Articles
Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.
Filtered by tag #eslint · clear filter
Jan 2, 20264 Browser Security Bugs That Pass Code Review — One Lint Run, 8 CI ErrorsJWT-in-localStorage, innerHTML XSS, postMessage('*'), a plaintext fetch — four bugs a type-checker and a backend pentest never see. One file, one `npx eslint .`, eight CWE-mapped errors. Includes the setup gotcha that silently skips your .ts files, and the metadata drift I found in my own plugin while capturing the run.#security#eslint#devsecops+19 min
Jan 2, 2026JWT Vulnerabilities Your Code Review Approves Every Day — 13 ESLint Rules Stop Them in CIalg:none token forgery, RS256↔HS256 confusion, weak/hardcoded secrets, missing exp/iss/aud — the JWT auth mistakes that hand attackers a valid session. The 13 CWE-mapped rules in eslint-plugin-jwt v2.2.7 that turn them into CI errors, which preset you actually need, and the four rules `recommended` leaves off.#security#node#devsecops+112 min
Jan 2, 2026eslint-plugin-import Spends 148s Finding Circular Deps in 5,000 Files. import-next Does It in 2.7s.A reproducible performance benchmark: eslint-plugin-import vs eslint-plugin-import-next across 1K/5K/10K files. The no-cycle rule goes from 148.59s to 2.71s at 5,000 files (54.8x measured, n=3). Both plugins compute strongly-connected components and both re-run per-edge BFS path-finding — I measured that disabling the old plugin's SCC check changes nothing, so the gap isn't 'no SCC at all'; the exact remaining cause is honestly unresolved, and the numbers are reproducible from the linked result JSON.#eslint#node#ai+1004 min0
Jan 2, 2026no-cycle Is Commented Out in Your ESLint Config. Here Is the Two-Minute Swap That Turns It Back On.Install and configure eslint-plugin-import-next v2.3.8 — the drop-in replacement for eslint-plugin-import. Flat-config setup, the real terminal output, TypeScript path aliases with no resolver package, the zero-diff migration that keeps every import/* rule name working, all 12 presets, and the version-stamped benchmark (54.8x on no-cycle at 5,000 files, measured 2026-01-02) plus the command to re-run it yourself.#eslint#javascript#imports+110 min
Dec 31, 2025Vercel AI SDK Security Holes That TypeScript Won't Catch — 19 Rules That WillPrompt injection via unvalidated user input, system prompt exfiltration, missing output validation, tool call injection — TypeScript types look correct in every case. Here are the 19 ESLint rules that catch them in CI.#ai#security#devsecops+10011 min0
Dec 31, 2025pool.query('BEGIN') Scattered Our Transfer Across Four Connections. The ESLint Rule That Catches It.A Sentry alert about totals that didn't reconcile traced back to four lines that read exactly like a transaction. pool.query('BEGIN') runs on a different pooled client than the UPDATE after it, so nothing is atomic. The race condition (CWE-362), a reproduction you can run against your own pool, the dedicated-client fix, and the pg ESLint rule that flags every BEGIN/COMMIT on a pool.#node#eslint#security+18 min
Dec 31, 2025A Missing client.release() Exhausted Our Postgres Pool at 3 AM. The ESLint Rule That Catches It.A missing client.release() drained our node-postgres pool and every request started timing out. A 60-second reproduction (the 11th checkout hangs forever), the finally/pool.query fix, and the structural ESLint rule that flags a checked-out client that's never released — before it merges.#node#eslint#devsecops+1009 min0
Dec 31, 2025Secure Coding Violations Your Team Ships Every Sprint — and the 28-Rule ESLint Config That Catches ThemHardcoded secrets, guessable reset tokens, GraphQL interpolation, a password in a log line — four violations that pass code review every sprint. Install one plugin, add six lines of config, and see the exact CWE/CVSS output each one produces. Every command and every terminal block below was re-run against v3.3.3 on 2026-07-28.#security#node#devsecops+112 min
Dec 31, 2025PostgreSQL Injection in Node.js: 4 Patterns That Pass Code Review, and the 13 Rules That Catch ThemSQL injection (CVSS 9.8), search_path schema hijacking (CVSS 7.5), COPY FROM filesystem access (CVSS 9.5), and pool connection leaks (CWE-404) — four node-postgres patterns that survive review every time, and the 13 ESLint rules in eslint-plugin-pg v1.4.6 that turn all four into CI errors. Install, config, and what each finding means.#security#node#devsecops+112 min
Dec 31, 2025I Mapped the OWASP Top 10 to ESLint Rules. 8 Hold Up. 2 Are Vendor Theater.A real, auditable mapping of the OWASP Top 10 (2021) to ten domain-security ESLint plugins: which categories a CWE-tagged rule genuinely catches in CI, the two (Insecure Design, Vulnerable Components) that need controls beyond source analysis, and what happens when you point these rules at AI-generated code.#security#node#devsecops+1108 min0
Dec 31, 2025Your AI Assistant Just Re-Added a 10-Year-Old JWT Bypass. One ESLint Rule Catches It.alg:none is a 2015 disclosure every JWT library patched years ago. It's also exactly the kind of permissive config an AI coding assistant will write back in the moment you ask it to 'support legacy tokens.' Here's the 1-line attack, why jsonwebtoken/jose/express-jwt each handle it differently, and the ESLint rule that catches it regardless of who wrote the code.#security#node#eslint+16 min
Dec 31, 2025Why eslint-plugin-import Takes 58 Seconds on 10,000 Files — And Where the Time Actually GoesA lint-performance post-mortem with the result JSON attached: 58.67s vs 11.26s on 10,000 files, and 148.59s vs 2.71s for no-cycle alone at 5,000 (eslint-plugin-import 2.32.0 vs eslint-plugin-import-next 2.3.3, measured 2026-01-02). What I can prove about the cause, and what I can't.#eslint#javascript#performance+17 min