Skip to main content

Home Articles npm Scorecard

Build Securely.

Engineering Leader & Open Source Creator. Architect of the Interlace ESLint Ecosystem.

GitHub
Dev.to
LinkedIn
X

© 2026 Ofri Peretz. All rights reserved.

Articles

Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.

Filtered by tag #eslint · clear filter

Jan 2, 2026
An SSRF in Your Lambda Steals the Execution Role. Action: '*' Hands Over the Account. 14 ESLint Rules Break the Chain.
SSRF to the metadata endpoint, Action:'*' IAM, secrets in env vars, stack traces in responses — AWS Lambda mistakes that pass review and become account takeovers. 14 CWE-mapped ESLint rules that catch them in CI.
#eslint#aws#lambda+1
9 min
Jan 2, 2026
Your Frontend Stores JWTs in localStorage and Posts to '*'. 45 ESLint Rules Catch What the Backend Audit Misses.
JWT-in-localStorage, innerHTML XSS, postMessage('*'), mixed content, permissive CORS — browser-side bugs a backend pentest and a type-checker never see. 45 CWE-mapped ESLint rules that catch them in CI.
#eslint#javascript#security+1
10 min
Jan 2, 2026
jsonwebtoken Will Verify a Token Signed With algorithm: none. These 13 ESLint Rules Stop It.
alg:none token forgery, RS256↔HS256 confusion, weak/hardcoded secrets, missing exp/iss/aud — the JWT auth mistakes that hand attackers a valid session. 13 CWE-mapped ESLint rules that catch them in CI.
#eslint#jwt#security+1
9 min
Jan 2, 2026
MD5, exec(), and Zip Slip: 34 ESLint Rules That Fail Your Node.js CI Before They Ship.
Weak crypto (MD5/SHA-1/ECB), command injection via exec(), Zip Slip path traversal, Math.random() tokens — Node.js built-in footguns that pass tests and ship as CVEs. 34 CWE-mapped ESLint rules that catch them in CI.
#eslint#node#security+1
9 min
Jan 2, 2026
eslint-plugin-import Spends 148s Finding Circular Deps in 5,000 Files. import-next Does It in 2.7s.
A reproducible performance benchmark: eslint-plugin-import vs eslint-plugin-import-next across 1K/5K/10K files. The no-cycle rule goes from 148s to 2.7s at 5,000 files (54.9x measured) — because O(n²) graph traversal became O(n).
#eslint#javascript#performance+1
004 min0
Dec 31, 2025
Your Vercel AI SDK Agent Has 19 Attack Surfaces. Here's an ESLint Rule for Each.
Prompt injection, tool over-permissioning, AI output that reaches eval/SQL/innerHTML, secrets in prompts — the Vercel AI SDK puts every one a single property away. 19 ESLint rules that catch them in CI, before deploy.
#eslint#ai#security+1
009 min0
Dec 31, 2025
BEGIN on a Postgres Pool Scatters Your Transaction Across Connections. One ESLint Rule Stops It.
pool.query('BEGIN') runs on a different pooled client than the UPDATE that follows it — so your 'transaction' isn't atomic and corrupts data under load. The race condition (CWE-362), the dedicated-client fix, and the pg ESLint rule that catches every BEGIN/COMMIT on a pool.
#eslint#postgres#node+1
5 min
Dec 31, 2025
A Missing client.release() Exhausted Our Postgres Pool at 3 AM. The ESLint Rule That Catches It.
A node-postgres connection leak took our API down: 100 connections gone in 2 minutes on normal traffic. The post-mortem, the finally/pool.query fix, and the structural ESLint rule that flags a checked-out client that's never released — before it merges.
#eslint#postgres#node+1
005 min0
Dec 31, 2025
A Hardcoded sk_live_ Key Passes Code Review. It Won't Pass These 27 ESLint Rules.
Hardcoded secrets, unsafe deserialization, LDAP/XPath/GraphQL injection, prototype pollution — language-level bugs that pass review and tests, then become CVEs. 27 CWE-mapped ESLint rules that catch them in CI, framework-agnostic.
#eslint#security#javascript+1
9 min
Dec 31, 2025
pg Lets You Concatenate SQL, Hijack search_path, and Leak Every Connection. 13 ESLint Rules Say No.
SQL injection, search_path schema hijacking, and the missing client.release() that exhausts your pool — node-postgres bugs that pass tests and take down production. 13 CWE-mapped ESLint rules that catch them in CI.
#eslint#postgres#node+1
9 min
Dec 31, 2025
8 of the OWASP Top 10 Are ESLint Rules. 2 Aren't — and That's the Honest Audit Answer.
A real, auditable mapping of the OWASP Top 10 (2021) to ten domain-security ESLint plugins: which categories a CWE-tagged rule genuinely catches in CI, and the two (Insecure Design, Vulnerable Components) that need controls beyond source analysis.
#eslint#security#owasp+1
108 min0
Dec 31, 2025
I Inherited a 3,000-Line Codebase. One ESLint Run Found 26 Critical Security Bugs.
How to turn an inherited Node.js codebase into a measurable risk heatmap in one ESLint run: the three plugins to install, the jq one-liner that ranks findings by rule, and how to read the result — 15 SQL injections and 8 hardcoded credentials before your first standup.
#eslint#security#node+1
1165 min0

Page 2 of 4