rules-couchdb

CouchDB emit() in a map function detected. Ensure the emit key and value do not expose sensitive document fields unnecessarily — emitted data is queryable by any user with read access to the design document's view.

CouchDB CORS configured with wildcard origins ('*'). Combined with require_valid_user=false or cookie-based auth, this allows any website to make cross-origin requests to your CouchDB instance and read or modify all databases. Restrict CORS to your exact application origin.

eval() or new Function() in a CouchDB design document map/reduce function. Design document code runs inside CouchDB's embedded JavaScript engine with access to all documents. Code injection here can leak all database content or corrupt views. Design docs should use pure, data-driven map/reduce functions with no eval.

db.view() is the legacy CouchDB 1.x Nano/Cradle API. Modern Nano (^10) uses db.view(designName, viewName, params). Verify you are using the current maintained API for your CouchDB version.

Hardcoded CouchDB credentials detected (CWE-798). Credentials in source code are exposed via version control history. Store credentials in environment variables (COUCHDB_USER / COUCHDB_PASSWORD) or a secrets manager and inject at runtime.

CouchDB require_valid_user = false permits unauthenticated access to the database. CouchDB ships in 'Admin Party' mode by default — all requests are admin requests until a user is created. Always set '[couch_httpd_auth] require_valid_user = true' in production and create at least one admin user before exposing the port.