dereferenced properties as they are dereferenced
- [newline-after-import](/docs/quality/plugin-import-next/rules/newline-after-import): Enforce a newline after import statements
- [no-absolute-path](/docs/quality/plugin-import-next/rules/no-absolute-path): Forbid import of modules using absolute paths
- [no-amd](/docs/quality/plugin-import-next/rules/no-amd): Prevents AMD require/define calls
- [no-anonymous-default-export](/docs/quality/plugin-import-next/rules/no-anonymous-default-export): Forbid anonymous values as default exports
- [no-barrel-file](/docs/quality/plugin-import-next/rules/no-barrel-file): Disallow barrel files that harm build performance and tree-shaking efficiency
- [no-barrel-import](/docs/quality/plugin-import-next/rules/no-barrel-import): Disallow imports from barrel files to improve build performance and tree-shaking
- [no-commonjs](/docs/quality/plugin-import-next/rules/no-commonjs): Prevents CommonJS require/module.exports
- [no-cross-domain-imports](/docs/quality/plugin-import-next/rules/no-cross-domain-imports): Prevents imports across domain/feature boundaries
- [no-cycle](/docs/quality/plugin-import-next/rules/no-cycle): Detect circular dependencies that cause bundle memory bloat and initialization issues
- [no-default-export](/docs/quality/plugin-import-next/rules/no-default-export): Prevents default exports
- [no-deprecated](/docs/quality/plugin-import-next/rules/no-deprecated): Forbid imported names marked with @deprecated documentation tag
- [no-duplicates](/docs/quality/plugin-import-next/rules/no-duplicates): Reports duplicate imports
- [no-dynamic-require](/docs/quality/plugin-import-next/rules/no-dynamic-require): Forbid require() calls with expressions
- [no-empty-named-blocks](/docs/quality/plugin-import-next/rules/no-empty-named-blocks): Forbid empty named import blocks
- [no-extraneous-dependencies](/docs/quality/plugin-import-next/rules/no-extraneous-dependencies): Forbid the use of extraneous packages not listed in package.json
- [no-full-package-import](/docs/quality/plugin-import-next/rules/no-full-package-import): Disallow full package imports from known large packages that prevent tree-shaking
- [no-import-module-exports](/docs/quality/plugin-import-next/rules/no-import-module-exports): Forbid import statements with CommonJS module.exports
- [no-internal-modules](/docs/quality/plugin-import-next/rules/no-internal-modules): Forbid importing the submodules of other modules
- [no-legacy-imports](/docs/quality/plugin-import-next/rules/no-legacy-imports): Detect imports from deprecated internal paths and suggest alternatives
- [no-mutable-exports](/docs/quality/plugin-import-next/rules/no-mutable-exports): Forbid the use of mutable exports with `var` or `let`
- [no-named-as-default-member](/docs/quality/plugin-import-next/rules/no-named-as-default-member): Forbid use of exported name as property of default export
- [no-named-as-default](/docs/quality/plugin-import-next/rules/no-named-as-default): Forbid use of exported name as identifier of default export
- [no-named-default](/docs/quality/plugin-import-next/rules/no-named-default): Forbid named default exports
- [no-named-export](/docs/quality/plugin-import-next/rules/no-named-export): Prevents named exports
- [no-namespace](/docs/quality/plugin-import-next/rules/no-namespace): Forbid namespace (a.k.a. "wildcard" *) imports
- [no-nodejs-modules](/docs/quality/plugin-import-next/rules/no-nodejs-modules): Prevents Node.js builtin imports
- [no-relative-packages](/docs/quality/plugin-import-next/rules/no-relative-packages): Forbid importing packages through relative paths
- [no-relative-parent-imports](/docs/quality/plugin-import-next/rules/no-relative-parent-imports): This rule aims to prevent issues related to relative-parent-imports.
- [no-restricted-paths](/docs/quality/plugin-import-next/rules/no-restricted-paths): Enforce which files can be imported in a given folder
- [no-self-import](/docs/quality/plugin-import-next/rules/no-self-import): Forbid a module from importing itself
- [no-unassigned-import](/docs/quality/plugin-import-next/rules/no-unassigned-import): Prevents unassigned imports
- [no-unresolved](/docs/quality/plugin-import-next/rules/no-unresolved): Ensures imports point to resolvable modules
- [no-unused-modules](/docs/quality/plugin-import-next/rules/no-unused-modules): Forbid modules without exports
- [no-useless-path-segments](/docs/quality/plugin-import-next/rules/no-useless-path-segments): Forbid unnecessary path segments in import and require statements
- [order](/docs/quality/plugin-import-next/rules/order): Enforces a specific order for import statements
- [prefer-default-export](/docs/quality/plugin-import-next/rules/prefer-default-export): Prefer a default export if module exports a single name
- [prefer-direct-import](/docs/quality/plugin-import-next/rules/prefer-direct-import): Prefer direct imports over barrel imports for better tree-shaking and build performance
- [prefer-modern-api](/docs/quality/plugin-import-next/rules/prefer-modern-api): Suggest modern replacements for deprecated or outdated libraries
- [prefer-node-protocol](/docs/quality/plugin-import-next/rules/prefer-node-protocol): Prefer using the node: protocol when importing Node.js builtin modules
- [prefer-tree-shakeable-imports](/docs/quality/plugin-import-next/rules/prefer-tree-shakeable-imports): Prefer import patterns that enable effective tree-shaking
- [require-import-approval](/docs/quality/plugin-import-next/rules/require-import-approval): Enforce explicit approval for high-risk package imports
- [unambiguous](/docs/quality/plugin-import-next/rules/unambiguous): Forbid potentially ambiguous parse goal (script vs. module)
- [cognitive-complexity](/docs/quality/plugin-maintainability/rules/cognitive-complexity): Enforces a maximum cognitive complexity threshold with refactoring guidance
- [consistent-function-scoping](/docs/quality/plugin-maintainability/rules/consistent-function-scoping): Move functions to the highest possible scope
- [error-message](/docs/quality/plugin-maintainability/rules/error-message): Enforce providing a message when creating built-in Error objects for better debugging
- [identical-functions](/docs/quality/plugin-maintainability/rules/identical-functions): Detects duplicate function implementations with DRY refactoring suggestions
- [Rules](/docs/quality/plugin-maintainability/rules): All ESLint rules provided by eslint-plugin-maintainability
- [max-parameters](/docs/quality/plugin-maintainability/rules/max-parameters): ESLint Rule: max-parameters with LLM-optimized suggestions and auto-fix capabilities.
- [nested-complexity-hotspots](/docs/quality/plugin-maintainability/rules/nested-complexity-hotspots): ESLint Rule: nested-complexity-hotspots with LLM-optimized suggestions and auto-fix capabilities.
- [no-lonely-if](/docs/quality/plugin-maintainability/rules/no-lonely-if): Disallow if statements as the only statement in else blocks
- [no-missing-error-context](/docs/quality/plugin-maintainability/rules/no-missing-error-context): ESLint Rule: no-missing-error-context with LLM-optimized suggestions and auto-fix capabilities.
- [no-nested-ternary](/docs/quality/plugin-maintainability/rules/no-nested-ternary): Prevent nested ternary expressions for better readability
- [no-silent-errors](/docs/quality/plugin-maintainability/rules/no-silent-errors): ESLint Rule: no-silent-errors with LLM-optimized suggestions and auto-fix capabilities.
- [no-unhandled-promise](/docs/quality/plugin-maintainability/rules/no-unhandled-promise): Disallow unhandled Promise rejections with LLM-optimized suggestions for proper async error handling
- [no-unreadable-iife](/docs/quality/plugin-maintainability/rules/no-unreadable-iife): Disallow unreadable IIFE (Immediately Invoked Function Expression) patterns
- [ddd-anemic-domain-model](/docs/quality/plugin-modularity/rules/ddd-anemic-domain-model): Detects entities with only getters/setters and no business logic, enforcing the Rich Domain Model over the Anemic Domain Model anti-pattern.
- [ddd-value-object-immutability](/docs/quality/plugin-modularity/rules/ddd-value-object-immutability): ESLint Rule: ddd-value-object-immutability with LLM-optimized suggestions and auto-fix capabilities.
- [enforce-naming](/docs/quality/plugin-modularity/rules/enforce-naming): Enforce domain-specific naming conventions with business context
- [enforce-rest-conventions](/docs/quality/plugin-modularity/rules/enforce-rest-conventions): ESLint Rule: enforce-rest-conventions with LLM-optimized suggestions and auto-fix capabilities.
- [Rules](/docs/quality/plugin-modularity/rules): All ESLint rules provided by eslint-plugin-modularity
- [no-external-api-calls-in-utils](/docs/quality/plugin-modularity/rules/no-external-api-calls-in-utils): ESLint Rule: no-external-api-calls-in-utils with LLM-optimized suggestions and auto-fix capabilities.
- [no-mutable-exports](/docs/quality/plugin-modularity/rules/no-mutable-exports): Disallow mutable let/var declarations on exported bindings
- [Rules](/docs/quality/plugin-modernization/rules): All ESLint rules provided by eslint-plugin-modernization
- [no-instanceof-array](/docs/quality/plugin-modernization/rules/no-instanceof-array): Prefer Array.isArray() over instanceof Array for reliable type checking across different JavaScript realms (iframes, Web Workers).
