What is the Interlace ESLint Ecosystem?

The Interlace ESLint Ecosystem is a collection of 18+ production-ready ESLint plugins designed for the AI/Agentic era. These plugins feature LLM-optimized error messages that empower both human developers and AI coding assistants to catch and fix security vulnerabilities automatically.

Why AI-native ESLint plugins?

Traditional ESLint error messages are designed for human developers reading them in an IDE. As AI coding assistants become more prevalent, there's a need for error messages that are also machine-parseable and provide clear remediation guidance. Our plugins bridge this gap.

Which security standards do the plugins cover?

The plugins provide comprehensive coverage for OWASP Top 10 2021, OWASP Mobile 2024, and framework-specific security patterns for Express, NestJS, Lambda, and more. Each plugin includes detailed documentation with Known False Negatives disclosure.

What technologies does Ofri Peretz work with?

Languages: TypeScript, JavaScript, Node.js. Frameworks: React, Express, NestJS. Backend: Kafka, Redis, Serverless. Cloud: AWS, Docker, Kubernetes. DevEx: ESLint, Nx Monorepos, CLIs.

Hardening the Data Layer: The node-postgres Static Analysis Standard

Name: Interlace ESLint Ecosystem
Author: Ofri Peretz

Postgres is the backbone of your production infrastructure. For engineering leaders, database security isn't a training problem—it's a governance problem. Here is the automated static analysis standard for node-postgres.

Quick Install

bash

npm install --save-dev eslint-plugin-pg

Flat Config

javascript

// eslint.config.js
import pg from "eslint-plugin-pg";

export default [pg.configs.recommended];

Run ESLint

bash

npx eslint .

You'll see output like:

bash

src/users.ts
  15:3  error  🔒 CWE-89 OWASP:A03 CVSS:9.8 | Unsafe SQL query detected
               Fix: Use parameterized query: client.query('SELECT * FROM users WHERE id = $1', [id])

src/orders.ts
  28:5  error  🔒 CWE-772 | pool.connect() without client.release()
               Fix: Add client.release() in finally block

Rule Overview

Rule	CWE	What it catches
`no-unsafe-query`	CWE-89	SQL injection via string concatenation
`no-missing-client-release`	CWE-772	Connection pool leaks
`prevent-double-release`	CWE-415	Double release crashes
`no-transaction-on-pool`	CWE-362	Transaction race conditions
`prefer-pool-query`	CWE-400	Unnecessary connect/release
`no-unsafe-copy-from`	CWE-22	Path traversal in COPY FROM
`no-unsafe-search-path`	CWE-426	search_path hijacking
`no-batch-insert-loop`	Perf	N+1 query patterns
Plus 5 more...

Quick Wins

Before

javascript

// ❌ SQL Injection
const query = `SELECT * FROM users WHERE id = '${userId}'`;
await pool.query(query);

After

javascript

// ✅ Parameterized Query
const query = "SELECT * FROM users WHERE id = $1";
await pool.query(query, [userId]);

Before

javascript

// ❌ Connection Leak
const client = await pool.connect();
const result = await client.query("SELECT * FROM users");
return result.rows;
// Missing client.release()!

After

javascript

// ✅ Guaranteed Release
const client = await pool.connect();
try {
  const result = await client.query("SELECT * FROM users");
  return result.rows;
} finally {
  client.release();
}

Available Presets

javascript

// Security + best practices
pg.configs.recommended;

// All rules enabled
pg.configs.all;

Customizing Rules

javascript

// eslint.config.js
import pg from "eslint-plugin-pg";

export default [
  pg.configs.recommended,
  {
    rules: {
      // Downgrade to warning
      "pg/prefer-pool-query": "warn",

      // Increase strictness
      "pg/no-unsafe-query": [
        "error",
        {
          allowLiteral: false,
        },
      ],
    },
  },
];

Performance

text

┌─────────────────────────────────────────────────────┐
│ Benchmark: 1000 files                               │
├─────────────────────────────────────────────────────┤
│ eslint-plugin-pg:          785ms                    │
│ 100% precision (0 false positives in tests)         │
└─────────────────────────────────────────────────────┘

Combine with Other Plugins

javascript

import pg from "eslint-plugin-pg";
import secureCoding from "eslint-plugin-secure-coding";

export default [pg.configs.recommended, secureCoding.configs.recommended];

Quick Reference

bash

# Install
npm install --save-dev eslint-plugin-pg

# Config (eslint.config.js)
import pg from 'eslint-plugin-pg';
export default [pg.configs.recommended];

# Run
npx eslint .

📦 npm: eslint-plugin-pg 📖 Full Rule List

🚀 Using node-postgres? Drop a star on GitHub!

The Interlace ESLint Ecosystem Interlace is a high-fidelity suite of static code analyzers designed to automate security, performance, and reliability for the modern Node.js stack. With over 330 rules across 18 specialized plugins, it provides 100% coverage for OWASP Top 10, LLM Security, and Database Hardening.

Explore the full Documentation

Build Securely. I'm Ofri Peretz, a Security Engineering Leader and the architect of the Interlace Ecosystem. I build static analysis standards that automate security and performance for Node.js fleets at scale.

ofriperetz.dev | LinkedIn | GitHub