Skip to content

Docs / Reference

Rules

All 16 rules in Lintsure v0.1.1, the controls each one maps to, and how to fix what it finds.

Beta. Every rule below is marked mappedBy: beta until a qualified compliance professional reviews its control mapping. The rule logic and tests are final for v0.1.1.

At a glance

FrameworkRules that map to it
GDPR10
SOC 212
ISO 2700111
EU AI Act5

Line rules read one line at a time. File rules look at a whole file, for example "an AI call in a file that never logs".

All rules

pii.logged Personal data written to logs

Gap · high severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • GDPR Art. 32 Security of processing
  • SOC 2 CC6.1 Logical access security
  • ISO 27001 A.8.11 Data masking

Fix: Mask or remove the personal field before logging, for example mask(user.email).

Auditor note: Logs are copied to many places and kept for a long time. Personal data in them is hard to find and delete.

secret.in-source Secret or private key committed to source

Gap · high severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py .env .json .yaml .yml .toml

  • SOC 2 CC6.1 Logical access security
  • ISO 27001 A.8.24 Use of cryptography
  • GDPR Art. 32 Security of processing

Fix: Move the secret to an environment variable or secrets manager, then rotate it: it is already in your git history.

Auditor note: Anyone with read access to the repo, or a leaked copy of it, can use this key.

transport.plain-http Data sent over plain HTTP

Partial · medium severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • SOC 2 CC6.7 Transmission of data
  • ISO 27001 A.8.20 Network security
  • GDPR Art. 32 Security of processing

Fix: Use https:// for every external call.

Auditor note: Marked Partial: the call may carry no sensitive data. Confirm, then switch to HTTPS anyway.

pii.to-analytics Personal data sent to an analytics or tracking tool

Gap · high severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • GDPR Art. 5(1)(c) Data minimisation
  • GDPR Art. 28 Processors
  • SOC 2 P6.1 Disclosure to third parties
  • ISO 27001 A.5.34 Privacy and protection of PII

Fix: Send an internal user ID instead of the email or name, and list the tool as a processor.

Auditor note: Analytics vendors keep what you send them. Personal data there needs a lawful basis and a processing agreement.

pii.in-url Personal data or tokens in a URL

Partial · medium severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • GDPR Art. 32 Security of processing
  • SOC 2 CC6.1 Logical access security
  • ISO 27001 A.8.11 Data masking

Fix: Send it in the request body or a header instead of the query string.

Auditor note: URLs end up in server logs, browser history and referrer headers. Marked Partial: confirm the value is real personal data.

crypto.weak-password-hash Passwords hashed with a weak or fast algorithm

Gap · high severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • GDPR Art. 32 Security of processing
  • SOC 2 CC6.1 Logical access security
  • ISO 27001 A.8.24 Use of cryptography

Fix: Use a password hashing function made for it: argon2id, scrypt or bcrypt.

Auditor note: MD5 and SHA-1 are fast, so leaked hashes can be cracked quickly.

transport.tls-verify-off TLS certificate checks turned off

Gap · high severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py .env

  • SOC 2 CC6.7 Transmission of data
  • ISO 27001 A.8.20 Network security
  • GDPR Art. 32 Security of processing

Fix: Remove the override and trust a proper certificate. For self-signed certs in tests, scope it to the test only.

Auditor note: With checks off, anyone on the network path can read or change the traffic.

sql.string-built SQL query built from strings

Gap · high severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • SOC 2 CC7.1 Detect and fix vulnerabilities
  • ISO 27001 A.8.28 Secure coding
  • GDPR Art. 32 Security of processing

Fix: Use parameterized queries or your ORM's query builder.

Auditor note: String-built SQL can let an attacker read or change your data (SQL injection).

cors.any-origin API open to requests from any website

Partial · medium severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • SOC 2 CC6.6 Boundary protection
  • ISO 27001 A.8.20 Network security

Fix: List the exact origins that may call the API.

Auditor note: Marked Partial: fine for a public, read-only API. Risky when the API uses cookies or returns user data.

session.cookie-insecure Session cookie without Secure or HttpOnly

Partial · medium severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • SOC 2 CC6.1 Logical access security
  • ISO 27001 A.8.5 Secure authentication

Fix: Set secure: true and httpOnly: true on session cookies.

Auditor note: Without these flags a session cookie can be read by scripts or sent over plain HTTP. Marked Partial: confirm it is a session cookie.

config.debug-on Debug mode switched on in code

Partial · medium severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • SOC 2 CC8.1 Change management
  • ISO 27001 A.8.9 Configuration management

Fix: Read debug from an environment variable that is off in production.

Auditor note: Debug pages can show stack traces, settings and secrets. Marked Partial: it may only run locally.

ai.automated-decision AI makes a decision about a person with no human check in the code

Partial · high severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • EU AI Act Art. 14 Human oversight
  • GDPR Art. 22 Automated individual decisions

Fix: Route the result to a review step where a person can confirm or override it, and record who did.

Auditor note: Credit, hiring, admission and similar decisions about people are high-risk under Annex III. Marked Partial: a review step may exist elsewhere.

ai.call-not-logged AI call with no record kept in this file

Partial · medium severity · file rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • EU AI Act Art. 12 Record-keeping
  • SOC 2 CC7.2 Monitoring of system components

Fix: Log each AI call: time, model and version, input reference and output, without raw personal data.

Auditor note: High-risk systems must keep logs that let you trace what the AI did. Marked Partial: logging may happen in another file.

ai.hides-being-ai AI told to hide that it is an AI

Gap · high severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py .md .txt .yaml .yml .json

  • EU AI Act Art. 50(1) Transparency for AI interacting with people

Fix: Remove the instruction and tell users they are talking to an AI.

Auditor note: People must be told when they interact with an AI system, unless it is obvious.

ai.synthetic-media AI-generated images, audio or video

Partial · medium severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • EU AI Act Art. 50(2) Marking AI-generated content

Fix: Mark generated media as AI-made in a machine-readable way (for example C2PA metadata) and label deepfakes for viewers.

Auditor note: Marked Partial: you may already add marking after this call. Confirm it does.

ai.emotion-or-biometric Emotion recognition or biometric categorisation

Gap · high severity · line rule · reads .ts .tsx .js .jsx .mjs .cjs .py

  • EU AI Act Art. 5(1)(f) Prohibited: emotion recognition at work and in education
  • EU AI Act Annex III(1) High-risk: biometrics
  • GDPR Art. 9 Special categories of personal data

Fix: Check whether this use is banned or high-risk before shipping. Remove it if it infers emotions of staff or students.

Auditor note: Some uses are banned outright since February 2025. Others are high-risk. This needs a human decision, not a code fix.

Source: packages/core/src/rules.

Lintsure is a readiness tool, not an audit or legal advice. Results cover code only; a qualified person should review them. Disclaimer