- [prefer-at](/docs/quality/plugin-modernization/rules/prefer-at): Prefer using Array.at() for accessing elements, especially with negative indices
- [prefer-event-target](/docs/quality/plugin-modernization/rules/prefer-event-target): Prefer EventTarget over EventEmitter for isomorphic code
- [prefer-template-literal](/docs/quality/plugin-modernization/rules/prefer-template-literal): Prefer template literals over string concatenation with runtime values
- [Rules](/docs/quality/plugin-operability/rules): All ESLint rules provided by eslint-plugin-operability
- [no-console-log](/docs/quality/plugin-operability/rules/no-console-log): Disallow console.log with configurable remediation strategies and LLM-optimized output. This rule is part of eslint-plugin-operability and provides 4 auto-f
- [no-debug-code-in-production](/docs/quality/plugin-operability/rules/no-debug-code-in-production): Detects debug code that should not be present in production builds.
- [no-process-exit](/docs/quality/plugin-operability/rules/no-process-exit): Prevents direct process.exit() calls to encourage graceful shutdown patterns. This rule is part of eslint-plugin-operability.
- [no-verbose-error-messages](/docs/quality/plugin-operability/rules/no-verbose-error-messages): Prevent exposing stack traces to users in API responses
- [require-code-minification](/docs/quality/plugin-operability/rules/require-code-minification): Require minification configuration in build tools
- [require-data-minimization](/docs/quality/plugin-operability/rules/require-data-minimization): Identifies excessive data collection patterns that violate privacy principles
- [alt-text](/docs/quality/plugin-react-a11y/rules/alt-text): Enforce alt text on images and other visual elements that carry accessibility impact.
- [anchor-ambiguous-text](/docs/quality/plugin-react-a11y/rules/anchor-ambiguous-text): anchor-ambiguous-text rule
- [anchor-has-content](/docs/quality/plugin-react-a11y/rules/anchor-has-content): anchor-has-content rule
- [anchor-is-valid](/docs/quality/plugin-react-a11y/rules/anchor-is-valid): anchor-is-valid rule
- [aria-activedescendant-has-tabindex](/docs/quality/plugin-react-a11y/rules/aria-activedescendant-has-tabindex): aria-activedescendant-has-tabindex rule
- [aria-props](/docs/quality/plugin-react-a11y/rules/aria-props): aria-props rule
- [aria-role](/docs/quality/plugin-react-a11y/rules/aria-role): aria-role rule
- [aria-unsupported-elements](/docs/quality/plugin-react-a11y/rules/aria-unsupported-elements): aria-unsupported-elements rule
- [autocomplete-valid](/docs/quality/plugin-react-a11y/rules/autocomplete-valid): autocomplete-valid rule
- [click-events-have-key-events](/docs/quality/plugin-react-a11y/rules/click-events-have-key-events): click-events-have-key-events rule
- [control-has-associated-label](/docs/quality/plugin-react-a11y/rules/control-has-associated-label): control-has-associated-label rule
- [heading-has-content](/docs/quality/plugin-react-a11y/rules/heading-has-content): heading-has-content rule
- [html-has-lang](/docs/quality/plugin-react-a11y/rules/html-has-lang): html-has-lang rule
- [iframe-has-title](/docs/quality/plugin-react-a11y/rules/iframe-has-title): iframe-has-title rule
- [img-redundant-alt](/docs/quality/plugin-react-a11y/rules/img-redundant-alt): img-redundant-alt rule
- [Rules](/docs/quality/plugin-react-a11y/rules): All ESLint rules provided by eslint-plugin-react-a11y
- [interactive-supports-focus](/docs/quality/plugin-react-a11y/rules/interactive-supports-focus): interactive-supports-focus rule
- [label-has-associated-control](/docs/quality/plugin-react-a11y/rules/label-has-associated-control): label-has-associated-control rule
- [lang](/docs/quality/plugin-react-a11y/rules/lang): lang rule
- [media-has-caption](/docs/quality/plugin-react-a11y/rules/media-has-caption): media-has-caption rule
- [mouse-events-have-key-events](/docs/quality/plugin-react-a11y/rules/mouse-events-have-key-events): mouse-events-have-key-events rule
- [no-access-key](/docs/quality/plugin-react-a11y/rules/no-access-key): no-access-key rule
- [no-aria-hidden-on-focusable](/docs/quality/plugin-react-a11y/rules/no-aria-hidden-on-focusable): no-aria-hidden-on-focusable rule
- [no-autofocus](/docs/quality/plugin-react-a11y/rules/no-autofocus): no-autofocus rule
- [no-distracting-elements](/docs/quality/plugin-react-a11y/rules/no-distracting-elements): no-distracting-elements rule
- [no-interactive-element-to-noninteractive-role](/docs/quality/plugin-react-a11y/rules/no-interactive-element-to-noninteractive-role): no-interactive-element-to-noninteractive-role rule
- [no-keyboard-inaccessible-elements](/docs/quality/plugin-react-a11y/rules/no-keyboard-inaccessible-elements): no-keyboard-inaccessible-elements rule
- [no-missing-aria-labels](/docs/quality/plugin-react-a11y/rules/no-missing-aria-labels): no-missing-aria-labels rule
- [no-noninteractive-element-interactions](/docs/quality/plugin-react-a11y/rules/no-noninteractive-element-interactions): no-noninteractive-element-interactions rule
- [no-noninteractive-element-to-interactive-role](/docs/quality/plugin-react-a11y/rules/no-noninteractive-element-to-interactive-role): no-noninteractive-element-to-interactive-role rule
- [no-noninteractive-tabindex](/docs/quality/plugin-react-a11y/rules/no-noninteractive-tabindex): no-noninteractive-tabindex rule
- [no-redundant-roles](/docs/quality/plugin-react-a11y/rules/no-redundant-roles): no-redundant-roles rule
- [no-static-element-interactions](/docs/quality/plugin-react-a11y/rules/no-static-element-interactions): no-static-element-interactions rule
- [prefer-tag-over-role](/docs/quality/plugin-react-a11y/rules/prefer-tag-over-role): prefer-tag-over-role rule
- [role-has-required-aria-props](/docs/quality/plugin-react-a11y/rules/role-has-required-aria-props): role-has-required-aria-props rule
- [role-supports-aria-props](/docs/quality/plugin-react-a11y/rules/role-supports-aria-props): role-supports-aria-props rule
- [scope](/docs/quality/plugin-react-a11y/rules/scope): scope rule
- [tabindex-no-positive](/docs/quality/plugin-react-a11y/rules/tabindex-no-positive): tabindex-no-positive rule
- [checked-requires-onchange-or-readonly](/docs/quality/plugin-react-features/rules/checked-requires-onchange-or-readonly): checked-requires-onchange-or-readonly rule
- [default-props-match-prop-types](/docs/quality/plugin-react-features/rules/default-props-match-prop-types): default-props-match-prop-types rule
- [display-name](/docs/quality/plugin-react-features/rules/display-name): display-name rule
- [hooks-exhaustive-deps](/docs/quality/plugin-react-features/rules/hooks-exhaustive-deps): hooks-exhaustive-deps rule
- [Rules](/docs/quality/plugin-react-features/rules): All ESLint rules provided by eslint-plugin-react-features
- [jsx-handler-names](/docs/quality/plugin-react-features/rules/jsx-handler-names): jsx-handler-names rule
- [jsx-key](/docs/quality/plugin-react-features/rules/jsx-key): jsx-key rule
- [jsx-max-depth](/docs/quality/plugin-react-features/rules/jsx-max-depth): jsx-max-depth rule
- [jsx-no-bind](/docs/quality/plugin-react-features/rules/jsx-no-bind): jsx-no-bind rule
- [jsx-no-duplicate-props](/docs/quality/plugin-react-features/rules/jsx-no-duplicate-props): Prevent duplicate props in JSX elements. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
- [jsx-no-literals](/docs/quality/plugin-react-features/rules/jsx-no-literals): jsx-no-literals rule
- [jsx-no-script-url](/docs/quality/plugin-react-features/rules/jsx-no-script-url): Prevent javascript: URLs in JSX. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
- [jsx-no-target-blank](/docs/quality/plugin-react-features/rules/jsx-no-target-blank): Require rel='noopener noreferrer' with target='_blank'. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
- [no-access-state-in-setstate](/docs/quality/plugin-react-features/rules/no-access-state-in-setstate): no-access-state-in-setstate rule
- [no-adjacent-inline-elements](/docs/quality/plugin-react-features/rules/no-adjacent-inline-elements): no-adjacent-inline-elements rule
- [no-arbitrary-token-class](/docs/quality/plugin-react-features/rules/no-arbitrary-token-class): No Tailwind arbitrary values when a token exists for that property (R19)
- [no-arrow-function-lifecycle](/docs/quality/plugin-react-features/rules/no-arrow-function-lifecycle): no-arrow-function-lifecycle rule
- [no-children-prop](/docs/quality/plugin-react-features/rules/no-children-prop): no-children-prop rule
- [no-danger-with-children](/docs/quality/plugin-react-features/rules/no-danger-with-children): Prevent using children and dangerouslySetInnerHTML together. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
- [no-danger](/docs/quality/plugin-react-features/rules/no-danger): no-danger rule
- [no-default-test-id](/docs/quality/plugin-react-features/rules/no-default-test-id): data-testid must be consumer-provided — no runtime default value (R5)
