79 Articles Published

Technical Insights

Deep dives into ESLint security, JavaScript performance, and modern development practices.

79 results

Filter by Topic

#security#node#devsecops+1

The 30-Minute Security Audit: 140 Gemini-Written Functions, 102 Shipped Vulnerable

A 30-minute static-analysis protocol for any inherited Node.js codebase — human- or AI-written: the three ESLint plugins to install, the jq one-liner that ranks findings by rule, and how to read the heatmap without over-trusting it. Then the same scan on a real Gemini-2.5-Pro corpus: 102 of 140 functions vulnerable, 168 findings, avg CVSS 8.3, and the rules that fired first.

Nobody Writes Bad Crypto. They Write Correct Crypto at Four Layers.

Crypto failures are not one mistake repeated. They are four distinct layers of correctness, and each one looks fine from the layer above it.

#ai#security#node+1

I Audited 203 of Our Own ESLint Security Rules. 16% Mislabel Their Own CVSS Score.

A CVSS 9.1 SSRF rule ships labeled LOW. A CVSS 9.8 JWT rule ships labeled MEDIUM. The root cause was one unvalidated string field.

#security#node#devsecops

142,076 Weekly Downloads. Zero Releases Since 2021. Is the Niche Defended?

A Serverless plugin with 142k weekly downloads last shipped a release in 2021. Downloads said taken; the registry said abandoned; the platform's roadmap said something else entirely. The incumbent map — weekly downloads × years since last publish × open-issue decay — is how I decide what to build next, including the pick I shipped against two months before the fact-check caught up with me.

#serverless#aws#opensource+1

We Were Wrong About sls remove

Our loudest serverless claim — 'ghost billing after sls remove' — failed our own E2E run. The trap is real, but it lives on a different path entirely. The full story of re-scoping a claim in public, and why the narrower version came out stronger.

#serverless#aws#devops+1

25% of My Benchmark Verdict Is an Opinion. Here's the Anatomy.

My serverless benchmark prints 0.88 vs 0.3025 — real measurements running on editorial weights. Every index has a committee; the only real question is whether it publishes its votes. Mine are here: seven dimensions, the null policy, and a ±50% attack on the weights.

#serverless#devops#node+1

Marketing Pages Rot Silently. Mine Print an Expiry Date on Every Claim.

The claims registry: one file where every public claim has a row, every row points at a versioned result file, and a 90-day staleness rule decides when a claim must re-earn its place. The contract, the lifecycle, and how any product adopts it in an afternoon.

#security#devsecops#node+1

Fixtures First, Rules Second: How to Design a Ground-Truth Corpus

Building the 40-fixture corpus behind the Interlace security benchmarks meant making 40 judgment calls. The full design discipline: category selection, edge-case labeling, version pinning, corpus lifecycle, robustness checks — and Fixture Cards, a per-fixture documentation standard.

#security#devsecops#javascript

Valid vs. Reliable Metrics: Consistent Numbers Can Still Be Wrong

A clock that runs ten minutes fast is perfectly reliable — the same wrong time every read — and completely invalid. Reliability and validity are independent properties, and confusing them is how confident dashboards stay green while the thing they measure quietly fails.

#security#devsecops#node+1

Static Analysis vs. SAST vs. Linting: The Taxonomy That Matters for Security Teams

A linter runs at edit time. CodeQL runs on your PRs. SonarQube runs in CI. All three get called 'static analysis' — and vendors call the linter 'SAST.' The three are not the same thing, and the differences decide what each can and cannot catch.

#security#devsecops#node+1

Sample Size and Statistical Power: What a Small Sample Can and Cannot Tell You

A small test set is enough to prove a detector misses an entire category. It is not enough to support a confidence interval on a score. Both are true — here's how to know which claims your sample size actually supports.

#security#devsecops#node+1

Proxy Metrics: The Number You Optimize Is Not the Thing You Want

GDP is not prosperity, price is not value, a test score is not learning. Every dashboard number stands in for a construct it can't fully measure — the discipline is knowing each gap and pairing every proxy with the counter-metric that catches its gaming.

#security#devsecops#node+1

Precision, Recall, and F1 for Static Analysis: Same Score, Opposite Tools

A tool with 100% recall and 2% precision and a tool with 2% recall and 100% precision score the same F1: 3.9%. One number cannot tell you which failure mode you're buying. Definitions, the security asymmetry, F-beta, and a worked example with two static-analysis tools that share a precision score and behave nothing alike.

#security#devsecops#node+1

Last synced: Aug 3, 2026, 12:05 AM