Articles
Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.
Foundations22
The Hardened Stack11
Inside our linter benchmarks8
Postgres Security Protocol8
AI Security Benchmark Series7
ESLint Security Benchmark Series6
Hardening AI Agents6
Standalone14
Hover a dot to preview an article.
Jan 2, 2026eslint-plugin-import Spends 148s Finding Circular Deps in 5,000 Files. import-next Does It in 2.7s.A reproducible performance benchmark: eslint-plugin-import vs eslint-plugin-import-next across 1K/5K/10K files. The no-cycle rule goes from 148.59s to 2.71s at 5,000 files (54.8x measured, n=3). Both plugins compute strongly-connected components and both re-run per-edge BFS path-finding — I measured that disabling the old plugin's SCC check changes nothing, so the gap isn't 'no SCC at all'; the exact remaining cause is honestly unresolved, and the numbers are reproducible from the linked result JSON.#eslint#node#ai+1004 min0
Jan 2, 2026no-cycle Is Commented Out in Your ESLint Config. Here Is the Two-Minute Swap That Turns It Back On.Install and configure eslint-plugin-import-next v2.3.8 — the drop-in replacement for eslint-plugin-import. Flat-config setup, the real terminal output, TypeScript path aliases with no resolver package, the zero-diff migration that keeps every import/* rule name working, all 12 presets, and the version-stamped benchmark (54.8x on no-cycle at 5,000 files, measured 2026-01-02) plus the command to re-run it yourself.#eslint#javascript#imports+110 min
Dec 31, 2025Vercel AI SDK Security Holes That TypeScript Won't Catch — 19 Rules That WillPrompt injection via unvalidated user input, system prompt exfiltration, missing output validation, tool call injection — TypeScript types look correct in every case. Here are the 19 ESLint rules that catch them in CI.#ai#security#devsecops+10011 min0
Dec 31, 2025pool.query('BEGIN') Scattered Our Transfer Across Four Connections. The ESLint Rule That Catches It.A Sentry alert about totals that didn't reconcile traced back to four lines that read exactly like a transaction. pool.query('BEGIN') runs on a different pooled client than the UPDATE after it, so nothing is atomic. The race condition (CWE-362), a reproduction you can run against your own pool, the dedicated-client fix, and the pg ESLint rule that flags every BEGIN/COMMIT on a pool.#node#eslint#security+18 min
Dec 31, 2025A Missing client.release() Exhausted Our Postgres Pool at 3 AM. The ESLint Rule That Catches It.A missing client.release() drained our node-postgres pool and every request started timing out. A 60-second reproduction (the 11th checkout hangs forever), the finally/pool.query fix, and the structural ESLint rule that flags a checked-out client that's never released — before it merges.#node#eslint#devsecops+1009 min0
Dec 31, 2025Secure Coding Violations Your Team Ships Every Sprint — and the 28-Rule ESLint Config That Catches ThemHardcoded secrets, guessable reset tokens, GraphQL interpolation, a password in a log line — four violations that pass code review every sprint. Install one plugin, add six lines of config, and see the exact CWE/CVSS output each one produces. Every command and every terminal block below was re-run against v3.3.3 on 2026-07-28.#security#node#devsecops+112 min
Dec 31, 2025PostgreSQL Injection in Node.js: 4 Patterns That Pass Code Review, and the 13 Rules That Catch ThemSQL injection (CVSS 9.8), search_path schema hijacking (CVSS 7.5), COPY FROM filesystem access (CVSS 9.5), and pool connection leaks (CWE-404) — four node-postgres patterns that survive review every time, and the 13 ESLint rules in eslint-plugin-pg v1.4.6 that turn all four into CI errors. Install, config, and what each finding means.#security#node#devsecops+112 min
Dec 31, 2025I Mapped the OWASP Top 10 to ESLint Rules. 8 Hold Up. 2 Are Vendor Theater.A real, auditable mapping of the OWASP Top 10 (2021) to ten domain-security ESLint plugins: which categories a CWE-tagged rule genuinely catches in CI, the two (Insecure Design, Vulnerable Components) that need controls beyond source analysis, and what happens when you point these rules at AI-generated code.#security#node#devsecops+1108 min0
Dec 31, 2025The 30-Minute Security Audit: 140 Gemini-Written Functions, 102 Shipped VulnerableA 30-minute static-analysis protocol for any inherited Node.js codebase — human- or AI-written: the three ESLint plugins to install, the jq one-liner that ranks findings by rule, and how to read the heatmap without over-trusting it. Then the same scan on a real Gemini-2.5-Pro corpus: 102 of 140 functions vulnerable, 168 findings, avg CVSS 8.3, and the rules that fired first.#security#node#devsecops+11168 min0
Dec 31, 202513 Security Questions Every JS Interview Asks — and the 9 ESLint Rules That Answer Them in CIThe 13 security concepts that come up in senior JavaScript/Node interviews — SQLi, XSS, CSRF, JWT, prototype pollution, ReDoS, timing attacks — each with the bad-vs-good code, the CWE, and the exact ESLint rule that stops your AI assistant (and you) from shipping the bad version anyway.#security#javascript#node+1009 min0
Dec 31, 2025Your AI Assistant Just Re-Added a 10-Year-Old JWT Bypass. One ESLint Rule Catches It.alg:none is a 2015 disclosure every JWT library patched years ago. It's also exactly the kind of permissive config an AI coding assistant will write back in the moment you ask it to 'support legacy tokens.' Here's the 1-line attack, why jsonwebtoken/jose/express-jwt each handle it differently, and the ESLint rule that catches it regardless of who wrote the code.#security#node#eslint+16 min
Dec 31, 20253 Lines of Vercel AI SDK Code Are a Prompt-Injection Hole — and "Just Sanitize It" Won't Close ItI scanned 356 files across 10 public Vercel AI SDK apps for one prompt-injection bug and found it in an official Vercel template. The exploit, why string sanitization is a trap, and the CWE-74 ESLint rule that enforces a real validation boundary at write-time.#ai#security#javascript+1008 min0