- [no-deprecated](/docs/quality/plugin-react-features/rules/no-deprecated): Warn about using deprecated React APIs. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
- [no-did-mount-set-state](/docs/quality/plugin-react-features/rules/no-did-mount-set-state): no-did-mount-set-state rule
- [no-did-update-set-state](/docs/quality/plugin-react-features/rules/no-did-update-set-state): no-did-update-set-state rule
- [no-direct-mutation-state](/docs/quality/plugin-react-features/rules/no-direct-mutation-state): no-direct-mutation-state rule
- [no-find-dom-node](/docs/quality/plugin-react-features/rules/no-find-dom-node): Prevent using findDOMNode. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
- [no-inline-style](/docs/quality/plugin-react-features/rules/no-inline-style): No inline `style={{}}` except for CSS-variable assignment (R18)
- [no-invalid-html-attribute](/docs/quality/plugin-react-features/rules/no-invalid-html-attribute): no-invalid-html-attribute rule
- [no-is-mounted](/docs/quality/plugin-react-features/rules/no-is-mounted): no-is-mounted rule
- [no-is-prefix-prop](/docs/quality/plugin-react-features/rules/no-is-prefix-prop): Boolean props must not be prefixed with `is` (R8)
- [no-kind-prop-discriminator](/docs/quality/plugin-react-features/rules/no-kind-prop-discriminator): Ban `type`/`kind` string-union props that select between rendered trees (R11)
- [no-multi-comp](/docs/quality/plugin-react-features/rules/no-multi-comp): no-multi-comp rule
- [no-namespace](/docs/quality/plugin-react-features/rules/no-namespace): no-namespace rule
- [no-object-type-as-default-prop](/docs/quality/plugin-react-features/rules/no-object-type-as-default-prop): no-object-type-as-default-prop rule
- [no-raw-color-literal](/docs/quality/plugin-react-features/rules/no-raw-color-literal): No raw hex / rgb / hsl / oklch color literals in source — use design tokens (R19)
- [no-redundant-should-component-update](/docs/quality/plugin-react-features/rules/no-redundant-should-component-update): no-redundant-should-component-update rule
- [no-render-return-value](/docs/quality/plugin-react-features/rules/no-render-return-value): no-render-return-value rule
- [no-set-state](/docs/quality/plugin-react-features/rules/no-set-state): no-set-state rule
- [no-string-refs](/docs/quality/plugin-react-features/rules/no-string-refs): no-string-refs rule
- [no-this-in-sfc](/docs/quality/plugin-react-features/rules/no-this-in-sfc): no-this-in-sfc rule
- [no-typos](/docs/quality/plugin-react-features/rules/no-typos): no-typos rule
- [no-unescaped-entities](/docs/quality/plugin-react-features/rules/no-unescaped-entities): no-unescaped-entities rule
- [no-unknown-property](/docs/quality/plugin-react-features/rules/no-unknown-property): no-unknown-property rule
- [no-unnecessary-rerenders](/docs/quality/plugin-react-features/rules/no-unnecessary-rerenders): no-unnecessary-rerenders rule
- [no-unsafe](/docs/quality/plugin-react-features/rules/no-unsafe): Warn about UNSAFE_ lifecycle methods. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
- [no-wrapper-sub-component](/docs/quality/plugin-react-features/rules/no-wrapper-sub-component): Ban pure-passthrough wrapper sub-components — slot the primitive directly (R12)
- [prefer-es6-class](/docs/quality/plugin-react-features/rules/prefer-es6-class): prefer-es6-class rule
- [prefer-stateless-function](/docs/quality/plugin-react-features/rules/prefer-stateless-function): prefer-stateless-function rule
- [prop-types](/docs/quality/plugin-react-features/rules/prop-types): prop-types rule
- [react-class-to-hooks](/docs/quality/plugin-react-features/rules/react-class-to-hooks): react-class-to-hooks rule
- [react-in-jsx-scope](/docs/quality/plugin-react-features/rules/react-in-jsx-scope): react-in-jsx-scope rule
- [react-no-inline-functions](/docs/quality/plugin-react-features/rules/react-no-inline-functions): react-no-inline-functions rule
- [react-render-optimization](/docs/quality/plugin-react-features/rules/react-render-optimization): react-render-optimization rule
- [require-data-slot](/docs/quality/plugin-react-features/rules/require-data-slot): Named composition parts must carry data-slot (R6)
- [require-default-props](/docs/quality/plugin-react-features/rules/require-default-props): require-default-props rule
- [require-optimization](/docs/quality/plugin-react-features/rules/require-optimization): require-optimization rule
- [require-render-return](/docs/quality/plugin-react-features/rules/require-render-return): require-render-return rule
- [required-attributes](/docs/quality/plugin-react-features/rules/required-attributes): required-attributes rule
- [sort-comp](/docs/quality/plugin-react-features/rules/sort-comp): sort-comp rule
- [state-in-constructor](/docs/quality/plugin-react-features/rules/state-in-constructor): state-in-constructor rule
- [static-property-placement](/docs/quality/plugin-react-features/rules/static-property-placement): static-property-placement rule
- [void-dom-elements-no-children](/docs/quality/plugin-react-features/rules/void-dom-elements-no-children): Prevent void DOM elements from receiving children. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
- [error-message](/docs/quality/plugin-reliability/rules/error-message): Enforce providing a message when creating built-in Error objects for better debugging. This rule is part of eslint-plugin-reliability and provides LLM-optim
- [Rules](/docs/quality/plugin-reliability/rules): All ESLint rules provided by eslint-plugin-reliability
- [no-await-in-loop](/docs/quality/plugin-reliability/rules/no-await-in-loop): Disallow await inside loops without considering concurrency implications
- [no-jsdoc-terminator-in-example](/docs/quality/plugin-reliability/rules/no-jsdoc-terminator-in-example): Detect `*/` sequences inside JSDoc `@example` blocks that prematurely close the JSDoc comment.
- [no-missing-error-context](/docs/quality/plugin-reliability/rules/no-missing-error-context): ESLint Rule: no-missing-error-context with LLM-optimized suggestions and auto-fix capabilities.
- [no-missing-null-checks](/docs/quality/plugin-reliability/rules/no-missing-null-checks): ESLint Rule: no-missing-null-checks with LLM-optimized suggestions and auto-fix capabilities.
- [no-silent-errors](/docs/quality/plugin-reliability/rules/no-silent-errors): ESLint Rule: no-silent-errors with LLM-optimized suggestions and auto-fix capabilities.
- [no-unhandled-promise](/docs/quality/plugin-reliability/rules/no-unhandled-promise): Disallow unhandled Promise rejections with LLM-optimized suggestions for proper async error handling. This rule detects promises that are created but never have
- [no-unsafe-type-narrowing](/docs/quality/plugin-reliability/rules/no-unsafe-type-narrowing): ESLint Rule: no-unsafe-type-narrowing with LLM-optimized suggestions and auto-fix capabilities.
- [require-network-timeout](/docs/quality/plugin-reliability/rules/require-network-timeout): Require timeout configuration for network requests. This rule is part of eslint-plugin-reliability and provides LLM-optimized error messages.
- [no-browser-api-key-exposure](/docs/security/plugin-anthropic-security/rules/no-browser-api-key-exposure): Forbid dangerouslyAllowBrowser, which exposes the Anthropic API key to the client
- [no-hardcoded-api-key](/docs/security/plugin-anthropic-security/rules/no-hardcoded-api-key): Forbid a literal API key in the Anthropic client options
- [no-untrusted-content-in-prompt](/docs/security/plugin-anthropic-security/rules/no-untrusted-content-in-prompt): Disallow untrusted content built into the Anthropic system prompt
- [no-mass-assignment](/docs/security/plugin-drizzle-security/rules/no-mass-assignment): Disallow writing an inbound request object straight to the database through Drizzle, which lets the caller set every column the model exposes.
- [no-raw-identifier-interpolation](/docs/security/plugin-drizzle-security/rules/no-raw-identifier-interpolation): Disallow interpolating table, column or sort identifiers into a Drizzle `sql` tagged template, where bind parameters cannot reach them.
- [no-unsafe-query](/docs/security/plugin-drizzle-security/rules/no-unsafe-query): Prevent SQL injection by disallowing string concatenation or interpolated template literals in Drizzle sql.raw() calls.
- [no-unscoped-mutation](/docs/security/plugin-drizzle-security/rules/no-unscoped-mutation): Require a chained `.where()` on Drizzle delete and update builders, so a bulk mutation cannot rewrite or delete every row in the table.
- [detect-mixed-content](/docs/security/plugin-browser-security/rules/detect-mixed-content): Detects HTTP URLs in code that should use HTTPS, preventing mixed content vulnerabilities.
- [Rules](/docs/security/plugin-browser-security/rules): All ESLint security rules provided by eslint-plugin-browser-security
- [no-allow-arbitrary-loads](/docs/security/plugin-browser-security/rules/no-allow-arbitrary-loads): Prevents disabling App Transport Security (ATS) by detecting NSAllowsArbitraryLoads: true in an Expo/React Native config.
