88 Articles Published

Articles

Deep dives into ESLint security, JavaScript performance, and modern development practices.

88 results

Filter by Topic

#security#node#devsecops+1

My credential rule reported 842 secrets in vercel/ai. The real count was 0.

Entropy-based credential detection misses a surprising share of hardcoded secrets — because most secrets look like regular strings until you see their context. Our no-hardcoded-credentials rule fired 842 times on vercel/ai. The peer plugin fired 380. I assumed we had better recall — until I sampled. 807 of the 'extra' findings were TypeScript union-type literals, error class names, and the string 'test'. Here's what catches the rest.

My Benchmark Judged Five Models Against a Threshold Built for Three

Every degree of freedom the table did not know about borrowed the df=2 threshold. It fired once, got the right answer, and nobody noticed for four months.

#javascript#testing#benchmarking

Your ESLint Plugin Installs 205 Packages. 69 Are ESLint.

I measured the install tree of 11 ESLint plugins. Direct dependency counts predict almost nothing, and every raw number hides the same 69-package baseline.

#javascript#webdev#node

The 3 Most-Installed ESLint Plugins Went Quiet in 2025

I measured days-since-release for 18 ESLint plugins. import, react and jsx-a11y have shipped nothing in over a year — and dormant is not the same as dead.

#javascript#webdev#opensource

ESLint Ships in 459 KB, So My Blog Posts Lint Your Code

ESLint's linter ships in 459 KB with two real security plugins inside it. Here's the esbuild recipe that puts a working linter inside a blog post.

#javascript#webdev#showdev

I Ran My Plugins Against a Competitor's Own Test Suite

eslint-plugin-security ships its tests. I ran 84 of its own vulnerable samples through my plugins: 51 caught, and 29 of the 33 misses are one obsolete rule.

#security#javascript#webdev

My 9-Reviewer AI Gate Failed Articles It Scored 9.1

A reviewer scored 10.0 and its clean bill of health parsed as a blocker. Three ways my LLM-judge gate failed work it had just praised.

#ai#webdev#testing

I Linted My Own Design System. All 8 Breaks Were Pasted In.

I ran four design-system rules over 401 of my own components. 144 violations — and every color break was in code I pasted in.

#react#webdev#css

Your Token Is Not Safer in a Cookie. It Is Safer From JavaScript.

The localStorage-versus-cookies argument is about the wrong axis. One property decides whether an XSS bug reads your session — and it is not the container.

#webdev#security#javascript+1

innerHTML Has Five Doors. Most Reviews Only Watch One.

A DOM sink is easy to grep for. The hard part is that one sink has many sources, and the source is where the trust decision actually lives — not the assignment.

#ai#webdev#security

Nobody Writes Bad Crypto. They Write Correct Crypto at Four Layers.

Crypto failures are not one mistake repeated. They are four distinct layers of correctness, and each one looks fine from the layer above it.

#ai#security#node+1

I Audited 203 of Our Own ESLint Security Rules. 16% Mislabel Their Own CVSS Score.

A CVSS 9.1 SSRF rule ships labeled LOW. A CVSS 9.8 JWT rule ships labeled MEDIUM. The root cause was one unvalidated string field.

#security#node#devsecops

142,076 Weekly Downloads. Zero Releases Since 2021. Is the Niche Defended?

A Serverless plugin with 142k weekly downloads last shipped a release in 2021. Downloads said taken; the registry said abandoned; the platform's roadmap said something else entirely. The incumbent map — weekly downloads × years since last publish × open-issue decay — is how I decide what to build next, including the pick I shipped against two months before the fact-check caught up with me.

#serverless#aws#opensource+1

Last synced: Sep 17, 2026, 12:18 PM