DEV Community

Ofri Peretz profile picture

Ofri Peretz

IC5/M2 Leader @ Snappy US. Building revenue APIs & AI-ready ESLint plugins. Expert in distributed teams, scalable infra, and fostering a culture of craftsmanship.

Education

CS

Work

Engineering Manager @ Snappy | Open Source Developer | ESLint for AI tools

Math.random() Is Not Random Enough. I Found It Building API Keys in a 44K-Star Repo.

Math.random() Is Not Random Enough. I Found It Building API Keys in a 44K-Star Repo.

2
Comments
5 min read

Want to connect with Ofri Peretz?

Create an account to connect with Ofri Peretz. You can also sign in below to proceed if you already have an account.

Already have an account? Sign in
Same NestJS Prompt. Claude Got 6 Security Errors. Gemini Got 2. Here's What Both Got Wrong.

Same NestJS Prompt. Claude Got 6 Security Errors. Gemini Got 2. Here's What Both Got Wrong.

2
Comments
6 min read
5 Cycles Invisible in 14,556 Files. The Cache Bug That Hid Them.

5 Cycles Invisible in 14,556 Files. The Cache Bug That Hid Them.

1
Comments
7 min read
import-next/no-cycle Reported 0 Cycles on Next.js. We Found Why — and Fixed It.

import-next/no-cycle Reported 0 Cycles on Next.js. We Found Why — and Fixed It.

1
Comments
5 min read
Claude Wrote a NestJS Service. TypeScript Was Happy. ESLint Found 6 Security Holes.

Claude Wrote a NestJS Service. TypeScript Was Happy. ESLint Found 6 Security Holes.

3
Comments 2
10 min read
I Inherited a NestJS Codebase. The First Lint Run Found 6 Vulnerabilities.

I Inherited a NestJS Codebase. The First Lint Run Found 6 Vulnerabilities.

1
Comments
5 min read
The False Positive Tax: a 1:1 TP:FP analysis of eslint-plugin-security

The False Positive Tax: a 1:1 TP:FP analysis of eslint-plugin-security

Comments
11 min read
I Benchmarked 17 ESLint Security Plugins. Only One Found Every Vulnerability.

I Benchmarked 17 ESLint Security Plugins. Only One Found Every Vulnerability.

Comments
9 min read
no-cycle finds 0 cycles in next.js (and other lies caches tell you)

no-cycle finds 0 cycles in next.js (and other lies caches tell you)

Comments
5 min read
Aggregate Benchmarks Lie. Here's What 700 AI Functions Look Like by Security Domain.

Aggregate Benchmarks Lie. Here's What 700 AI Functions Look Like by Security Domain.

Comments
12 min read
I Found 3 Real Bugs in Popular ESLint Plugins. Unit Tests Didn't Catch Them.

I Found 3 Real Bugs in Popular ESLint Plugins. Unit Tests Didn't Catch Them.

Comments
7 min read
We Ranked 5 AI Models by Security. The Leaderboard Is Wrong.

We Ranked 5 AI Models by Security. The Leaderboard Is Wrong.

2
Comments
9 min read
The AI Hydra Problem: Fix One AI Bug, Get Two More

The AI Hydra Problem: Fix One AI Bug, Get Two More

Comments
12 min read
Microsoft's ESLint Security Plugin Catches 10% of Vulnerabilities. Here's What It Misses.

Microsoft's ESLint Security Plugin Catches 10% of Vulnerabilities. Here's What It Misses.

1
Comments
10 min read
SonarJS Has 269 Rules. It Still Misses 65% of Security Vulnerabilities.

SonarJS Has 269 Rules. It Still Misses 65% of Security Vulnerabilities.

Comments
15 min read
eslint-plugin-security Is Unmaintained. Here's What Nobody Tells You.

eslint-plugin-security Is Unmaintained. Here's What Nobody Tells You.

Comments
8 min read
I Let Claude Write 80 Functions. 65-75% Had Security Vulnerabilities.

I Let Claude Write 80 Functions. 65-75% Had Security Vulnerabilities.

