Rules
Deterministic checks run before model review.
Active Rules
8errorlexical
baseline-no-eval
eval() executes arbitrary code — a code-injection vector. Use a parser or JSON.parse for data.
errorlexical
baseline-no-new-function
new Function() compiles arbitrary code at runtime — equivalent to eval(). Use a static function.
warninglexical
baseline-hardcoded-secret
Possible hardcoded secret — API key or token literal in source. Move to an environment variable.
errorlexical
baseline-disabled-tls
TLS verification disabled (rejectUnauthorized: false) — enables MITM attacks. Never disable in production.
warninglexical
baseline-dangerous-innerhtml
innerHTML assignment can introduce XSS if the value is user-controlled. Use textContent or sanitize.
warninglexical
baseline-sql-string-concat
SQL query built via string concatenation — a SQL-injection vector. Use parameterized queries.
warninglexical
baseline-debugger-statement
debugger statement left in source — will pause execution in devtools. Remove before shipping.
infolexical
baseline-console-in-prod-path
console output in what may be a production code path. Consider a proper logger with levels.