- [no-clickjacking](/docs/security/plugin-browser-security/rules/no-clickjacking): Detects clickjacking vulnerabilities and missing frame protections
- [no-client-side-auth-logic](/docs/security/plugin-browser-security/rules/no-client-side-auth-logic): Prevent client-side authentication logic that can be bypassed. This rule is part of eslint-plugin-browser-security and provides LLM-optimized error messages.
- [no-cookie-auth-tokens](/docs/security/plugin-browser-security/rules/no-cookie-auth-tokens): Prevent storing authentication tokens in JavaScript-accessible cookies.
- [no-credentials-in-query-params](/docs/security/plugin-browser-security/rules/no-credentials-in-query-params): CWE-598
- [no-disabled-certificate-validation](/docs/security/plugin-browser-security/rules/no-disabled-certificate-validation): CWE-295
- [no-dynamic-service-worker-url](/docs/security/plugin-browser-security/rules/no-dynamic-service-worker-url): Prevent dynamic URLs in service worker registration.
- [no-eval](/docs/security/plugin-browser-security/rules/no-eval): Detects dangerous eval() and similar code execution patterns
- [no-filereader-innerhtml](/docs/security/plugin-browser-security/rules/no-filereader-innerhtml): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [no-http-urls](/docs/security/plugin-browser-security/rules/no-http-urls): CWE-319
- [no-incomplete-url-sanitization](/docs/security/plugin-browser-security/rules/no-incomplete-url-sanitization): Disallow URL substring tests and partial scheme denylists as security decisions
- [no-innerhtml](/docs/security/plugin-browser-security/rules/no-innerhtml): Detects dangerous innerHTML/outerHTML assignments that can lead to Cross-Site Scripting (XSS)
- [no-insecure-redirects](/docs/security/plugin-browser-security/rules/no-insecure-redirects): ESLint Rule: no-insecure-redirects
- [no-insecure-websocket](/docs/security/plugin-browser-security/rules/no-insecure-websocket): CWE-319
- [no-jwt-in-storage](/docs/security/plugin-browser-security/rules/no-jwt-in-storage): This rule prevents storing JWT tokens in browser storage (localStorage/sessionStorage)
- [no-missing-cors-check](/docs/security/plugin-browser-security/rules/no-missing-cors-check): Detects missing CORS validation (wildcard CORS, missing origin check) that can allow unauthorized cross-origin requests
- [no-missing-csrf-protection](/docs/security/plugin-browser-security/rules/no-missing-csrf-protection): Detects missing CSRF token validation in POST/PUT/DELETE requests
- [no-missing-security-headers](/docs/security/plugin-browser-security/rules/no-missing-security-headers): ESLint Rule: no-missing-security-headers
- [no-password-in-url](/docs/security/plugin-browser-security/rules/no-password-in-url): This rule detects when URLs contain password-related query parameters or URL fragments
- [no-permissive-cors](/docs/security/plugin-browser-security/rules/no-permissive-cors): CWE-942
- [no-postmessage-innerhtml](/docs/security/plugin-browser-security/rules/no-postmessage-innerhtml): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [no-postmessage-wildcard-origin](/docs/security/plugin-browser-security/rules/no-postmessage-wildcard-origin): This rule prevents using "" as the targetOrigin parameter in postMessage() calls
- [no-sensitive-cookie-js](/docs/security/plugin-browser-security/rules/no-sensitive-cookie-js): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [no-sensitive-data-in-analytics](/docs/security/plugin-browser-security/rules/no-sensitive-data-in-analytics): This rule detects when sensitive user data (email, SSN, credit card, password, phone, address) is passed to analytics...
- [no-sensitive-data-in-cache](/docs/security/plugin-browser-security/rules/no-sensitive-data-in-cache): CWE-200
- [no-sensitive-indexeddb](/docs/security/plugin-browser-security/rules/no-sensitive-indexeddb): Prevent storing sensitive data in IndexedDB.
- [no-sensitive-localstorage](/docs/security/plugin-browser-security/rules/no-sensitive-localstorage): Detects storage of sensitive data (tokens, passwords, PII) in localStorage
- [no-sensitive-sessionstorage](/docs/security/plugin-browser-security/rules/no-sensitive-sessionstorage): Prevent storing sensitive data in sessionStorage.
- [no-tracking-without-consent](/docs/security/plugin-browser-security/rules/no-tracking-without-consent): CWE-359
- [no-unencrypted-transmission](/docs/security/plugin-browser-security/rules/no-unencrypted-transmission): Detects unencrypted data transmission (HTTP vs HTTPS, plain text protocols)
- [no-unescaped-url-parameter](/docs/security/plugin-browser-security/rules/no-unescaped-url-parameter): Detects unescaped URL parameters that can lead to Cross-Site Scripting (XSS) or open redirect vulnerabilities
- [no-unsafe-eval-csp](/docs/security/plugin-browser-security/rules/no-unsafe-eval-csp): Disallow 'unsafe-eval' in Content Security Policy directives.
- [no-unsafe-inline-csp](/docs/security/plugin-browser-security/rules/no-unsafe-inline-csp): Disallow 'unsafe-inline' in Content Security Policy directives.
- [no-unvalidated-deeplinks](/docs/security/plugin-browser-security/rules/no-unvalidated-deeplinks): This rule detects when deep link URLs are opened without validation in React Native or mobile web apps
- [no-websocket-eval](/docs/security/plugin-browser-security/rules/no-websocket-eval): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [no-websocket-innerhtml](/docs/security/plugin-browser-security/rules/no-websocket-innerhtml): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [no-worker-message-innerhtml](/docs/security/plugin-browser-security/rules/no-worker-message-innerhtml): Disallow using innerHTML with Web Worker message data.
- [require-blob-url-revocation](/docs/security/plugin-browser-security/rules/require-blob-url-revocation): Require revoking Blob URLs after use to prevent memory leaks.
- [require-cookie-secure-attrs](/docs/security/plugin-browser-security/rules/require-cookie-secure-attrs): Require Secure and SameSite attributes on cookies.
- [require-csp-headers](/docs/security/plugin-browser-security/rules/require-csp-headers): CWE-1021
- [require-https-only](/docs/security/plugin-browser-security/rules/require-https-only): This rule detects HTTP (unencrypted) URLs in fetch() and axios requests
- [require-mime-type-validation](/docs/security/plugin-browser-security/rules/require-mime-type-validation): CWE-434
- [require-postmessage-origin-check](/docs/security/plugin-browser-security/rules/require-postmessage-origin-check): Detects postMessage event handlers without origin validation
- [require-url-validation](/docs/security/plugin-browser-security/rules/require-url-validation): CWE-601
- [require-websocket-wss](/docs/security/plugin-browser-security/rules/require-websocket-wss): This rule enforces the use of wss:// (WebSocket Secure) protocol instead of ws:// (unencrypted WebSocket)
- [Rules](/docs/security/plugin-express-security/rules): All ESLint security rules provided by eslint-plugin-express-security
- [no-client-controlled-authorization](/docs/security/plugin-express-security/rules/no-client-controlled-authorization): This rule detects access decisions taken on request-supplied role, permission or identity values — the check runs, and passes for anyone who sets the field
- [no-cors-credentials-wildcard](/docs/security/plugin-express-security/rules/no-cors-credentials-wildcard): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [no-disabled-helmet-protections](/docs/security/plugin-express-security/rules/no-disabled-helmet-protections): This rule detects helmet options that switch a shipped security-header default off, leaving a mounted helmet with the exposure of no helmet at all
- [no-error-details-in-response](/docs/security/plugin-express-security/rules/no-error-details-in-response): Disallow sending caught error objects, stack traces, or spreads of them in HTTP responses.
- [no-exposed-debug-endpoints](/docs/security/plugin-express-security/rules/no-exposed-debug-endpoints): Identifies potential debug, administration, or testing endpoints that are often left exposed in production environmen...
- [no-express-unsafe-regex-route](/docs/security/plugin-express-security/rules/no-express-unsafe-regex-route): This rule detects Regular Expression Denial of Service (ReDoS) vulnerabilities in Express route patterns
- [no-graphql-introspection-production](/docs/security/plugin-express-security/rules/no-graphql-introspection-production): This rule detects GraphQL servers with introspection enabled in production
- [no-host-header-in-links](/docs/security/plugin-express-security/rules/no-host-header-in-links): Disallow building absolute URLs (password-reset and verification links) from the Host or X-Forwarded-Host request header.
- [no-idor-resource-access](/docs/security/plugin-express-security/rules/no-idor-resource-access): This rule detects a resource fetched by an identifier taken straight from the request inside a handler that never mentions the authenticated principal — the classic IDOR shape
- [no-insecure-cookie-options](/docs/security/plugin-express-security/rules/no-insecure-cookie-options): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [no-missing-cors-check](/docs/security/plugin-express-security/rules/no-missing-cors-check): Detects missing CORS validation (wildcard CORS, missing origin check)
- [no-missing-csrf-protection](/docs/security/plugin-express-security/rules/no-missing-csrf-protection): Detects missing CSRF token validation in POST/PUT/DELETE requests
- [no-missing-security-headers](/docs/security/plugin-express-security/rules/no-missing-security-headers): Detects missing security headers in HTTP responses
- [no-permissive-cors](/docs/security/plugin-express-security/rules/no-permissive-cors): Detects overly permissive CORS configurations in Express.js applications
- [no-permissive-trust-proxy](/docs/security/plugin-express-security/rules/no-permissive-trust-proxy): This rule detects unconditional 'trust proxy' settings, which make req.ip whatever the caller says it is and hand rate limits, IP allowlists and audit logs to the client
- [no-sensitive-data-in-query](/docs/security/plugin-express-security/rules/no-sensitive-data-in-query): Disallow reading sensitive-named parameters (password, token, secret, apiKey, ...) from req.query.
