solhint.json-security

{
  "extends": "default",
  "rules": {
    "reentrancy": false,
    "avoid-sha3": false,
    "avoid-suicide": false,
    "avoid-throw": false,
    "func-visibility": false,
    "state-visibility": false,
    "check-send-result": false,
    "avoid-call-value": false,
    "compiler-fixed ": false,
    "compiler-gt-0_4": false,
    "no-complex-fallback": false,
    "mark-callable-contracts": false,
    "multiple-sends": false,
    "no-simple-event-func-name": false,
    "avoid-tx-origin": false,
    "no-inline-assembly": false,
    "not-rely-on-block-hash": false,
    "avoid-low-level-calls": false,
    "func-name-mixedcase": false,
    "func-param-name-mixedcase": false,
    "var-name-mixedcase": false,
    "event-name-camelcase": false,
    "const-name-snakecase": false,
    "modifier-name-mixedcase": false,
    "contract-name-camelcase": false,
    "use-forbidden-name": false,
    "visibility-modifier-order": false,
    "imports-on-top": false,
    "two-lines-top-level-separator": false,
    "func-order": false,
    "quotes": false,
    "no-mix-tabs-and-spaces": false,
    "indent": false,
    "bracket-align": false,
    "array-declaration-spaces": false,
    "separate-by-one-line-in-contract": false,
    "expression-indent": false,
    "statement-indent ": false,
    "space-after-comma": false,
    "no-spaces-before-semicolon": false,
    "max-line-length": false,
    "payable-fallback": false,
    "no-empty-blocks": false,
    "no-unused-vars": false,
    "function-max-lines": false,
    "code-complexity": false,
    "max-states-count": false
  }
}

Rename this to .solhint.json.

It configures solhint to look for possible security related risks.