ESLint

• Category: sast (JavaScript / TypeScript)
• Fingerprint: rule-file-surrounding-3-lines-v1 — ESLint's own partialFingerprints are preserved under scanner/eslint/* by RewriteESLintSARIF.
• License: MIT

sast:
  eslint: { enabled: true }

When to enable

Any JS/TS project. Combine with the security plugin for runtime-safety checks (prototype pollution, open redirect, …).

Common false positives

• no-unused-vars on intentionally-prefixed _arg names — configure the lint rule to accept the underscore prefix rather than dismissing one-by-one.