99 Articles Published

Articles

Deep dives into ESLint security, JavaScript performance, and modern development practices.

99 results

Filter by Topic

#security#node#devsecops+1

The 30-Minute Security Audit: 140 Gemini-Written Functions, 102 Shipped Vulnerable

A 30-minute static-analysis protocol for any inherited Node.js codebase — human- or AI-written: the three ESLint plugins to install, the jq one-liner that ranks findings by rule, and how to read the heatmap without over-trusting it. Then the same scan on a real Gemini-2.5-Pro corpus: 102 of 140 functions vulnerable, 168 findings, avg CVSS 8.3, and the rules that fired first.

My Harness Reported 0 Findings on 100 Files. All 100 Were Ignored.

Three separate mechanisms make an ESLint run report zero while reading nothing — and every one of them exits 0 with an empty stderr. A clean bill of health and a file nobody opened are the same output.

#javascript#testing#webdev

My Plugin Has 14 Rules. Two of Them Found 60% of Everything.

I pointed my own React plugin at a public codebase and counted per rule. 308 findings, and two rules produced 184 of them. Six rules produced nothing at all — and the reason that is not a bug is the whole article.

#javascript#react#webdev

Rename the Variable, Change the Security Verdict

One of my own rules flags a Zod schema containing no XPath, and stays silent on textbook XPath injection. Both come from the same heuristic: it decides whether a value is attacker-controlled by substring-matching the variable's name.

#security#webdev#javascript

Six Rules Found Nothing. Only Five of Them Were Waiting.

A lint rule sitting at zero is one of three different things, and reading the rule list will not tell you which. Asking each rule to fire on its own test fixture takes ten seconds — and on six silent rules it found one that could never have fired at all.

#javascript#webdev#testing

13 Repos Keep a Credential in Web Storage. Seven Are Governments.

A field study of 1,423 storage call sites in 189 public repositories. The practice is rarer than the argument about it, and it concentrates somewhere specific.

#webdev#security#javascript

I Linted 14 Public AI SDK Repos. 12 Ship a Call With No Token Ceiling.

A field study of 116 generation call sites across 14 public repositories, including five of the SDK vendor's own. The output cap is the one almost nobody sets.

#ai#webdev#security

Your LLM Call Has No Ceiling. TypeScript Is Fine With It. Three CWEs Aren't.

An AI SDK call with no token cap, no timeout and no abort signal is three distinct CWEs hiding in one missing config object.

#ai#webdev#security

Everyone Greps for SQL Injection. Nobody Greps for the Other Eight.

SQL injection has a name everyone knows. Eight more injections aim the same defect at parsers nobody audits: GraphQL, LDAP, XPath, XXE, template and more.

#javascript#security#webdev+1

One Import Moves a commander CLI to burgee. --json Still Says null.

Swapping commander for burgee/commander kept 7 of 7 invocations byte-identical and added --schema, MCP and completions. Getting data out took a return.

#node#javascript#webdev+1

A commander Stack Installs 70 Packages, burgee's Family 9. Like for Like, the Family Weighs 2.4 More.

Part 2 of the dependency-weight method: nine CLI layers, counted. 70 packages from 25 npm accounts against 9 from one, the rows where the nine weigh more, and three unmet gates.

#node#javascript#cli+1

55 Places My Code Predates the Language. All Auto-Fixed.

Four rules over 389 of my own files found 55 spots written the pre-2022 way. Every one carried a fixer, so the whole thing was one command.

#javascript#webdev#typescript

My Benchmark Judged Five Models Against a Threshold Built for Three

Every degree of freedom the table did not know about borrowed the df=2 threshold. It fired once, got the right answer, and nobody noticed for four months.

#javascript#testing#benchmarking

Last synced: Nov 3, 2026, 02:36 PM