Skip to main content

Home Articles npm Scorecard

Build Securely.

Engineering Leader & Open Source Creator. Architect of the Interlace ESLint Ecosystem.

GitHub
Dev.to
LinkedIn
X

© 2026 Ofri Peretz. All rights reserved.

Articles

Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.

Filtered by tag #vercel · clear filter

Dec 31, 2025
Your Vercel AI SDK Agent Has 19 Attack Surfaces. Here's an ESLint Rule for Each.
Prompt injection, tool over-permissioning, AI output that reaches eval/SQL/innerHTML, secrets in prompts — the Vercel AI SDK puts every one a single property away. 19 ESLint rules that catch them in CI, before deploy.
#eslint#ai#security+1
009 min0
Dec 31, 2025
3 Lines of Vercel AI SDK Code Are a Prompt-Injection Hole — and "Just Sanitize It" Won't Close It
The 3-line prompt-injection bug in almost every Vercel AI SDK app, the exploit that proves it, why string sanitization is a trap, and the CWE-74 ESLint rule that enforces a real validation boundary at write-time.
#eslint#ai#security+1
005 min0
Dec 20, 2025
Your Vercel AI SDK Agent Can Delete Your Database. 5 ESLint Rules That Gate Every Tool Call.
An agent that hallucinates doesn't just say the wrong thing — it calls the wrong tool. Five CWE-tagged ESLint rules bound an AI agent's agency: tool confirmation, input schemas, step limits, error handling, and abort signals — caught at write-time.
#eslint#ai#security+1
006 min0
Dec 19, 2025
Your Vercel AI SDK App Has a Prompt Injection Vulnerability — in 1 of 3 Places. Here's the ESLint Rule for Each.
Prompt injection has three faces in a Vercel AI SDK app: unvalidated input, a leaky system prompt, and unconfirmed tool calls. Three CWE-tagged ESLint rules catch each at write-time — plus the hardened pattern they want.
#eslint#vercel#ai+1
7 min