Articles

Name: Interlace ESLint Ecosystem
Author: Ofri Peretz

Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.

Filtered by tag #devsecops · clear filter

Getting Started with eslint-plugin-mongodb-security
May 31, 2026
Getting Started with eslint-plugin-mongodb-security
How to prevent MongoDB NoSQL injection, operator injection, and hardcoded connection strings with the only ESLint plugin built specifically for MongoDB/Mongoose.
#security#node#devsecops+1
005 min0
May 29, 2026
Claude Wrote a NestJS Service. TypeScript Was Happy. ESLint Found 6 Security Holes.
I gave Claude one prompt and got 200 lines of correct NestJS. TypeScript compiled clean. Then I ran eslint-plugin-nestjs-security. 6 errors, 3 seconds. Here is what it found and why each one is an AI failure mode.
#ai#security#node+1
0010 min0
May 28, 2026
I Inherited a NestJS Codebase. The First Lint Run Found 6 Vulnerabilities.
The codebase had 2 years of feature PRs and zero security audits. In 30 minutes, a fresh ESLint run surfaced 6 distinct vulnerability classes — auth bypass, sensitive field leaks, brute-force exposure, and three more. Here's what each one looks like and why it survived code review.
#nestjs#security#node+1
008 min0
Dec 31, 2025
8 of the OWASP Top 10 Are ESLint Rules. 2 Aren't — and That's the Honest Audit Answer.
A real, auditable mapping of the OWASP Top 10 (2021) to ten domain-security ESLint plugins: which categories a CWE-tagged rule genuinely catches in CI, and the two (Insecure Design, Vulnerable Components) that need controls beyond source analysis.
#eslint#security#owasp+1
108 min0
Dec 31, 2025
I Inherited a 3,000-Line Codebase. One ESLint Run Found 26 Critical Security Bugs.
How to turn an inherited Node.js codebase into a measurable risk heatmap in one ESLint run: the three plugins to install, the jq one-liner that ranks findings by rule, and how to read the result — 15 SQL injections and 8 hardcoded credentials before your first standup.
#eslint#security#node+1
1165 min0