- [no-static-root-exposure](/docs/security/plugin-express-security/rules/no-static-root-exposure): Disallow express.static() roots that expose the application directory and any serve-index usage
- [no-unsafe-csp-directives](/docs/security/plugin-express-security/rules/no-unsafe-csp-directives): This rule detects Content-Security-Policy directives that hand back the protection the header exists to provide — unsafe-inline, unsafe-eval, wildcard sources, unrestricted framing, and dropped mixed-content upgrades
- [no-user-controlled-redirect](/docs/security/plugin-express-security/rules/no-user-controlled-redirect): Disallow res.redirect() with values directly from req.query / req.body / req.params
- [no-user-controlled-render-locals](/docs/security/plugin-express-security/rules/no-user-controlled-render-locals): Disallow res.render() with locals or view names sourced wholesale from req.body / req.query / req.params
- [require-case-insensitive-path-guard](/docs/security/plugin-express-security/rules/require-case-insensitive-path-guard): This rule detects path-based authorization guards that compare req.path case-sensitively, which case-insensitive Express routing bypasses
- [require-csrf-protection](/docs/security/plugin-express-security/rules/require-csrf-protection): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [require-express-body-parser-limits](/docs/security/plugin-express-security/rules/require-express-body-parser-limits): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [require-helmet](/docs/security/plugin-express-security/rules/require-helmet): This rule detects Express.js applications that are missing the helmet middleware
- [require-query-type-guard](/docs/security/plugin-express-security/rules/require-query-type-guard): This rule detects string methods called on req.query values without a type guard — Express query values can be arrays or objects, not just strings
- [require-rate-limiting](/docs/security/plugin-express-security/rules/require-rate-limiting): This rule detects Express.js applications missing rate-limiting middleware
- [require-route-authentication](/docs/security/plugin-express-security/rules/require-route-authentication): This rule detects routes that expose a critical function — credentials, accounts, payments, configuration — with no authentication middleware and no principal read in the handler
- [require-strict-transport-security](/docs/security/plugin-express-security/rules/require-strict-transport-security): This rule detects HSTS configurations that leave a downgrade window open — the header disabled, a max-age below the six-month floor, or subdomains excluded
- [Rules](/docs/security/plugin-jwt-security/rules): All ESLint security rules provided by eslint-plugin-jwt-security
- [no-algorithm-confusion](/docs/security/plugin-jwt-security/rules/no-algorithm-confusion): This rule detects algorithm confusion attacks where symmetric algorithms (HS256, HS384, HS512) are used with asymmetr...
- [no-algorithm-none](/docs/security/plugin-jwt-security/rules/no-algorithm-none): This rule detects attempts to use the none algorithm which completely bypasses JWT signature verification
- [no-decode-without-verify](/docs/security/plugin-jwt-security/rules/no-decode-without-verify): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [no-hardcoded-secret](/docs/security/plugin-jwt-security/rules/no-hardcoded-secret): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [no-sensitive-payload](/docs/security/plugin-jwt-security/rules/no-sensitive-payload): JWT payloads are NOT encrypted, only base64-encoded
- [no-timestamp-manipulation](/docs/security/plugin-jwt-security/rules/no-timestamp-manipulation): This rule detects noTimestamp: true which disables automatic iat (issued at) claim generation
- [no-weak-secret](/docs/security/plugin-jwt-security/rules/no-weak-secret): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [require-algorithm-whitelist](/docs/security/plugin-jwt-security/rules/require-algorithm-whitelist): This rule enforces explicit algorithm specification in verify() calls
- [require-audience-validation](/docs/security/plugin-jwt-security/rules/require-audience-validation): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [require-expiration](/docs/security/plugin-jwt-security/rules/require-expiration): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [require-issued-at](/docs/security/plugin-jwt-security/rules/require-issued-at): This rule ensures tokens have the iat claim for freshness validation
- [require-issuer-validation](/docs/security/plugin-jwt-security/rules/require-issuer-validation): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [require-max-age](/docs/security/plugin-jwt-security/rules/require-max-age): This rule mandates maxAge in verify operations
- [no-disabled-safety-settings](/docs/security/plugin-gemini-security/rules/no-disabled-safety-settings): Forbid disabling Gemini harm-category filters
- [no-hardcoded-api-key](/docs/security/plugin-gemini-security/rules/no-hardcoded-api-key): Forbid a literal API key in the Gemini client construction
- [no-untrusted-content-in-prompt](/docs/security/plugin-gemini-security/rules/no-untrusted-content-in-prompt): Disallow untrusted content built into the Gemini system prompt
- [no-hardcoded-credentials](/docs/security/plugin-knex-security/rules/no-hardcoded-credentials): Disallow literal database passwords in knex connection configuration, including credentials embedded in a connection URL.
- [no-mass-assignment](/docs/security/plugin-knex-security/rules/no-mass-assignment): Disallow writing an inbound request object straight to the database through knex, which lets the caller set every column the model exposes.
- [no-unsafe-query](/docs/security/plugin-knex-security/rules/no-unsafe-query): Prevent SQL injection by disallowing string concatenation or interpolated template literals in knex.raw() calls.
- [no-unscoped-mutation](/docs/security/plugin-knex-security/rules/no-unscoped-mutation): Require a chained `.where()` on Knex delete and update builders, so a bulk mutation cannot rewrite or delete every row in the table.
- [require-tls](/docs/security/plugin-knex-security/rules/require-tls): Require TLS on Knex database connections, so queries and credentials are not sent in cleartext and the server is authenticated.
- [Rules](/docs/security/plugin-lambda-security/rules): All ESLint security rules provided by eslint-plugin-lambda-security
- [no-env-logging](/docs/security/plugin-lambda-security/rules/no-env-logging): Detect logging of process.env which may expose secrets
- [no-error-swallowing](/docs/security/plugin-lambda-security/rules/no-error-swallowing): Detect empty catch blocks and missing error logging
- [no-exposed-debug-endpoints](/docs/security/plugin-lambda-security/rules/no-exposed-debug-endpoints): Detect debug endpoints without authentication in Lambda handlers
- [no-exposed-error-details](/docs/security/plugin-lambda-security/rules/no-exposed-error-details): Detect Lambda handlers exposing internal error details in responses
- [no-hardcoded-credentials-sdk](/docs/security/plugin-lambda-security/rules/no-hardcoded-credentials-sdk): Detects hardcoded AWS credentials in SDK client configurations
- [no-missing-authorization-check](/docs/security/plugin-lambda-security/rules/no-missing-authorization-check): Security rule for lambda-security. This rule is part of eslint-plugin-lambda-security and provides LLM-optimized error messages.
- [no-overly-permissive-iam-policy](/docs/security/plugin-lambda-security/rules/no-overly-permissive-iam-policy): Security rule for lambda-security. This rule is part of eslint-plugin-lambda-security and provides LLM-optimized error messages.
- [no-permissive-cors-middy](/docs/security/plugin-lambda-security/rules/no-permissive-cors-middy): Detects permissive CORS configurations in Middy middleware
- [no-permissive-cors-response](/docs/security/plugin-lambda-security/rules/no-permissive-cors-response): Detects permissive CORS headers in Lambda API Gateway responses
- [no-secrets-in-env](/docs/security/plugin-lambda-security/rules/no-secrets-in-env): Detects secrets defined directly in environment variable configurations
- [no-unbounded-batch-processing](/docs/security/plugin-lambda-security/rules/no-unbounded-batch-processing): Detect processing batch records without size validation
- [no-unvalidated-event-body](/docs/security/plugin-lambda-security/rules/no-unvalidated-event-body): Detect Lambda handlers using event body without validation
- [no-user-controlled-requests](/docs/security/plugin-lambda-security/rules/no-user-controlled-requests): Detect HTTP requests with user-controlled URLs (SSRF)
- [require-timeout-handling](/docs/security/plugin-lambda-security/rules/require-timeout-handling): Require timeout handling in Lambda handlers with external calls
- [no-command-injection-in-tool](/docs/security/plugin-mcp-sdk-security/rules/no-command-injection-in-tool): Disallow an MCP tool argument being used directly as the command in a child_process call.
- [no-tool-description-injection](/docs/security/plugin-mcp-sdk-security/rules/no-tool-description-injection): Require MCP tool descriptions and titles to be static text, since they reach the model as instructions.
- [no-unvalidated-tool-args](/docs/security/plugin-mcp-sdk-security/rules/no-unvalidated-tool-args): Disallow a tool handler reading an argument its declared input schema does not include.
- [require-tool-input-schema](/docs/security/plugin-mcp-sdk-security/rules/require-tool-input-schema): Require an input schema when registering an MCP tool
- [Rules](/docs/security/plugin-mongodb-security/rules): All ESLint security rules provided by eslint-plugin-mongodb-security
- [no-bypass-middleware](/docs/security/plugin-mongodb-security/rules/no-bypass-middleware): Detects Mongoose operations that bypass middleware hooks (pre/post hooks).
