Articles
Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.
Filtered by tag #googleai · clear filter
May 31, 2026Claude vs Gemini Across 4 Security Domains: A Dead Heat — and the Hardening 63% of AI Code SkipsSame prompts, both CLIs, scored by the ESLint security plugins I wrote. Gemini tied Claude on JWT and MongoDB, won the NestJS round, and never shipped a high-severity injection bug. The real finding: both frontier models miss the exact same hardening — the negative space static analysis was built for.#ai#security#googleai+110 min
May 30, 2026Same NestJS Prompt. Claude Got 6 Security Errors. Gemini Got 2. Here's What Both Got Wrong.Same prompt. Claude Sonnet 4.6 got 6 security errors from eslint-plugin-nestjs-security. Gemini 2.5 Flash got 2. Both missed rate limiting on auth endpoints — and Gemini got guards, validators, and serialization right where Claude didn't.#ai#security#googleai+1009 min0
Feb 8, 2026SonarJS Has 269 Rules. It Still Missed 26 of My 40 Node.js Vulnerabilities.A reproducible fixture benchmark: eslint-plugin-sonarjs (269 rules) vs the Interlace security plugins on 40 known vulnerabilities. SonarJS is one of the best quality linters in the ecosystem — which is exactly why a green run isn't a clean Node.js security bill. Recall 35%, the 26 it misses, why they survive review, and what happens when Claude and Gemini write them. Result JSON linked.#security#eslint#devsecops+59 min