38 Articles Published

Technical Insights

Deep dives into ESLint security, JavaScript performance, and modern development practices.

38 results

Filter by Topic

#security#node#devsecops

The 30-Minute Security Audit: A Static Analysis Protocol for Onboarding

A data-driven protocol for assessing a new codebase in under 30 minutes. Use automated static analysis to generate immediate risk heatmaps for CTOs and VPs.

I Inherited a NestJS Codebase. The First Lint Run Found 6 Vulnerabilities.

The codebase had 2 years of feature PRs and zero security audits. In 30 minutes, a fresh ESLint run surfaced 6 distinct vulnerability classes.

#eslint#nestjs#security+1

no-cycle finds 0 cycles in next.js (and other lies caches tell you)

Our import-next/no-cycle reported 0 cycles in next.js's 14K-file repo. oxlint reported 17. The same rule, run on a 33-file subset of the same repo, found 5+. The bug: cache pollution from a depth-truncated DFS marking files as 'known acyclic' that hadn't been fully explored.

#staticanalysis#performance#algorithms

Aggregate Benchmarks Lie. Here's What 700 AI Functions Look Like by Security Domain.

Part 3 ranked 5 AI models by overall vulnerability rate. But when we broke the data down by security domain — database, auth, file I/O, command execution — the rankings inverted. The 'worst' model fixes 93% of database vulnerabilities. The 'best' model fails at remediation. Aggregate numbers hide domain expertise.

#ai#security#googleai+1

What ground truth caught that unit tests missed: 3 real bugs in 9 flagship lint rules

A 5KB ground-truth corpus failed three flagship ESLint rules at F1=1.00 the moment we ran it. Months of green unit tests missed every bug. Three diagnostics, three fixes.

#staticanalysis#testing#benchmarks

We Ranked 5 AI Models by Security. The Leaderboard Is Wrong.

700 AI-generated functions. 5 models. The cheapest model leads the aggregate leaderboard — but one model writes perfect JWT code where the flagship fails every time, and the 'worst' model fixes 93% of database bugs. The rankings don't tell you any of this.

#ai#security#googleai+1

The AI Hydra Problem: Fix One AI Bug, Get Two More

When AI models fix security vulnerabilities, they sometimes introduce entirely new ones. I tested this across 3 remediation rounds with Claude Opus 4.6 using two approaches — ESLint-guided feedback vs. prompt engineering alone. The results expose a fundamental limit of 'fix it again' workflows.

#ai#security#javascript

Microsoft's ESLint Security Plugin Catches 10% of Vulnerabilities. Here's What It Misses.

A head-to-head benchmark between @microsoft/eslint-plugin-sdl and the Interlace security ecosystem. Microsoft's SDL standard covers 1 of 14 security categories.

#security#javascript#benchmark

SonarJS Has 269 Rules. It Still Misses 65% of Security Vulnerabilities.

A head-to-head benchmark between eslint-plugin-sonarjs and the Interlace security ecosystem. 269 rules vs 201 rules — more isn't better when 65% of vulnerabilities slip through.

#security#javascript#benchmark

eslint-plugin-security Is Unmaintained. Here's What Nobody Tells You.

eslint-plugin-security has 1.5M weekly downloads but only 13 rules and no meaningful updates since 2020. Learn why it misses 90% of vulnerabilities—including SQL injection, JWT attacks, and AI/LLM security—and what modern ESLint security plugins to use instead.

#security#javascript#node

I Let Claude Write 80 Functions. 65-75% Had Security Vulnerabilities.

AI coding assistants are incredible—until they introduce security holes. I ran an experiment asking Claude (Haiku 3.5, Sonnet 4.5, Opus 4.5, Opus 4.6) to generate 80 common Node.js functions with zero security context using my Claude Pro subscription. 65-75% had vulnerabilities. Then I tested if static analysis could help the models fix their own mistakes.

#ai#security#javascript

Exploit Analysis: PostgreSQL COPY FROM Filesystem Access

A deep dive into PostgreSQL filesystem exploits. Learn how to engineer static analysis guards to prevent unauthorized database-level file access.

#postgres#security#node

The Performance Protocol: Solving PostgreSQL N+1 Loops via Static Analysis

Eliminate API performance bottlenecks at the commit level. A case study on detecting and fixing architectural N+1 patterns programmatically.

#postgres#performance#node

Last synced: May 24, 2026, 03:20 AM