Articles

A node-postgres connection leak took our API down: 100 connections gone in 2 minutes on normal traffic. The post-mortem, the finally/pool.query fix, and the structural ESLint rule that flags a checked-out client that's never released — before it merges.

Hardcoded secrets, unsafe deserialization, LDAP/XPath/GraphQL injection, prototype pollution — language-level bugs that pass review and tests, then become CVEs. 27 CWE-mapped ESLint rules that catch them in CI, framework-agnostic.

SQL injection, search_path schema hijacking, and the missing client.release() that exhausts your pool — node-postgres bugs that pass tests and take down production. 13 CWE-mapped ESLint rules that catch them in CI.

A real, auditable mapping of the OWASP Top 10 (2021) to ten domain-security ESLint plugins: which categories a CWE-tagged rule genuinely catches in CI, and the two (Insecure Design, Vulnerable Components) that need controls beyond source analysis.

How to turn an inherited Node.js codebase into a measurable risk heatmap in one ESLint run: the three plugins to install, the jq one-liner that ranks findings by rule, and how to read the result — 15 SQL injections and 8 hardcoded credentials before your first standup.

The 13 security concepts that come up in senior JavaScript/Node interviews — SQLi, XSS, CSRF, JWT, prototype pollution, ReDoS, timing attacks — each with the bad-vs-good code, the CWE, and the exact ESLint rule that enforces it automatically.

alg:none tells a JWT verifier 'this token has no signature' — and a permissive verify call accepts the forgery. The header-swap walkthrough, why jsonwebtoken still ships the foot-gun, and the CWE-347 ESLint rule that fails the build on it.

The 3-line prompt-injection bug in almost every Vercel AI SDK app, the exploit that proves it, why string sanitization is a trap, and the CWE-74 ESLint rule that enforces a real validation boundary at write-time.

SQL injection is the famous node-postgres failure — but identifier hijacking, connection-pool exhaustion, and insecure transport page you at 3 AM just as hard. The four data-layer threat classes, the pg-specific ESLint rule for each, and the one config that turns them all on.

AI assistants leave demo keys, placeholder passwords, and bare config literals in source — CWE-798 at scale. One ESLint rule catches the hardcoded literal, and its CWE/CVSS/fix message is structured so the same AI can read the error and hoist it to process.env.

A 4-way benchmark on one fixture (12 vulnerability classes): Oxlint's built-in rules, eslint-plugin-security, the Interlace plugins on ESLint, and the same Interlace rules on Oxlint. Real current numbers, the false-positive breakdown, and the parity proof that the rules run on both engines.

An agent that hallucinates doesn't just say the wrong thing — it calls the wrong tool. Five CWE-tagged ESLint rules bound an AI agent's agency: tool confirmation, input schemas, step limits, error handling, and abort signals — caught at write-time.