BETA Shoulder is in beta — Findings may sometimes be wrong. Your feedback shapes what we fix next. Share feedback

Description

Detects password validation that lacks proper complexity requirements, making accounts vulnerable to brute force attacks.

What Shoulder detects

Password validation at {location} lacks proper complexity requirements

How to fix

Implement strong password requirements:

```javascript
// ✅ SAFE - Strong password policy
function validatePassword(password) {
  if (password.length < 12) {
    throw new Error('Password must be at least 12 characters');
  }

  const hasUppercase = /[A-Z]/.test(password);
  const hasLowercase = /[a-z]/.test(password);
  const hasDigit = /\d/.test(password);
  const hasSpecial = /[!@#$%^&*(),.?":{}|<>]/.test(password);

  if (!hasUppercase || !hasLowercase || !hasDigit || !hasSpecial) {
    throw new Error(
      'Password must contain uppercase, lowercase, digit, and special character'
    );
  }

  return true;
}
```

Applies to

Frameworks

express fastify nextjs nodejs

References

Scan for this issue

Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=javascript-weak-password-policy .

Related rules