.eslintrc.js

const hasSecurityPlugin = (() => {
  try {
    require.resolve('eslint-plugin-security');
    return true;
  } catch (error) {
    return false;
  }
})();

module.exports = {
  env: {
    node: true,
    es2021: true,
    jest: true,
  },
  extends: ['eslint:recommended'],
  plugins: ['no-secrets', ...(hasSecurityPlugin ? ['security'] : [])],
  parserOptions: {
    ecmaVersion: 12,
  },
  rules: {
    // Security rules
    'no-secrets/no-secrets': 'error',
    ...(hasSecurityPlugin ? {
      'security/detect-object-injection': 'warn',
      'security/detect-non-literal-regexp': 'warn',
      'security/detect-unsafe-regex': 'error',
      'security/detect-buffer-noassert': 'error',
      'security/detect-child-process': 'warn',
      'security/detect-disable-mustache-escape': 'error',
      'security/detect-eval-with-expression': 'error',
      'security/detect-no-csrf-before-method-override': 'error',
      'security/detect-non-literal-fs-filename': 'warn',
      'security/detect-non-literal-require': 'warn',
      'security/detect-possible-timing-attacks': 'warn',
      'security/detect-pseudoRandomBytes': 'error',
    } : {}),
    
    // Code quality rules that affect security
    'no-eval': 'error',
    'no-implied-eval': 'error',
    'no-new-func': 'error',
    'no-console': 'off', // We use structured logging
  },
  ignorePatterns: [
    'node_modules/',
    'data/',
    'logs/',
    'coverage/',
  ],
};