$ codelinters check ./src --strict

Lint rules that fit the codebase you actually have.

Most linters ship one giant rulebook and make you fight it. CodeLinters starts from your existing code, flags real risk, and lets your team tune severity instead of arguing about style.

Get Started Free Read the Docs →

1// api/orders.ts

14await db.query(sql) // unsanitized input — no-unsafe-sql

15 return res.json(rows)

22export const tmp // no-unused-exports (warn)

24✓ 118 files checked · 1 error · 1 warning

// rule engine

Rules with judgment, not just pattern matching

Every rule ships with a default severity, but nothing is locked. Downgrade a rule to a warning, scope it to a folder, or turn it off for legacy code without touching the rest of your config.

RULE · no-unsafe-sql

Unsanitized query input

Flags raw string interpolation into SQL calls before it becomes a security review finding.

error

RULE · no-unused-exports

Dead export detection

Finds exported values nothing in the repo imports, across your whole workspace, not just one file.

warning

RULE · consistent-error-shape

Uniform error handling

Makes sure every thrown error matches the shape your API layer expects downstream.

info

RULE · no-async-in-loop

Sequential awaits in loops

Catches accidental serial requests where a batched call was clearly intended.

warning

RULE · no-secret-literal

Hardcoded credentials

Scans string literals for key-shaped patterns before they reach a commit history.

error

RULE · explicit-return-type

Typed function boundaries

Optional rule for teams who want every exported function's return type written out.

info

// setup

One config file, plain to read

No plugin soup. Extend a base profile, override what your team disagrees with, done.

base

react

node-api

monorepo

legacy-relaxed

// codelinters.config.js
export default {
  extends: "base",
  rules: {
    "no-unsafe-sql": "error",
    "no-unused-exports": "warn",
    "explicit-return-type": "off"
  }
}