rules-drizzle

RISK: db.delete(table) without a .where() clause deletes ALL rows in the table — this is a catastrophic data loss operation equivalent to TRUNCATE. FIX: Always chain .where(eq(table.id, id)) or similar; if a bulk delete is intended, add an explicit comment and a safety check.

RISK: A database connection string with credentials is hardcoded in source code and will be committed to version control, leaking credentials. FIX: Read the connection URL from process.env.DATABASE_URL and store it in a .env file (gitignored) or a secrets manager.

Drizzle sql`` tagged template detected. Ensure all interpolated values are either static Drizzle references (table/column objects) or wrapped with sql.placeholder()/sql.param() — never interpolate raw user input. See drizzle-sql-injection-interpolation rule for the hard block.

RISK: Interpolating a non-sql() value directly into a Drizzle sql`` tagged template bypasses parameterization and enables SQL injection (CWE-89). FIX: Wrap any variable with sql.placeholder() or pass it as a Drizzle column/table reference; use parameterized placeholders via the Drizzle query builder rather than raw interpolation.

RISK: db.update(table).set({...}) without a .where() clause applies the update to every row in the table. FIX: Always chain .where(eq(table.id, id)); use Drizzle's drizzle.config.ts strict mode to enforce this at compile time.