oxlint-no-secrets

An oxlint plugin that ports secret detection rules from eslint-plugin-no-secrets.

Installation

npm install --save-dev oxlint-no-secrets

Usage

Add to your .oxlintrc.json:

{
  "jsPlugins": [{ "name": "no-secrets", "specifier": "oxlint-no-secrets" }],
  "rules": {
    "no-secrets/no-secrets": ["error", { "tolerance": 4, "ignoreModules": true }],
    "no-secrets/no-pattern-match": ["warn", { "patterns": { "JWT": "ey[A-Za-z0-9-_]+\\.[A-Za-z0-9-_]+" } }]
  }
}

Rules

| Rule | Description | |---|---| | no-secrets | Detect hardcoded secrets via Shannon entropy and built-in regex patterns | | no-pattern-match | Flag strings matching user-supplied regex patterns |

no-secrets Options

| Option | Type | Default | Description | |---|---|---|---| | tolerance | number | 4 | Entropy threshold — strings above this are flagged | | additionalRegexes | Record<string, string> | {} | Extra name→regex patterns to check | | ignoreContent | string[] | [] | Skip strings whose content matches any of these regexes | | ignoreIdentifiers | string[] | [] | Skip strings assigned to these variable/property names | | ignoreModules | boolean | false | Skip string arguments to require() and import() |

Built-in Patterns

The no-secrets rule checks for: AWS Access Key IDs, AWS Secret Access Keys, Slack Tokens, GitHub Tokens, Stripe Live Keys, Twilio API Keys, Generic Secret/Password/API Key/Token assignments, and PEM private key headers (RSA, SSH, PGP).

no-pattern-match Options

| Option | Type | Description | |---|---|---| | patterns | Record<string, string> | Name→regex map; reports any string matching any pattern |

License

MIT