Weak Password Policy
Description
Detects password validation that lacks proper complexity requirements, making accounts vulnerable to brute force attacks.
What Shoulder detects
How to fix
Implement strong password requirements:
```javascript
// ✅ SAFE - Strong password policy
function validatePassword(password) {
if (password.length < 12) {
throw new Error('Password must be at least 12 characters');
}
const hasUppercase = /[A-Z]/.test(password);
const hasLowercase = /[a-z]/.test(password);
const hasDigit = /\d/.test(password);
const hasSpecial = /[!@#$%^&*(),.?":{}|<>]/.test(password);
if (!hasUppercase || !hasLowercase || !hasDigit || !hasSpecial) {
throw new Error(
'Password must contain uppercase, lowercase, digit, and special character'
);
}
return true;
}
```
Applies to
Languages
Frameworks
express
fastify
nextjs
nodejs
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=javascript-weak-password-policy .