Articles

Name: Interlace ESLint Ecosystem
Author: Ofri Peretz

Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.

Dec 19, 2025
Your Vercel AI SDK App vs the OWASP LLM Top 10: 8 Categories ESLint Catches in CI — and 2 It Honestly Can't.
A real mapping of the OWASP LLM Top 10 (2025) to eslint-plugin-vercel-ai-security: which categories a CWE-tagged rule genuinely catches in source, and which two (supply chain, model poisoning) live outside static analysis.
#eslint#ai#security+1
8 min
Dec 19, 2025
Your Vercel AI SDK App Has a Prompt Injection Vulnerability — in 1 of 3 Places. Here's the ESLint Rule for Each.
Prompt injection has three faces in a Vercel AI SDK app: unvalidated input, a leaky system prompt, and unconfirmed tool calls. Three CWE-tagged ESLint rules catch each at write-time — plus the hardened pattern they want.
#eslint#vercel#ai+1
7 min
Microsoft's SDL ESLint Plugin Caught 3 of My Node Vulns; the Domain Plugins Caught 46 — It's a Frontend Tool
A reproducible benchmark: @microsoft/eslint-plugin-sdl (17 rules, Angular/Electron/browser-focused) vs the Interlace security plugins, on one Node fixture. SDL is a frontend-hardening tool — which is exactly why it's the wrong layer for a Node backend.
#security#eslint#javascript+1
7 min
SonarJS Has 269 Rules and Found 13 Security Issues Where the Domain Plugins Found 46 — It's a Quality Linter
A reproducible 5-way benchmark: eslint-plugin-sonarjs (269 rules) vs the Interlace security plugins, on one fixture. SonarJS is one of the best quality linters in the ecosystem — and that's exactly why its security coverage is a different scope.
#security#eslint#javascript+1
8 min
no-cycle finds 0 cycles in next.js (and other lies caches tell you)
no-cycle finds 0 cycles in next.js (and other lies caches tell you)
Our import-next/no-cycle reported 0 cycles in next.js's 14K-file repo. oxlint reported 17. The same rule, run on a 33-file subset of the same repo, found 5+. The bug: cache pollution from a depth-truncated DFS marking files as 'known acyclic' that hadn't been fully explored.
#eslint#staticanalysis#performance+1
6 min
The AI Hydra Problem: Fix One AI Bug, Get Two More
When AI models fix security vulnerabilities, they sometimes introduce entirely new ones. I tested this across 3 remediation rounds with Claude Opus 4.6 using two approaches — ESLint-guided feedback vs. prompt engineering alone. The results expose a fundamental limit of 'fix it again' workflows.
#ai#security#javascript+1
17 min
Three SQL Injection Patterns That Still Ship in Node.js — And the ESLint Rule That Catches Them
Direct concatenation, template literals, and cross-line variable taint: the three structural forms of SQL injection in node-postgres codebases, why each survives code review, and how a pg-specific ESLint rule catches all three.
#security#postgres#node+1
005 min0
What ground truth caught that unit tests missed: 3 real bugs in 9 flagship lint rules
A 5KB ground-truth corpus failed three flagship ESLint rules at F1=1.00 the moment we ran it. Months of green unit tests missed every bug. Three diagnostics, three fixes.
#staticanalysis#eslint#testing+1
9 min