- [no-debug-mode-production](/docs/security/plugin-mongodb-security/rules/no-debug-mode-production): Detects Mongoose debug mode that could expose sensitive query information in production.
- [no-hardcoded-connection-string](/docs/security/plugin-mongodb-security/rules/no-hardcoded-connection-string): Detects hardcoded MongoDB connection strings containing credentials in source code.
- [no-hardcoded-credentials](/docs/security/plugin-mongodb-security/rules/no-hardcoded-credentials): Detects hardcoded MongoDB authentication credentials in connection options.
- [no-operator-injection](/docs/security/plugin-mongodb-security/rules/no-operator-injection): Detects MongoDB operator injection attacks where user input is passed directly as query values, allowing attackers to...
- [no-select-sensitive-fields](/docs/security/plugin-mongodb-security/rules/no-select-sensitive-fields): Detects queries that may return sensitive fields like passwords, tokens, or API keys.
- [no-unbounded-find](/docs/security/plugin-mongodb-security/rules/no-unbounded-find): Requires limit() on find queries to prevent resource exhaustion from unbounded result sets.
- [no-unsafe-populate](/docs/security/plugin-mongodb-security/rules/no-unsafe-populate): Detects user-controlled populate() paths that could lead to data exposure or injection.
- [no-unsafe-query](/docs/security/plugin-mongodb-security/rules/no-unsafe-query): Prevents NoSQL injection by detecting direct use of user input in MongoDB query objects.
- [no-unsafe-regex-query](/docs/security/plugin-mongodb-security/rules/no-unsafe-regex-query): Detects user input in MongoDB $regex operators that could cause ReDoS (Regular Expression Denial of Service) or infor...
- [no-unsafe-where](/docs/security/plugin-mongodb-security/rules/no-unsafe-where): Prevents use of the dangerous $where operator which executes JavaScript on the MongoDB server, enabling Remote Code E...
- [require-auth-mechanism](/docs/security/plugin-mongodb-security/rules/require-auth-mechanism): Requires explicit authentication mechanism specification for MongoDB connections.
- [require-lean-queries](/docs/security/plugin-mongodb-security/rules/require-lean-queries): Suggests using .lean() for read-only Mongoose queries to reduce memory usage.
- [require-projection](/docs/security/plugin-mongodb-security/rules/require-projection): Requires field projection on queries to minimize data exposure.
- [require-schema-validation](/docs/security/plugin-mongodb-security/rules/require-schema-validation): Requires validation options on Mongoose schema fields to prevent invalid or malicious data.
- [require-tls-connection](/docs/security/plugin-mongodb-security/rules/require-tls-connection): Requires TLS/SSL encryption for MongoDB connections in production environments.
- [no-hardcoded-credentials](/docs/security/plugin-mysql-security/rules/no-hardcoded-credentials): Disallow literal database passwords in mysql2 / mysql connection configuration, including credentials embedded in a connection URL.
- [no-unsafe-query](/docs/security/plugin-mysql-security/rules/no-unsafe-query): Prevent SQL injection by disallowing string concatenation or interpolated template literals in mysql/mysql2 queries.
- [require-tls](/docs/security/plugin-mysql-security/rules/require-tls): Require TLS on mysql2 / mysql connections, so queries and credentials are not sent in cleartext and the server is authenticated.
- [Rules](/docs/security/plugin-nestjs-security/rules): All ESLint security rules provided by eslint-plugin-nestjs-security
- [no-exposed-private-fields](/docs/security/plugin-nestjs-security/rules/no-exposed-private-fields): This rule detects sensitive fields (like passwords, tokens, secrets) in entity or DTO classes that are not excluded f...
- [no-hybrid-app-config-loss](/docs/security/plugin-nestjs-security/rules/no-hybrid-app-config-loss): Detect connectMicroservice() without inheritAppConfig, which silently drops every global pipe and guard from the microservice transport
- [no-missing-validation-pipe](/docs/security/plugin-nestjs-security/rules/no-missing-validation-pipe): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [no-permissive-cors](/docs/security/plugin-nestjs-security/rules/no-permissive-cors): Flags CORS configured to accept any origin — a bare enableCors(), origin '*', or the reflecting origin true.
- [no-res-bypass-serialization](/docs/security/plugin-nestjs-security/rules/no-res-bypass-serialization): This rule detects route handlers that inject @Res() without passthrough and then write an object, which silently ...
- [no-unguarded-swagger](/docs/security/plugin-nestjs-security/rules/no-unguarded-swagger): This rule detects SwaggerModule.setup() running unconditionally in an application bootstrap, which publishes every route, DTO shape and declared auth scheme to anonymous callers in production.
- [no-unsafe-multer-filename](/docs/security/plugin-nestjs-security/rules/no-unsafe-multer-filename): Flags a multer diskStorage filename callback that stores an upload under the name the client chose.
- [require-guards](/docs/security/plugin-nestjs-security/rules/require-guards): The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:
- [require-throttler](/docs/security/plugin-nestjs-security/rules/require-throttler): This rule detects NestJS controllers and route handlers that lack rate limiting, which can make the application vulne...
- [require-validation-pipe-whitelist](/docs/security/plugin-nestjs-security/rules/require-validation-pipe-whitelist): Requires whitelist true on ValidationPipe, so properties the DTO never declared are stripped instead of reaching the service layer.
- [detect-child-process](/docs/security/plugin-node-security/rules/detect-child-process): Detects instances of childprocess & non-literal exec() calls that may allow command injection
- [detect-eval-with-expression](/docs/security/plugin-node-security/rules/detect-eval-with-expression): Detects eval(variable) which can allow an attacker to run arbitrary code inside your process
- [detect-non-literal-fs-filename](/docs/security/plugin-node-security/rules/detect-non-literal-fs-filename): Detects variable in filename argument of fs calls, which might allow an attacker to access anything on your system
- [detect-suspicious-dependencies](/docs/security/plugin-node-security/rules/detect-suspicious-dependencies): This rule detects package imports that look like typosquatting attempts on popular npm packages
- [Rules](/docs/security/plugin-node-security/rules): All ESLint security rules provided by eslint-plugin-node-security
- [lock-file](/docs/security/plugin-node-security/rules/lock-file): CWE-829
- [no-arbitrary-file-access](/docs/security/plugin-node-security/rules/no-arbitrary-file-access): Prevents file system access with unsanitized user input to protect against path traversal attacks.
- [no-buffer-overread](/docs/security/plugin-node-security/rules/no-buffer-overread): Detects buffer access beyond bounds
- [no-cryptojs-weak-random](/docs/security/plugin-node-security/rules/no-cryptojs-weak-random): Disallow crypto-js WordArray.random() (CVE-2020-36732)
- [no-cryptojs](/docs/security/plugin-node-security/rules/no-cryptojs): Disallow deprecated crypto-js library (use native crypto instead)
- [no-data-in-temp-storage](/docs/security/plugin-node-security/rules/no-data-in-temp-storage): Temporary directories (/tmp, /var/tmp, temp/) are often world-readable or persist longer than expected
- [no-deprecated-buffer](/docs/security/plugin-node-security/rules/no-deprecated-buffer): Disallow the deprecated `new Buffer()` constructor and `Buffer()` factory call.
- [no-deprecated-cipher-method](/docs/security/plugin-node-security/rules/no-deprecated-cipher-method): Disallow deprecated crypto.createCipher/createDecipher methods
- [no-dynamic-algorithm-selection](/docs/security/plugin-node-security/rules/no-dynamic-algorithm-selection): Disallow dynamic algorithm names in Node.js crypto functions (CWE-327)
- [no-dynamic-command-string](/docs/security/plugin-node-security/rules/no-dynamic-command-string): Detects dynamically assembled command strings handed to a shell flag (bash -c) or to a command-runner that does not escape (execaCommand, $.raw)
- [no-dynamic-dependency-loading](/docs/security/plugin-node-security/rules/no-dynamic-dependency-loading): This rule detects dynamically constructed paths in require() and import() statements
- [no-dynamic-require](/docs/security/plugin-node-security/rules/no-dynamic-require): Forbid require() calls with non-literal arguments
- [no-ecb-mode](/docs/security/plugin-node-security/rules/no-ecb-mode): Disallow ECB encryption mode (use GCM or CBC instead)
- [no-env-injection](/docs/security/plugin-node-security/rules/no-env-injection): Detects writes to process.env under a key the caller controls, which can overwrite PATH, NODE_OPTIONS or LD_PRELOAD and change how later processes execute
- [no-insecure-http-parser](/docs/security/plugin-node-security/rules/no-insecure-http-parser): Disallow insecureHTTPParser true on Node HTTP servers and clients
- [no-insecure-key-derivation](/docs/security/plugin-node-security/rules/no-insecure-key-derivation): Disallow PBKDF2 with insufficient iterations (< 100,000)
- [no-insecure-rsa-padding](/docs/security/plugin-node-security/rules/no-insecure-rsa-padding): Disallow RSA PKCS#1 v1.5 padding (CVE-2023-46809 Marvin Attack)
- [no-math-random-crypto](/docs/security/plugin-node-security/rules/no-math-random-crypto): Disallow Math.random() for cryptographic purposes (tokens, keys, secrets, salts, IVs)
- [no-self-signed-certs](/docs/security/plugin-node-security/rules/no-self-signed-certs): Disallow rejectUnauthorized false in TLS options
- [no-sha1-hash](/docs/security/plugin-node-security/rules/no-sha1-hash): Disallow sha1() from crypto-hash package (use sha256 or sha512)
- [no-shell-injection](/docs/security/plugin-node-security/rules/no-shell-injection): Disallow string concatenation or template expressions in shell command arguments (CWE-78)
- [no-ssrf](/docs/security/plugin-node-security/rules/no-ssrf): Detect HTTP requests with user-controlled URLs (server-side request forgery).