4
Comments 4
12 min read
Exploit Analysis: PostgreSQL COPY FROM Filesystem Access

Exploit Analysis: PostgreSQL COPY FROM Filesystem Access

Comments
4 min read
The Performance Protocol: Solving PostgreSQL N+1 Loops via Static Analysis

The Performance Protocol: Solving PostgreSQL N+1 Loops via Static Analysis

1
Comments 3
3 min read
Exploit Analysis: search_path Hijacking (The Hidden PostgreSQL Attack)

Exploit Analysis: search_path Hijacking (The Hidden PostgreSQL Attack)

Comments
3 min read
Express.js Security Audit: 5 Middleware Vulnerabilities Found in Real Codebases

Express.js Security Audit: 5 Middleware Vulnerabilities Found in Real Codebases

Comments
3 min read
NestJS Security: The 6 Vulnerabilities That Slip Past Code Review

NestJS Security: The 6 Vulnerabilities That Slip Past Code Review

Comments
3 min read
Your AWS Lambda Has 3 Attack Surfaces. Here's How to Find Them in 10 Minutes.

Your AWS Lambda Has 3 Attack Surfaces. Here's How to Find Them in 10 Minutes.

Comments
4 min read
The 10-Minute Browser Security Audit: DOM Vulnerabilities Your Linter Misses

The 10-Minute Browser Security Audit: DOM Vulnerabilities Your Linter Misses

Comments
2 min read
JWT Security Beyond the Algorithm: What Static Analysis Catches in Token Code

JWT Security Beyond the Algorithm: What Static Analysis Catches in Token Code

Comments
3 min read
Node.js Cryptography Has a Blind Spot: What npm audit Misses That ESLint Catches

Node.js Cryptography Has a Blind Spot: What npm audit Misses That ESLint Catches

Comments
2 min read
Performance at Scale: The Static Analysis Standard for 100x Faster Linting

Performance at Scale: The Static Analysis Standard for 100x Faster Linting

Comments
2 min read
Hardening Vercel AI SDK Agents: The Security Vulnerabilities ESLint Catches

Hardening Vercel AI SDK Agents: The Security Vulnerabilities ESLint Catches

Comments
3 min read
Post-Mortem: Race Conditions in PostgreSQL Pools (And the Guard)

Post-Mortem: Race Conditions in PostgreSQL Pools (And the Guard)

Comments
3 min read
Post-Mortem: The Connection Leak That Crashed Production (Caught by One ESLint Rule)

Post-Mortem: The Connection Leak That Crashed Production (Caught by One ESLint Rule)

Comments
3 min read
The 30-Minute OWASP Compliance Audit: Automating Secure Coding Checks with ESLint

The 30-Minute OWASP Compliance Audit: Automating Secure Coding Checks with ESLint

Comments
3 min read
PostgreSQL Security with node-postgres: The SQL Injection Patterns That Slip Through

PostgreSQL Security with node-postgres: The SQL Injection Patterns That Slip Through

Comments
3 min read
The OWASP Compliance Protocol: Mapping 247 Static Analysis Rules

The OWASP Compliance Protocol: Mapping 247 Static Analysis Rules

1
Comments
8 min read
The JavaScript Security Checklist: Covering the OWASP Top 10 with ESLint

The JavaScript Security Checklist: Covering the OWASP Top 10 with ESLint

Comments
4 min read
Exploit Analysis: The JWT Algorithm 'none' Attack (And the Guard)

Exploit Analysis: The JWT Algorithm 'none' Attack (And the Guard)

1
Comments
4 min read
Vulnerability Case Study: Prompt Injection in Vercel AI Agents

Vulnerability Case Study: Prompt Injection in Vercel AI Agents

Comments
3 min read
SQL Injection in node-postgres: The Pattern 80% of Developers Get Wrong

SQL Injection in node-postgres: The Pattern 80% of Developers Get Wrong

Comments
2 min read
The Secret Management Standard: Automating AI Agent Protection

The Secret Management Standard: Automating AI Agent Protection

Comments
2 min read
Post-Mortem: Why ESLint Performance Failed (And the 100x Fix)

Post-Mortem: Why ESLint Performance Failed (And the 100x Fix)

Comments
2 min read
Benchmark Report: Why Most Security Linters Miss 80% of Vulnerabilities

Benchmark Report: Why Most Security Linters Miss 80% of Vulnerabilities

Comments
6 min read
The AI Security Protocol: Hardening Vercel AI SDK Agents

The AI Security Protocol: Hardening Vercel AI SDK Agents

Comments
3 min read
The OWASP LLM Protocol: 100% Automated Coverage for Vercel AI

The OWASP LLM Protocol: 100% Automated Coverage for Vercel AI

Comments
4 min read
Your Vercel AI SDK App Has a Prompt Injection Vulnerability

Your Vercel AI SDK App Has a Prompt Injection Vulnerability

Comments
2 min read
loading...