SecurityData protection

security/no-sensitive-data-exposure

Response, render, file-transfer, and redirect sinks should expose only visibly projected, masked, redacted, or sanitized sensitive values.

responsesprivacyredaction

01 Examples

TypeScript

res.json({ user, passwordHash: user.passwordHash });

Finding

Disallow sensitive data sent through output sinks.

02 Enable it

Setup

Install the package, register its plugin factory, then enable the rule.

pnpm add -D @scruple/security

In scruple.config.ts, register the factory under the security namespace used by the rule ID.

import { security } from "@scruple/security";

plugins: {
  "security": security(),
},

"security/no-sensitive-data-exposure": "warn"