Articles
Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.
Filtered by tag #devsecops · clear filter
Dec 20, 2025Your ESLint security plugin is missing 58% of vulnerability classes — zero rules for 7 of 12. I have proof, and a correction: my own headline said 80%.A 4-way benchmark on one fixture (12 vulnerability classes): Oxlint's built-in rules, eslint-plugin-security, the Interlace plugins on ESLint, and the same Interlace rules on Oxlint. eslint-plugin-security has rules for 5 of 12 classes — a 58% class-coverage gap. The URL says 80% because the original headline did; the body stands behind the checkable number.#security#node#devsecops+17 min
Dec 20, 2025I Linted 12 AI-Shaped Agent Tools. All 12 Were Missing an Input Schema.I ran eslint-plugin-vercel-ai-security over 12 tool definitions written the way AI assistants wire them: 12/12 had no inputSchema and 6 destructive tools (deleteUser, transferFunds, executeCommand…) had no confirmation gate. Five CWE-tagged ESLint rules bound an AI agent's agency at write-time — and one ungated tool still slipped past.#ai#security#javascript+1008 min0
Dec 19, 2025I Linted Every OWASP LLM Category Against a Real Vercel AI SDK App. 8 Fire. 2 Are Vendor Theater.A real mapping of the OWASP LLM Top 10 (2025) to eslint-plugin-vercel-ai-security: which categories a CWE-tagged rule genuinely catches in source — and why each one survives normal code review.#ai#security#javascript+19 min
Dec 19, 2025Every AI Model Ships a Vulnerability in Half the Code It Writes. Prompt Injection Has 3 Faces in Your Vercel AI SDK App — Here's the ESLint Rule for Each.Across 700 AI-generated functions from five models (measured 2026-02-09), every model shipped a vulnerability in 49–73% of them. Prompt injection has three faces in a Vercel AI SDK app: unvalidated input, a leaky system prompt, and unconfirmed tool calls. Three CWE-tagged ESLint rules catch each at write-time — plus the hardened pattern they want.#ai#security#javascript+18 min