⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides General secure coding practices and OWASP compliance for JavaScript/TypeScript.

• Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
• How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
• What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

• To check out the guide, visit eslint.interlace.tools. 📚

npm install eslint-plugin-secure-coding --save-dev

Add to your eslint.config.mjs — one line activates 16 security rules:

import securePlugin from 'eslint-plugin-secure-coding';

export default [
  // Balanced: catches critical issues as errors, lower-confidence rules as warnings
  ...securePlugin.configs.recommended,

  // Zero-tolerance: same 16 rules, all promoted to error (good for CI gates)
  // ...securePlugin.configs['recommended-strict'],
];

Or if you use a legacy .eslintrc.json:

{
  "extends": ["plugin:secure-coding/recommended"]
}

Using recommended already? Extend your coverage with domain-specific plugins: eslint-plugin-node-security (crypto, eval, buffer) · eslint-plugin-jwt-security (JWT auth) · eslint-plugin-express-security (Express middleware)

Benchmarks vs competitors (CWE-798 ground truth)

no-hardcoded-credentials is part of the ILB-Flagship benchmark suite. On the labeled CWE-798 fixture set (Juliet-style: 2 vulnerable + 2 safe files, ground-truthed):

| Rule | Precision | Recall | F1 | | :--- | ---: | ---: | ---: | | secure-coding/no-hardcoded-credentials (ours) | 100% | 100% | 1.00 | | eslint-plugin-no-secrets/no-secrets | 100% | 50% | 0.67 |

The competitor's entropy-only detection catches the high-entropy API-key shape but misses the 15-character literal password assigned to password:. Our context-gated detection (structural patterns + credential-named-variable check + context-positive path) catches both for the right reasons.

On real OSS (vercel/ai), the competitor reports ~380 more findings than us. Those 380 are not catches we missed — they're entropy false-positives on TypeScript type literals ('experimental_onLanguageModelCallStart'), error class names ('AI_ToolCallNotFoundForApprovalError'), and documentation URLs. Sampling confirmed zero are actual credentials. The corpus number is the right one to weigh; the OSS finding-count is a noise metric.

⚙️ Configuration Presets

| Preset | Description | | :-------------------- | :-------------------------------------------------------------- | | recommended | 16 core rules — critical issues as error, lower-confidence as warn | | recommended-strict | Same 16 rules as recommended, all promoted to error — for CI gates | | strict | All rules as error — maximum coverage including experimental rules | | owasp-top-10 | OWASP Top 10 Web 2021 compliance focused | | owasp-mobile-top-10 | OWASP Mobile Top 10 2024 compliance focused |

📦 Compatibility

| Package | Version | | :--- | :--- | | ESLint | ^8.40.0 \|\| ^9.0.0 \|\| ^10.0.0 | | Node.js | >=18.0.0 |

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

| Icon | Description | | :---: | :--- | | 💼 | Recommended: Included in the recommended preset. | | ⚠️ | Warns: Set to warn in recommended preset. | | 🔧 | Auto-fixable: Automatically fixable by the --fix CLI option. | | 💡 | Suggestions: Providing code suggestions in IDE. | | 🚫 | Deprecated: This rule is deprecated. | | 🟢 | Type-unaware: AST-only, runs in oxlint JS-plugin tier. | | 🟡 | Type-aware (refining): pure-AST primary path; types refine precision. | | 🟠 | Type-aware (graceful): requires TS program; silent without it. |