- [no-static-iv](/docs/security/plugin-node-security/rules/no-static-iv): Disallow static or hardcoded initialization vectors (IVs)
- [no-timing-unsafe-compare](/docs/security/plugin-node-security/rules/no-timing-unsafe-compare): Disallow timing-unsafe comparison of secrets
- [no-toctou-vulnerability](/docs/security/plugin-node-security/rules/no-toctou-vulnerability): Detects Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerabilities in file system operations.
- [no-unbounded-decompression](/docs/security/plugin-node-security/rules/no-unbounded-decompression): Require a maxOutputLength ceiling on zlib one-shot decompression
- [no-unsafe-buffer-alloc](/docs/security/plugin-node-security/rules/no-unsafe-buffer-alloc): Disallow `Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()`, which return uninitialized memory.
- [no-unsafe-dynamic-require](/docs/security/plugin-node-security/rules/no-unsafe-dynamic-require): Disallows dynamic require() calls with non-literal arguments that could lead to security vulnerabilities
- [no-weak-cipher-algorithm](/docs/security/plugin-node-security/rules/no-weak-cipher-algorithm): Disallow weak cipher algorithms (DES, 3DES, RC4, Blowfish, RC2, IDEA)
- [no-weak-dh-parameters](/docs/security/plugin-node-security/rules/no-weak-dh-parameters): Disallow Diffie-Hellman and ECDH parameters below a safe strength
- [no-weak-hash-algorithm](/docs/security/plugin-node-security/rules/no-weak-hash-algorithm): Disallow weak hash algorithms (MD5, MD4, SHA-1, RIPEMD)
- [no-zip-slip](/docs/security/plugin-node-security/rules/no-zip-slip): Detects zip slip/archive extraction vulnerabilities
- [prefer-native-crypto](/docs/security/plugin-node-security/rules/prefer-native-crypto): Prefer native crypto over third-party libraries
- [require-aead-tag-verification](/docs/security/plugin-node-security/rules/require-aead-tag-verification): Require AEAD decryption to verify the authentication tag (setAuthTag + final)
- [require-dependency-integrity](/docs/security/plugin-node-security/rules/require-dependency-integrity): CWE-494
- [require-secure-credential-storage](/docs/security/plugin-node-security/rules/require-secure-credential-storage): This rule detects a credential written to localStorage, sessionStorage, AsyncStorage or process.env without encryption
- [require-secure-deletion](/docs/security/plugin-node-security/rules/require-secure-deletion): CWE-459
- [require-storage-encryption](/docs/security/plugin-node-security/rules/require-storage-encryption): CWE-312
- [require-stream-error-handler](/docs/security/plugin-node-security/rules/require-stream-error-handler): Require an error listener on streams passed to pipe, which does not forward errors
- [no-browser-api-key-exposure](/docs/security/plugin-openai-security/rules/no-browser-api-key-exposure): Forbid dangerouslyAllowBrowser, which exposes the OpenAI API key to the client
- [no-hardcoded-api-key](/docs/security/plugin-openai-security/rules/no-hardcoded-api-key): Forbid a literal API key in the OpenAI client options
- [no-untrusted-content-in-prompt](/docs/security/plugin-openai-security/rules/no-untrusted-content-in-prompt): Disallow untrusted content built into the OpenAI system prompt
- [check-query-params](/docs/security/plugin-postgresql-security/rules/check-query-params): Ensures the number of placeholders in SQL queries matches the provided parameters.
- [Rules](/docs/security/plugin-postgresql-security/rules): All ESLint security rules provided by eslint-plugin-postgresql-security
- [no-batch-insert-loop](/docs/security/plugin-postgresql-security/rules/no-batch-insert-loop): Prevents INSERT/UPDATE/DELETE queries inside loops (N+1 query anti-pattern).
- [no-floating-query](/docs/security/plugin-postgresql-security/rules/no-floating-query): Ensures query promises are awaited or handled.
- [no-hardcoded-credentials](/docs/security/plugin-postgresql-security/rules/no-hardcoded-credentials): Prevents hardcoded passwords and connection strings in PostgreSQL client initialization.
- [no-insecure-ssl](/docs/security/plugin-postgresql-security/rules/no-insecure-ssl): Prevents disabling SSL certificate validation in PostgreSQL connections.
- [no-missing-client-release](/docs/security/plugin-postgresql-security/rules/no-missing-client-release): Ensures acquired pool clients are released back to the pool.
- [no-select-all](/docs/security/plugin-postgresql-security/rules/no-select-all): Discourages SELECT in favor of explicit column lists.
- [no-transaction-on-pool](/docs/security/plugin-postgresql-security/rules/no-transaction-on-pool): Prevents running transaction commands directly on pool (must use dedicated client).
- [no-unsafe-copy-from](/docs/security/plugin-postgresql-security/rules/no-unsafe-copy-from): Prevents COPY FROM with file paths (should use STDIN for safe client-side data loading).
- [no-unsafe-query](/docs/security/plugin-postgresql-security/rules/no-unsafe-query): SQL injection is one of the most critical security vulnerabilities
- [no-unsafe-search-path](/docs/security/plugin-postgresql-security/rules/no-unsafe-search-path): Prevents dynamic SET searchpath queries that could enable schema hijacking.
- [prefer-pool-query](/docs/security/plugin-postgresql-security/rules/prefer-pool-query): Suggests using pool.query() for single-shot queries instead of manual connect/release.
- [prevent-double-release](/docs/security/plugin-postgresql-security/rules/prevent-double-release): Prevents calling client.release() multiple times on the same client.
- [detect-non-literal-regexp](/docs/security/plugin-secure-coding/rules/detect-non-literal-regexp): Detects RegExp(variable), which might allow an attacker to DOS your server with a long-running regular expression
- [detect-object-injection](/docs/security/plugin-secure-coding/rules/detect-object-injection): Detects variable[key] as a left- or right-hand assignment operand (prototype pollution)
- [detect-weak-password-validation](/docs/security/plugin-secure-coding/rules/detect-weak-password-validation): Detects weak password length requirements (less than 8 characters) in validation code.
- [Rules](/docs/security/plugin-secure-coding/rules): All ESLint security rules provided by eslint-plugin-secure-coding
- [no-bidi-characters](/docs/security/plugin-secure-coding/rules/no-bidi-characters): Disallows Unicode bidirectional control characters, which let source render differently than it compiles (Trojan Source, CWE-1007)
- [no-directive-injection](/docs/security/plugin-secure-coding/rules/no-directive-injection): Detects directive injection vulnerabilities in template systems
- [no-electron-security-issues](/docs/security/plugin-secure-coding/rules/no-electron-security-issues): Detects Electron security vulnerabilities and insecure configurations
- [no-fail-open-auth](/docs/security/plugin-secure-coding/rules/no-fail-open-auth): Detects authentication and authorization checks whose catch block fails open
- [no-format-string-injection](/docs/security/plugin-secure-coding/rules/no-format-string-injection): Detects format string injection vulnerabilities
- [no-graphql-injection](/docs/security/plugin-secure-coding/rules/no-graphql-injection): Detects GraphQL injection vulnerabilities and DoS attacks
- [no-hardcoded-credentials](/docs/security/plugin-secure-coding/rules/no-hardcoded-credentials): Detects hardcoded passwords, API keys, tokens, and other sensitive credentials in source code
- [no-hardcoded-session-tokens](/docs/security/plugin-secure-coding/rules/no-hardcoded-session-tokens): This rule detects hardcoded JWT tokens (starting with eyJ), Bearer tokens, and session identifiers
- [no-homoglyph-identifiers](/docs/security/plugin-secure-coding/rules/no-homoglyph-identifiers): Detects homoglyph identifiers and invisible characters that hide what the code actually does
- [no-improper-sanitization](/docs/security/plugin-secure-coding/rules/no-improper-sanitization): Detects improper sanitization of user input
- [no-improper-type-validation](/docs/security/plugin-secure-coding/rules/no-improper-type-validation): Detects improper type validation in user input handling
- [no-insecure-comparison](/docs/security/plugin-secure-coding/rules/no-insecure-comparison): Detects insecure comparison operators (==, !=) that can lead to type coercion vulnerabilities
- [no-ldap-injection](/docs/security/plugin-secure-coding/rules/no-ldap-injection): Detects LDAP injection vulnerabilities
- [no-log-injection](/docs/security/plugin-secure-coding/rules/no-log-injection): Detects request data concatenated into a log message, which lets an attacker forge log records
- [no-missing-authentication](/docs/security/plugin-secure-coding/rules/no-missing-authentication): CWE-287
- [no-pii-in-logs](/docs/security/plugin-secure-coding/rules/no-pii-in-logs): Prevent personally identifiable information (PII) — emails, SSNs, credit cards, phone numbers — from reaching console / logger output.
