Global mutable state
Part of Architecture & Best Practices, which counts for 15% of the overall score. When this check fires it deducts 2 points from that category, once per scan, no matter how many places it turns up.
What it detects
A module exports mutable top-level state (let/var), a common source of subtle cross-request bugs in server code.
Why it matters
Module-level let/var in server code is shared by every request the process handles, so one user's request can read state written by another's, and the bugs only appear under concurrency, where they are miserable to reproduce. It also breaks as soon as you run more than one process, since each has its own copy. Sometimes it is an intentional cache, but that should be a deliberate, visible choice.
How to fix it
Reclassify each mutable module variable: values never reassigned become const; per-request values move into request scope (function parameters, res.locals, or AsyncLocalStorage); data that must persist or be shared across instances moves to a real store like the database or Redis. Anything that legitimately stays module-level (a process-local cache) gets wrapped in accessor functions with a comment stating its lifetime, so mutation is visible and searchable.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo