97 Articles Published

Articles

Deep dives into ESLint security, JavaScript performance, and modern development practices.

97 results

Filter by Topic

#security#node#devsecops+1

My credential rule reported 842 secrets in vercel/ai. The real count was 0.

Entropy-based credential detection misses a surprising share of hardcoded secrets — because most secrets look like regular strings until you see their context. Our no-hardcoded-credentials rule fired 842 times on vercel/ai. The peer plugin fired 380. I assumed we had better recall — until I sampled. 807 of the 'extra' findings were TypeScript union-type literals, error class names, and the string 'test'. Here's what catches the rest.

Rename the Variable, Change the Security Verdict

One of my own rules flags a Zod schema containing no XPath, and stays silent on textbook XPath injection. Both come from the same heuristic: it decides whether a value is attacker-controlled by substring-matching the variable's name.

#security#webdev#javascript

Six Rules Found Nothing. Only Five of Them Were Waiting.

A lint rule sitting at zero is one of three different things, and reading the rule list will not tell you which. Asking each rule to fire on its own test fixture takes ten seconds — and on six silent rules it found one that could never have fired at all.

#javascript#webdev#testing

13 Repos Keep a Credential in Web Storage. Seven Are Governments.

A field study of 1,423 storage call sites in 189 public repositories. The practice is rarer than the argument about it, and it concentrates somewhere specific.

#webdev#security#javascript

I Linted 14 Public AI SDK Repos. 12 Ship a Call With No Token Ceiling.

A field study of 116 generation call sites across 14 public repositories, including five of the SDK vendor's own. The output cap is the one almost nobody sets.

#ai#webdev#security

Your LLM Call Has No Ceiling. TypeScript Is Fine With It. Three CWEs Aren't.

An AI SDK call with no token cap, no timeout and no abort signal is three distinct CWEs hiding in one missing config object.

#ai#webdev#security

Everyone Greps for SQL Injection. Nobody Greps for the Other Eight.

SQL injection has a name everyone knows. Eight more injections aim the same defect at parsers nobody audits: GraphQL, LDAP, XPath, XXE, template and more.

#javascript#security#webdev+1

One Import Moves a commander CLI to burgee. --json Still Says null.

Swapping commander for burgee/commander kept 7 of 7 invocations byte-identical and added --schema, MCP and completions. Getting data out took a return.

#node#javascript#webdev+1

A commander Stack Installs 70 Packages, burgee's Family 9. Like for Like, the Family Weighs 2.4 More.

Part 2 of the dependency-weight method: nine CLI layers, counted. 70 packages from 25 npm accounts against 9 from one, the rows where the nine weigh more, and three unmet gates.

#node#javascript#cli+1

55 Places My Code Predates the Language. All Auto-Fixed.

Four rules over 389 of my own files found 55 spots written the pre-2022 way. Every one carried a fixer, so the whole thing was one command.

#javascript#webdev#typescript

My Benchmark Judged Five Models Against a Threshold Built for Three

Every degree of freedom the table did not know about borrowed the df=2 threshold. It fired once, got the right answer, and nobody noticed for four months.

#javascript#testing#benchmarking

Your ESLint Plugin Installs 205 Packages. 69 Are ESLint.

I measured the install tree of 11 ESLint plugins. Direct dependency counts predict almost nothing, and every raw number hides the same 69-package baseline.

#javascript#webdev#node

The 3 Most-Installed ESLint Plugins Went Quiet in 2025

I measured days-since-release for 18 ESLint plugins. import, react and jsx-a11y have shipped nothing in over a year — and dormant is not the same as dead.

#javascript#webdev#opensource

Last synced: Oct 25, 2026, 06:30 PM