- [no-privilege-escalation](/docs/security/plugin-secure-coding/rules/no-privilege-escalation): Detects potential privilege escalation vulnerabilities where user input is used to assign roles or permissions withou...
- [no-redos-vulnerable-regex](/docs/security/plugin-secure-coding/rules/no-redos-vulnerable-regex): ESLint Rule: no-redos-vulnerable-regex
- [no-sensitive-data-exposure](/docs/security/plugin-secure-coding/rules/no-sensitive-data-exposure): ESLint Rule: no-sensitive-data-exposure
- [no-sql-injection](/docs/security/plugin-secure-coding/rules/no-sql-injection): Detects SQL statements built from attacker-controlled input in files that import no SQL driver
- [no-template-injection](/docs/security/plugin-secure-coding/rules/no-template-injection): Disallow dynamic strings as template arguments to server-side template engines (CWE-94)
- [no-unchecked-loop-condition](/docs/security/plugin-secure-coding/rules/no-unchecked-loop-condition): Detects unchecked loop conditions that could cause DoS
- [no-unlimited-resource-allocation](/docs/security/plugin-secure-coding/rules/no-unlimited-resource-allocation): Detects unlimited resource allocation that could cause DoS
- [no-unsafe-deserialization](/docs/security/plugin-secure-coding/rules/no-unsafe-deserialization): Detects unsafe deserialization of untrusted data
- [no-unsafe-regex-construction](/docs/security/plugin-secure-coding/rules/no-unsafe-regex-construction): ESLint Rule: no-unsafe-regex-construction with LLM-optimized suggestions and auto-fix capabilities
- [no-weak-password-recovery](/docs/security/plugin-secure-coding/rules/no-weak-password-recovery): ESLint Rule: no-weak-password-recovery with LLM-optimized suggestions and auto-fix capabilities
- [no-xpath-injection](/docs/security/plugin-secure-coding/rules/no-xpath-injection): Detects XPath injection vulnerabilities
- [no-xxe-injection](/docs/security/plugin-secure-coding/rules/no-xxe-injection): Detects XML External Entity (XXE) injection vulnerabilities
- [require-backend-authorization](/docs/security/plugin-secure-coding/rules/require-backend-authorization): CWE-602
- [require-secure-defaults](/docs/security/plugin-secure-coding/rules/require-secure-defaults): CWE-1188
- [no-mass-assignment](/docs/security/plugin-prisma-security/rules/no-mass-assignment): Disallow writing an inbound request object straight to the database through Prisma, which lets the caller set every column the model exposes.
- [no-raw-identifier-interpolation](/docs/security/plugin-prisma-security/rules/no-raw-identifier-interpolation): Disallow interpolating table, column or sort identifiers into a Prisma $queryRaw / $executeRaw template, where bind parameters cannot reach them.
- [no-unsafe-query](/docs/security/plugin-prisma-security/rules/no-unsafe-query): Prevent SQL injection by disallowing string concatenation or interpolated template literals in Prisma raw queries.
- [no-unscoped-mutation](/docs/security/plugin-prisma-security/rules/no-unscoped-mutation): Require a `where` filter on Prisma bulk mutations, so deleteMany and updateMany cannot rewrite or delete every row in the table.
- [no-hardcoded-credentials](/docs/security/plugin-sequelize-security/rules/no-hardcoded-credentials): Disallow literal database passwords in Sequelize connection configuration, including credentials embedded in a connection URL.
- [no-mass-assignment](/docs/security/plugin-sequelize-security/rules/no-mass-assignment): Disallow writing an inbound request object straight to the database through Sequelize, which lets the caller set every column the model exposes.
- [no-unsafe-query](/docs/security/plugin-sequelize-security/rules/no-unsafe-query): Detects SQL injection in raw Sequelize queries built with string concatenation or template literals
- [require-tls](/docs/security/plugin-sequelize-security/rules/require-tls): Require TLS on Sequelize connections, so queries and credentials are not sent in cleartext and the server is authenticated.
- [no-unsafe-query](/docs/security/plugin-sqlite-security/rules/no-unsafe-query): Prevent SQL injection by disallowing string concatenation or interpolated template literals in SQLite statements.
- [no-dynamic-rpc-name](/docs/security/plugin-supabase-security/rules/no-dynamic-rpc-name): Call `.rpc()` with a literal function name
- [no-public-storage-bucket](/docs/security/plugin-supabase-security/rules/no-public-storage-bucket): Do not create a Supabase storage bucket as public
- [no-service-role-key-in-client](/docs/security/plugin-supabase-security/rules/no-service-role-key-in-client): Keep the Supabase service_role key out of client code
- [require-auth-error-check](/docs/security/plugin-supabase-security/rules/require-auth-error-check): Read `error` from a Supabase auth result
- [no-hardcoded-credentials](/docs/security/plugin-typeorm-security/rules/no-hardcoded-credentials): Disallow literal database passwords in TypeORM connection configuration, including credentials embedded in a connection URL.
- [no-mass-assignment](/docs/security/plugin-typeorm-security/rules/no-mass-assignment): Disallow writing an inbound request object straight to the database through TypeORM, which lets the caller set every column the model exposes.
- [no-unsafe-query](/docs/security/plugin-typeorm-security/rules/no-unsafe-query): Prevent SQL injection by disallowing string concatenation or interpolated template literals in TypeORM raw queries.
- [require-tls](/docs/security/plugin-typeorm-security/rules/require-tls): Require TLS on TypeORM DataSource connections, so queries and credentials are not sent in cleartext and the server is authenticated.
- [Rules](/docs/security/plugin-vercel-ai-security/rules): All ESLint security rules provided by eslint-plugin-vercel-ai-security
- [no-dynamic-system-prompt](/docs/security/plugin-vercel-ai-security/rules/no-dynamic-system-prompt): This rule identifies code patterns where system prompts contain dynamic or user-controlled content
- [no-hardcoded-api-keys](/docs/security/plugin-vercel-ai-security/rules/no-hardcoded-api-keys): This rule identifies hardcoded API keys, tokens, and secrets in your codebase that are used with AI SDK providers
- [no-sensitive-in-prompt](/docs/security/plugin-vercel-ai-security/rules/no-sensitive-in-prompt): This rule identifies code patterns where sensitive data like passwords, API keys, tokens, or personally identifiable ...
- [no-system-prompt-leak](/docs/security/plugin-vercel-ai-security/rules/no-system-prompt-leak): This rule identifies code patterns where system prompts or AI instructions are returned in API responses, logged, or ...
- [no-training-data-exposure](/docs/security/plugin-vercel-ai-security/rules/no-training-data-exposure): This rule identifies code patterns where user data might be sent to LLM training endpoints or when training data coll...
- [no-unsafe-output-handling](/docs/security/plugin-vercel-ai-security/rules/no-unsafe-output-handling): This rule identifies code patterns where AI-generated output is passed directly to dangerous functions that can execu...
- [require-abort-signal](/docs/security/plugin-vercel-ai-security/rules/require-abort-signal): This rule identifies streaming AI SDK calls (streamText, streamObject) that don't include an AbortSignal for cancella...
- [require-audit-logging](/docs/security/plugin-vercel-ai-security/rules/require-audit-logging): This rule identifies AI SDK calls that aren't preceded by logging statements
- [require-embedding-validation](/docs/security/plugin-vercel-ai-security/rules/require-embedding-validation): This rule identifies code patterns where embeddings are stored in vector databases without validation.
- [require-error-handling](/docs/security/plugin-vercel-ai-security/rules/require-error-handling): This rule identifies AI SDK calls that aren't wrapped in try-catch blocks
- [require-max-steps](/docs/security/plugin-vercel-ai-security/rules/require-max-steps): This rule identifies AI SDK calls that use tools but don't specify a step limit (maxSteps or stopWhen)
- [require-max-tokens](/docs/security/plugin-vercel-ai-security/rules/require-max-tokens): This rule identifies AI SDK calls that don't specify a token limit (maxTokens or maxOutputTokens)
- [require-output-filtering](/docs/security/plugin-vercel-ai-security/rules/require-output-filtering): This rule identifies tool execute functions that return raw data from data sources (databases, APIs, file systems) wi...
- [require-output-validation](/docs/security/plugin-vercel-ai-security/rules/require-output-validation): This rule identifies code patterns where AI-generated output is displayed to users without validation or fact-checking.
- [require-rag-content-validation](/docs/security/plugin-vercel-ai-security/rules/require-rag-content-validation): This rule identifies code patterns where content retrieved from vector stores or document retrieval systems is used d...
- [require-request-timeout](/docs/security/plugin-vercel-ai-security/rules/require-request-timeout): This rule identifies AI SDK calls that don't have timeout or abort signal configuration.
- [require-tool-confirmation](/docs/security/plugin-vercel-ai-security/rules/require-tool-confirmation): This rule identifies destructive tools (delete, transfer, execute, etc.) that don't require human confirmation before...
- [require-tool-schema](/docs/security/plugin-vercel-ai-security/rules/require-tool-schema): Get weather
- [require-validated-prompt](/docs/security/plugin-vercel-ai-security/rules/require-validated-prompt): This rule identifies code patterns where user-controlled input is passed directly to AI prompts without validation or...