rules-cypress

cy.server() was removed in Cypress 12. Use cy.intercept() to stub and spy on network requests instead.

RISK: cy.exec() with string concatenation or template-literal interpolation of test variables is command injection — an attacker-controlled fixture value can run arbitrary shell commands on the test runner host. FIX: Pass only literal command strings to cy.exec(); parameterize via a safe task in cypress/support/commands.ts instead.

cy.exec() runs shell commands on the Cypress test runner host. Review the command to ensure it does not interpolate any test fixture or user-controlled value (command injection risk). Confirm the write is intentional.

RISK: Hardcoded credentials in cy.request() calls are committed to version control and visible in CI logs. FIX: Store credentials in Cypress environment variables (cypress.env.json / CYPRESS_* env vars) and reference them via Cypress.env('MY_SECRET').

RISK: eval() in test code can be exploited if fixture data or API responses containing attacker-controlled strings reach the eval call, enabling XSS/RCE in the test runner. FIX: Use Cypress commands and assertions instead of eval; parse structured data with JSON.parse().