Security

@scruple/security checks security-sensitive code using evidence visible in one file. It reports nothing when the rule cannot see enough about trust boundaries or helper behavior.

pnpm add -D @scruple/security

import { defineConfig } from "@scruple/core";
import { security } from "@scruple/security";

export default defineConfig({
  parser,
  provider,
  plugins: { security: security() },
  rules: { "security/no-user-controlled-authorization": "warn" },
});

Rule	Checks
security/no-user-controlled-authorization	Authorization based on attacker-controlled authority claims
security/no-sensitive-data-exposure	Sensitive data sent through output sinks
security/no-untrusted-command-execution	Request data reaching command or code execution
security/no-untrusted-mass-assignment	Request objects assigned or persisted wholesale
security/no-unsafe-redirect	Request-controlled redirect targets

All rules accept threshold, defaulting to { warning: 0.9, error: 0.97 }, and minConfidence, defaulting to 0.75.

security/no-user-controlled-authorization

Reviews visible request boundaries or authorization operations. It reports when code grants access or assigns authority based on client-controlled roles, permissions, scopes, ownership, tenant, or admin claims without validation against a trusted source. Resource IDs alone are not authority claims.

security/no-sensitive-data-exposure

Reviews recognized response, render, file-transfer, and redirect sinks. Logging belongs to observability/no-sensitive-logs. It traces visible projection, masking, redaction, and sanitization before output.

security/no-untrusted-command-execution

Reviews direct same-function flows from request data to command, shell, or dynamic-code execution. Fixed executables with visibly allowlisted arguments and shell parsing disabled are accepted.

security/no-untrusted-mass-assignment

Reviews direct request-object or spread flows into persistence and assignment sinks. Explicit field projection or a visible allowlisting schema is accepted.

security/no-unsafe-redirect

Reviews request-controlled redirects. Fixed local paths and parsed URLs compared against an exact visible origin allowlist are accepted; hidden validators cause abstention.

rules: { "security/no-sensitive-data-exposure": ["warn", { minConfidence: 0.8 }] }