Articles
Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.
Dec 31, 2025Exploit Analysis: The JWT Algorithm 'none' Attack (And the Guard)A technical analysis of the most dangerous auth misconfiguration. How to engineering static analysis guards to eliminate 'none' exploits.#eslint#security#jwt+1104 min0
Dec 31, 2025Vulnerability Case Study: Prompt Injection in Vercel AI AgentsA strategic analysis of prompt injection in modern AI applications. How we built the static analysis standard to fix it with one line of code.#eslint#ai#security+1003 min0
Dec 31, 2025Hardening the Data Layer: The node-postgres Engineering StandardEliminate the #1 database vulnerability. An automated static analysis protocol for preventing SQL injection in high-scale Node.js environments.#eslint#postgres#node+1002 min0
Dec 31, 2025The Secret Management Standard: Automating AI Agent ProtectionHardcoded credentials are a governance failure. Learn the static analysis standard for detecting and auto-fixing secrets in AI-native codebases.#eslint#javascript#security+1002 min0
Dec 31, 2025Post-Mortem: Why ESLint Performance Failed (And the 100x Fix)A technical analysis of performance degradation in large-scale static analysis. The engineering journey from 45s to 0.4s linting times.#eslint#javascript#performance+1002 min0
Dec 20, 2025Benchmark Report: Why Most Security Linters Miss 80% of VulnerabilitiesA head-to-head performance and detection benchmark. Measurable proof of how deep static analysis identifies vulnerabilities that incumbent tools miss.#eslint#security#javascript+1005 min0
Dec 20, 2025The AI Security Protocol: Hardening Vercel AI SDK AgentsThe definitive engineering standard for AI-native security. Use automated static analysis to protect agents from LLM-specific vulnerabilities.#eslint#ai#security+1003 min0
Dec 19, 2025The OWASP LLM Protocol: 100% Automated Coverage for Vercel AIA complete mapping of OWASP LLM Top 10 to static analysis rules. The engineering standard for governance in the Vercel AI ecosystem.#eslint#ai#security+1004 min0
Dec 19, 2025Your Vercel AI SDK App Has a Prompt Injection VulnerabilityAutomate the detection and prevention of prompt injection in AI-native SDKs. A measurable protocol for sustaining AI security at scale.#eslint#vercel#ai+1002 min0
Aggregate Benchmarks Lie. Here's What 700 AI Functions Look Like by Security Domain.Part 3 ranked 5 AI models by overall vulnerability rate. But when we broke the data down by security domain — database, auth, file I/O, command execution — the rankings inverted. The 'worst' model fixes 93% of database vulnerabilities. The 'best' model fails at remediation. Aggregate numbers hide domain expertise.#ai#security#googleai+10012 min0- Microsoft's ESLint Security Plugin Catches 10% of Vulnerabilities. Here's What It Misses.A head-to-head benchmark between @microsoft/eslint-plugin-sdl and the Interlace security ecosystem. Microsoft's SDL standard covers 1 of 14 security categories.#security#eslint#javascript+110 min
- SonarJS Has 269 Rules. It Still Misses 65% of Security Vulnerabilities.A head-to-head benchmark between eslint-plugin-sonarjs and the Interlace security ecosystem. 269 rules vs 201 rules — more isn't better when 65% of vulnerabilities slip through.#security#eslint#javascript+112 min
