Security Rules Reference
All rules detected by VeeStack analysis engine
🔒 Security Rules
Code Injection via eval()
Use of eval() with user input can lead to code injection.
Fix: Use JSON.parse() or safer alternatives.
SQL Injection Risk
String concatenation in SQL queries allows injection.
Fix: Use parameterized queries or ORM.
Hardcoded Secret
API keys, passwords, or tokens found in code.
Fix: Use environment variables or secret managers.
Insecure Dependency
Package with known vulnerability detected.
Fix: Update to patched version or find alternative.
Missing Input Validation
User input used without validation.
Fix: Add validation with libraries like Zod or Joi.
Prototype Pollution
Object merge with user-controlled keys.
Fix: Use Object.create(null) or validate keys.
XSS Vulnerability
Unescaped user input rendered in HTML.
Fix: Use proper escaping or sanitization.
Insecure Random Number
Math.random() used for security purposes.
Fix: Use crypto.randomBytes() or Web Crypto API.
🏗️ Architecture Rules
Circular Dependency
Circular import detected between modules.
Fix: Refactor to break the cycle.
Deep Nesting
Directory depth exceeds 5 levels.
Fix: Flatten structure or use feature folders.
Large File
File exceeds 500 lines.
Fix: Split into smaller modules.
Missing TypeScript
JavaScript files in TypeScript project.
Fix: Migrate to TypeScript for type safety.
Unused Dependency
Package listed but not imported.
Fix: Remove from package.json.
Suppressing Rules
To suppress a specific rule on a line: