Philosophy

The Interlace Philosophy

ESLint Interlace isn't a single plugin—it's an ecosystem of 18+ specialized plugins. This is by design.

Why Many Plugins?

1. Install Only What You Need

2. Focused Expertise

Each plugin is laser-focused on one domain:

This focus means:

• Deeper coverage — We can go deep instead of broad
• Domain experts — Each plugin maintained by specialists
• Better errors — Context-aware messages, not generic "security issue"

3. Independent Releases

When we fix a JWT vulnerability rule, you don't need to update your entire linting setup. Independent versioning means:

• Surgical updates — Update only affected plugins
• No breaking cascades — One plugin's major version doesn't force others
• Faster iteration — We can ship fixes without coordinating 18 changelogs

The Two Pillars

ESLint Interlace organizes plugins into two main categories:

Design Principles

AI-Native from Day One

Every rule in Interlace includes structured metadata:

// Every error includes:
{
  messageId: 'insecureJwtAlgorithm',
  data: {
    cwe: 'CWE-327',
    owasp: 'A02:2021',
    cvss: 7.5,
    fix: 'Use RS256 or ES256 instead of HS256 with public keys'
  }
}

This enables AI assistants (Copilot, Cursor, Claude) to:

• Understand the severity of issues
• Apply the correct fix without hallucinating
• Prioritize by risk score

Performance First

We don't just add rules—we optimize them:

• 100x faster cycle detection in import-next
• Parallel rule execution where possible
• Lazy AST traversal to avoid unnecessary work

Framework-Aware

Generic rules produce false positives. Framework-aware rules understand context:

• express-security knows Express middleware patterns
• nestjs-security understands decorators and DI
• lambda-security recognizes handler signatures

Adoption Strategies

Start Small

# Week 1: Core security
npm install eslint-plugin-browser-security eslint-plugin-secure-coding

# Week 2: Add framework-specific
npm install eslint-plugin-express-security

# Week 3: Add quality
npm install eslint-plugin-conventions eslint-plugin-reliability

By Stack

Community & Contribution

Each plugin is:

• Open source (MIT licensed)
• Independently maintainable — You can fork just one plugin
• Test-covered — 85%+ coverage for security plugins

We believe security tooling should be transparent. Every rule's logic is visible, testable, and auditable.

Next Steps