Articles
Engineering writing on static analysis, ESLint, security, and AI-native developer tooling.
- eslint-plugin-security Is Unmaintained. Here's What Nobody Tells You.eslint-plugin-security has 1.5M weekly downloads but only 13 rules and no meaningful updates since 2020. Learn why it misses 90% of vulnerabilities—including SQL injection, JWT attacks, and AI/LLM security—and what modern ESLint security plugins to use instead.#security#eslint#javascript+19 min
The AI Hydra Problem: Fix One AI Bug, Get Two MoreWhen AI models fix security vulnerabilities, they sometimes introduce entirely new ones. I tested this across 3 remediation rounds with Claude Opus 4.6 using two approaches — ESLint-guided feedback vs. prompt engineering alone. The results expose a fundamental limit of 'fix it again' workflows.#ai#security#javascript+117 min
We Ranked 5 AI Models by Security. The Leaderboard Is Wrong.700 AI-generated functions. 5 models. The cheapest model leads the aggregate leaderboard — but one model writes perfect JWT code where the flagship fails every time, and the 'worst' model fixes 93% of database bugs. The rankings don't tell you any of this.#ai#security#googleai+1009 min0
What ground truth caught that unit tests missed: 3 real bugs in 9 flagship lint rulesA 5KB ground-truth corpus failed three flagship ESLint rules at F1=1.00 the moment we ran it. Months of green unit tests missed every bug. Three diagnostics, three fixes.#staticanalysis#eslint#testing+19 min