| Rule | CWE | OWASP | CVSS | Description | 🧠 | 💼 | ⚠️ | 🔧 | 💡 | 🚫 | | :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: | :---: | | detect-non-literal-regexp | CWE-400 | | | Detects RegExp(variable), which might allow an attacker to DOS your server with a long-running regular expr… | 🟢 | | | | | | | detect-object-injection | CWE-915 | | | Detects variable[key] as a left- or right-hand assignment operand (prototype pollution) | 🟡 | | | | | | | detect-weak-password-validation | CWE-521 | A07:2021 | | Detects weak password length requirements (less than 8 characters) in validation code. | 🟢 | | | | | | | no-bidi-characters | CWE-1007 | | | Disallows Unicode bidirectional control characters, which let source render differently than it compiles (T… | 🟢 | | | | | | | no-directive-injection | CWE-94 | | | Detects directive injection vulnerabilities in template systems | 🟢 | | | | | | | no-electron-security-issues | CWE-16 | | | Detects Electron security vulnerabilities and insecure configurations | 🟢 | | | | | | | no-fail-open-auth | CWE-636 | A10:2025 | | Detects authentication and authorization checks whose catch block fails open | 🟢 | 💼 | | | | | | no-format-string-injection | CWE-134 | | | Detects format string injection vulnerabilities | 🟢 | | | | | | | no-graphql-injection | CWE-943 | | | Detects GraphQL injection vulnerabilities and DoS attacks | 🟢 | | ⚠️ | | | | | no-hardcoded-credentials | CWE-798 | | | Detects hardcoded passwords, API keys, tokens, and other sensitive credentials in source code | 🟢 | 💼 | | | | | | no-hardcoded-session-tokens | CWE-798 | | | This rule detects hardcoded JWT tokens (starting with eyJ), Bearer tokens, and session identifiers | 🟢 | | | | | | | no-homoglyph-identifiers | CWE-1007 | A08:2021 | | Detects homoglyph identifiers and invisible characters that hide what the code actually does | 🟢 | 💼 | | | | | | no-improper-sanitization | CWE-116 | | | Detects improper sanitization of user input | 🟢 | 💼 | | | | | | no-improper-type-validation | CWE-1287 | | | Detects improper type validation in user input handling | 🟢 | | | | | | | no-insecure-comparison | CWE-697 | | | Detects insecure comparison operators (==, !=) that can lead to type coercion vulnerabilities | 🟢 | | | | | | | no-ldap-injection | CWE-90 | | | Detects LDAP injection vulnerabilities | 🟢 | 💼 | | | | | | no-log-injection | CWE-117 | A09:2021 | | Detects request data concatenated into a log message, which lets an attacker forge log records | 🟢 | 💼 | | | | | | no-missing-authentication | CWE-287 | | | CWE: CWE-287 | 🟢 | | | | | | | no-pii-in-logs | CWE-359 | | | Prevent personally identifiable information (PII) — emails, SSNs, credit cards, phone numbers — from reachi… | 🟢 | | | | 💡 | | | no-privilege-escalation | CWE-269 | | | Detects potential privilege escalation vulnerabilities where user input is used to assign roles or permissi… | 🟢 | | ⚠️ | | | | | no-redos-vulnerable-regex | CWE-400 | | | ESLint Rule: no-redos-vulnerable-regex | 🟢 | 💼 | | | | | | no-sensitive-data-exposure | CWE-532 | | | ESLint Rule: no-sensitive-data-exposure | 🟢 | | ⚠️ | | | | | no-sql-injection | CWE-89 | A03:2021 | | Detects SQL statements built from attacker-controlled input in files that import no SQL driver | 🟢 | 💼 | | | | | | no-template-injection | CWE-94 | A03:2021 | | Disallow dynamic strings as template arguments to server-side template engines (CWE-94) | 🟢 | 💼 | | | | | | no-unchecked-loop-condition | CWE-400 | | | Detects unchecked loop conditions that could cause DoS | 🟢 | | | | | | | no-unlimited-resource-allocation | CWE-770 | | | Detects unlimited resource allocation that could cause DoS | 🟢 | | ⚠️ | | | | | no-unsafe-deserialization | CWE-502 | | | Detects unsafe deserialization of untrusted data | 🟢 | | ⚠️ | | | | | no-unsafe-regex-construction | CWE-400 | | | ESLint Rule: no-unsafe-regex-construction with LLM-optimized suggestions and auto-fix capabilities | 🟢 | 💼 | | | | | | no-weak-password-recovery | CWE-640 | | | ESLint Rule: no-weak-password-recovery with LLM-optimized suggestions and auto-fix capabilities | 🟢 | | ⚠️ | | | | | no-xpath-injection | CWE-643 | | | Detects XPath injection vulnerabilities | 🟢 | 💼 | | | | | | no-xxe-injection | CWE-611 | | | Detects XML External Entity (XXE) injection vulnerabilities | 🟢 | 💼 | | | | | | require-backend-authorization | CWE-602 | | | CWE: CWE-602 | 🟢 | | | | | | | require-secure-defaults | CWE-1188 | | | CWE: CWE-1188 | 🟢 | | | | | |

🔗 Related ESLint Plugins

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

| Plugin | Downloads | Description | | :--- | :---: | :--- | | eslint-plugin-anthropic-security | | Anthropic SDK security. | | eslint-plugin-browser-security | | XSS, DOM security. | | eslint-plugin-drizzle-security | | Drizzle security. | | eslint-plugin-express-security | | Express middleware hardening. | | eslint-plugin-gemini-security | | Google Gemini SDK security. | | eslint-plugin-jwt-security | | Token security. | | eslint-plugin-knex-security | | Knex security. | | eslint-plugin-lambda-security | | AWS Lambda hardening. | | eslint-plugin-mcp-sdk-security | | MCP SDK security. | | eslint-plugin-mongodb-security | | MongoDB injection. | | eslint-plugin-mysql-security | | MySQL security. | | eslint-plugin-nestjs-security | | NestJS framework hardening. | | eslint-plugin-node-security | | Server-side patterns. | | eslint-plugin-openai-security | | OpenAI SDK security. | | eslint-plugin-postgresql-security | | PostgreSQL security. | | eslint-plugin-prisma-security | | Prisma security. | | eslint-plugin-sequelize-security | | Sequelize ORM security. | | eslint-plugin-sqlite-security | | SQLite security. | | eslint-plugin-typeorm-security | | TypeORM security. | | eslint-plugin-vercel-ai-security | | AI SDK security. |

Code quality

| Plugin | Downloads | Description | | :--- | :---: | :--- | | eslint-plugin-conventions | | Team-specific habits and styles. | | eslint-plugin-import-next | | Fast cycle + import-graph analysis. | | eslint-plugin-maintainability | | Cognitive load and clean-code patterns. | | eslint-plugin-modernization | | ESNext migration + syntax evolution. | | eslint-plugin-modularity | | Structural integrity and DDD patterns. | | eslint-plugin-operability | | Production readiness and resource health. | | eslint-plugin-react-a11y | | React accessibility / WCAG. | | eslint-plugin-react-features | | React best practices and optimization. | | eslint-plugin-reliability | | Runtime stability and error safety. |

⭐ Support & follow

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

MIT © Ofri Peretz