no-unscoped-mutation

CWE: CWE-284 OWASP: A01:2021 – Broken Access Control

Detects Drizzle bulk mutations that reach every row in the table. This rule is part of eslint-plugin-drizzle-security.

💼 This rule is set to error in the strict config.

Quick SummaryCopy Anchor Link

Why this mattersCopy Anchor Link

A bulk mutation without a filter is one forgotten clause away from rewriting or deleting the entire table. It type-checks, it passes review, and it usually only shows up once it has run against production data. Drizzle's argument is the table (db.delete(users)), never a filter — the scope always arrives as a chained .where().

❌ IncorrectCopy Anchor Link

// Deletes every row in users
await db.delete(users);

// Rewrites every row
await db.update(users).set({ role: 'admin' });

// returning() is not a filter
await db.delete(users).returning();

✅ CorrectCopy Anchor Link

await db.delete(users).where(eq(users.id, id));

await db.update(users).set({ active: false }).where(eq(users.id, id));

Known limitationsCopy Anchor Link

This rule reports only what it can prove. Scope that cannot be read statically is treated as present, so the rule stays silent rather than guessing.

When not to use itCopy Anchor Link

Disable this rule in maintenance scripts, seeders, and test fixtures whose job is to clear a table. Prefer a scoped eslint-disable-next-line on the specific call over switching the rule off for the whole project.

How a mutation is recognised (2026-10 review)Copy Anchor Link

The receiver is judged by where it is written — an import of the driver, a client built from it, a transaction handle it passes to a callback, a typed parameter or class member, or a relative module that exports one — never by its name. A Map or Set is never a table; an untraceable handle reports when its argument is a table the driver built (db.delete(users)).

Test files are skipped.

Further readingCopy Anchor Link

• Drizzle documentation
• CWE-284: Improper Access Control

Use this rule

npm install -D oxlint-plugin-drizzle-security

{  "jsPlugins": ["oxlint-plugin-drizzle-security"],  "rules": {    "drizzle-security/no-unscoped-mutation": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-drizzle-security'],    rules: {      'drizzle-security/no-unscoped-mutation': 'error',    },  },});