Nine security vulnerabilities that slip past linters undetected

A technical post on DEV Community outlines nine dangerous coding anti-patterns that standard linters consistently fail to flag, despite the code being syntactically valid and passing CI checks. The patterns include use of eval() with user-controlled input, raw SQL string concatenation vulnerable to injection, and predictable random number generators used for security tokens. Other risks highlighted are ReDoS-prone regular expressions, hardcoded localhost URLs left over from development, and disabled SSL certificate verification that exposes apps to man-in-the-middle attacks. The article argues that linters are designed to enforce style rather than security, meaning these flaws can survive code review and reach production undetected. Developers are advised to use parameterised queries, cryptographically secure random functions, and environment variables to mitigate these risks.