Articles

Our import cycle detector reported 0 cycles in a Next.js app with 7 actual cycles. Here's the 3-line cache bug that hid them all — and how to test if your own detector has the same class of failure.

The codebase had 2 years of feature PRs and zero security audits. A 12-second ESLint run surfaced 47 violations across 6 distinct vulnerability classes — auth bypass, sensitive field leaks, brute-force exposure, and three more. Here's what each one looks like, why experienced developers didn't catch it, and why your AI assistant writes the same six today.

The most-installed security linter on npm flags one safe pattern for every real vulnerability it catches — a 1:1 true-positive-to-false-positive ratio at 27.5% recall. Six plugins benchmarked side-by-side, with the false-positive code samples that train teams to ignore the tool.

I ran 40 real-world vulnerable patterns through 17 ESLint plugins — eslint-plugin-security, SonarJS, Microsoft SDL. The old pinned version crashes on ESLint 9; the current one doesn't crash but still misses SQL injection entirely. Most others miss 60–100%. Here's the reproducible benchmark, re-verified against the current version of every plugin.

Our import-next/no-cycle reported 0 cycles in next.js's 14K-file repo. oxlint reported 17. The same rule on a 33-file subset of the same repo found 5. The bug: a depth-truncated DFS cached files as 'known acyclic' that it had never finished exploring — and the cascade swallowed 245 files. Five lines fixed it. Here is why your AI-generated barrel files make this worse.

The 'most dangerous' AI model fixes 93% of the database vulnerabilities it writes; the 'safest' fixes 45%. Same 700 functions, opposite conclusion. When I broke a 5-model security benchmark down by domain — database, auth, file I/O, command execution — the rankings inverted. Aggregate numbers hide domain expertise. Here's the per-domain data and how to gate it in CI.

Nine flagship ESLint rules. Months of green unit tests, weeks of OSS benchmarking. A 5KB ground-truth corpus failed three of them at F1=1.00 the first time we ran it — and two of the three blind spots are the exact patterns AI assistants emit. Three diagnostics, three fixes, one CI gate, and why both green signals shared one hole.

A reproducible benchmark: @microsoft/eslint-plugin-sdl (17 rules, Angular/Electron/browser-focused) vs the Interlace security plugins, on one Node fixture. SDL's recommended config catches 5 — frontend hardening is exactly why it's the wrong layer for a Node backend, and exactly the gap your AI assistant ships into.

A reproducible fixture benchmark: eslint-plugin-sonarjs (269 rules) vs the Interlace security plugins on 40 known vulnerabilities. SonarJS is one of the best quality linters in the ecosystem — which is exactly why a green run isn't a clean Node.js security bill. Recall 35%, the 26 it misses, why they survive review, and what happens when Claude and Gemini write them. Result JSON linked.

No helmet, a CORS origin that reflects the caller, an unbounded req.body, a redirect that echoes user input — four Express apps with nothing wrong on screen. The install, the flat config, and the 14 CWE-mapped ESLint rules that catch the missing middleware in CI.

Missing @UseGuards, unvalidated @Body(), entities leaking passwordHash — NestJS security lives in decorators, and an absent decorator produces no diff. 6 CWE-mapped ESLint rules that catch all of it in CI: vulnerable code, why review missed it, the fix, and the real lint output.

Unvalidated event input, hardcoded credentials, Action:'*' IAM, sensitive data in logs — four Lambda vulnerabilities that survive code review and become account takeovers. Install, config, and the 14 CWE-mapped rules that catch them on every push.