JavaScript-Doctor

JS Doctor is a command-line security scanner for JavaScript and TypeScript projects, designed especially for code generated or accelerated by AI coding assistants. The idea is that AI-generated code can introduce security vulnerabilities without the developer noticing, and JS Doctor provides a fast way to check for common issues before shipping.

Running it against a project folder produces plain-English findings that each include a diagnosis (what the problem is), a risk assessment, a recommended treatment, a severity level, a confidence level, and the exact file and line where the issue was found.

The scanner checks for a broad range of security problems: exposed secrets, missing authorization checks on update and delete operations, unsafe HTML rendering that could enable script injection, runtime code execution, command injection, SQL injection, server-side request forgery (SSRF), open redirects, path traversal, weak or insecure cryptography, permissive CORS settings, disabled TLS verification, insecure cookie configuration, prototype pollution, unsafe deserialization, and JWT tokens decoded without signature verification. It can also check third-party npm dependencies against the npm audit database and the OSV.dev vulnerability advisory database.

A watch mode rescans files as they change. JSON output is available for integration into other tools. By default the tool exits with a non-zero code when high or critical issues are found, making it suitable for CI pipelines. The rule system is file-based — each rule pack is a JSON or YAML file — so new checks can be added without modifying the core engine.

The project is written in TypeScript and ships as an npm package.