Articles
Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.
Filtered by tag #security · clear filter
Jan 2, 2026AWS Lambda Security Bugs Your Serverless Functions Are Shipping — 14 ESLint Rules That Catch Them in CIUnvalidated event input, hardcoded credentials, Action:'*' IAM, sensitive data in logs — four Lambda vulnerabilities that survive code review and become account takeovers. Install, config, and the 14 CWE-mapped rules that catch them on every push.#security#node#devsecops+112 min
Jan 2, 20264 Browser Security Bugs That Pass Code Review — One Lint Run, 8 CI ErrorsJWT-in-localStorage, innerHTML XSS, postMessage('*'), a plaintext fetch — four bugs a type-checker and a backend pentest never see. One file, one `npx eslint .`, eight CWE-mapped errors. Includes the setup gotcha that silently skips your .ts files, and the metadata drift I found in my own plugin while capturing the run.#security#eslint#devsecops+19 min
Jan 2, 2026JWT Vulnerabilities Your Code Review Approves Every Day — 13 ESLint Rules Stop Them in CIalg:none token forgery, RS256↔HS256 confusion, weak/hardcoded secrets, missing exp/iss/aud — the JWT auth mistakes that hand attackers a valid session. The 13 CWE-mapped rules in eslint-plugin-jwt v2.2.7 that turn them into CI errors, which preset you actually need, and the four rules `recommended` leaves off.#security#node#devsecops+112 min
Jan 2, 2026Node.js Security Bugs That Pass Code Review Every Day — 35 Static Analysis Rules That Don'tPath traversal via fs, shell injection via child_process, eval on user input, weak hashes — Node.js built-in footguns that survive code review and ship as CVEs. Here's the guard that catches all of them in CI, with the real linter output.#security#node#devsecops+110 min
Dec 31, 2025Vercel AI SDK Security Holes That TypeScript Won't Catch — 19 Rules That WillPrompt injection via unvalidated user input, system prompt exfiltration, missing output validation, tool call injection — TypeScript types look correct in every case. Here are the 19 ESLint rules that catch them in CI.#ai#security#devsecops+10011 min0
Dec 31, 2025pool.query('BEGIN') Scattered Our Transfer Across Four Connections. The ESLint Rule That Catches It.A Sentry alert about totals that didn't reconcile traced back to four lines that read exactly like a transaction. pool.query('BEGIN') runs on a different pooled client than the UPDATE after it, so nothing is atomic. The race condition (CWE-362), a reproduction you can run against your own pool, the dedicated-client fix, and the pg ESLint rule that flags every BEGIN/COMMIT on a pool.#node#eslint#security+18 min
Dec 31, 2025A Missing client.release() Exhausted Our Postgres Pool at 3 AM. The ESLint Rule That Catches It.A missing client.release() drained our node-postgres pool and every request started timing out. A 60-second reproduction (the 11th checkout hangs forever), the finally/pool.query fix, and the structural ESLint rule that flags a checked-out client that's never released — before it merges.#node#eslint#devsecops+1009 min0
Dec 31, 2025Secure Coding Violations Your Team Ships Every Sprint — and the 28-Rule ESLint Config That Catches ThemHardcoded secrets, guessable reset tokens, GraphQL interpolation, a password in a log line — four violations that pass code review every sprint. Install one plugin, add six lines of config, and see the exact CWE/CVSS output each one produces. Every command and every terminal block below was re-run against v3.3.3 on 2026-07-28.#security#node#devsecops+112 min
Dec 31, 2025PostgreSQL Injection in Node.js: 4 Patterns That Pass Code Review, and the 13 Rules That Catch ThemSQL injection (CVSS 9.8), search_path schema hijacking (CVSS 7.5), COPY FROM filesystem access (CVSS 9.5), and pool connection leaks (CWE-404) — four node-postgres patterns that survive review every time, and the 13 ESLint rules in eslint-plugin-pg v1.4.6 that turn all four into CI errors. Install, config, and what each finding means.#security#node#devsecops+112 min
Dec 31, 2025I Mapped the OWASP Top 10 to ESLint Rules. 8 Hold Up. 2 Are Vendor Theater.A real, auditable mapping of the OWASP Top 10 (2021) to ten domain-security ESLint plugins: which categories a CWE-tagged rule genuinely catches in CI, the two (Insecure Design, Vulnerable Components) that need controls beyond source analysis, and what happens when you point these rules at AI-generated code.#security#node#devsecops+1108 min0
Dec 31, 2025The 30-Minute Security Audit: 140 Gemini-Written Functions, 102 Shipped VulnerableA 30-minute static-analysis protocol for any inherited Node.js codebase — human- or AI-written: the three ESLint plugins to install, the jq one-liner that ranks findings by rule, and how to read the heatmap without over-trusting it. Then the same scan on a real Gemini-2.5-Pro corpus: 102 of 140 functions vulnerable, 168 findings, avg CVSS 8.3, and the rules that fired first.#security#node#devsecops+11168 min0
Dec 31, 202513 Security Questions Every JS Interview Asks — and the 9 ESLint Rules That Answer Them in CIThe 13 security concepts that come up in senior JavaScript/Node interviews — SQLi, XSS, CSRF, JWT, prototype pollution, ReDoS, timing attacks — each with the bad-vs-good code, the CWE, and the exact ESLint rule that stops your AI assistant (and you) from shipping the bad version anyway.#security#javascript#node+1009 min0