TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679
JavaScript Jabber29 Touko 2025

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Jaksot(735)

143 JSJ Teaching Programming and Computer Science with Pamela Fox

143 JSJ Teaching Programming and Computer Science with Pamela Fox

Pamela Fox and the rest of the gang talk about teaching programming and Computer Science.Special Guest: Pamela Fox. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

21 Tammi 20151h 17min

142 JSJ Share.js with Joseph Gentle

142 JSJ Share.js with Joseph Gentle

The panel discusses Share.js with Joseph GentleSpecial Guest: Joseph Gentle. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

14 Tammi 201530min

141 JSJ Firefox OS with Jason Weathersby

141 JSJ Firefox OS with Jason Weathersby

The panelists talk about Firefox OS with Jason Weathersby.Special Guest: Jason Weathersby. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

7 Tammi 20153min

140 JSJ Using Art to Get and Keep People Interested in Programming with Jenn Schiffer

140 JSJ Using Art to Get and Keep People Interested in Programming with Jenn Schiffer

The panelists talk to Jenn Schiffer about using art to get and keep people interested in programming.Special Guest: Jenn Schiffer. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

31 Joulu 201452min

139 JSJ The Mozilla Developer Network with Les Orchard and David Walsh

139 JSJ The Mozilla Developer Network with Les Orchard and David Walsh

The panelists talk about the Mozilla Developer Network with Les Orchard and David Walsh.Special Guests: David Walsh and Les Orchard. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

24 Joulu 201454min

138 JSJ {Track:js} with Todd Gardner

138 JSJ {Track:js} with Todd Gardner

The panelists talk {Track:js} with Todd Gardner.Special Guest: Todd Gardner. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

17 Joulu 20141h 2min

137 JSJ &yet with Henrik Joreteg and Phil Roberts

137 JSJ &yet with Henrik Joreteg and Phil Roberts

The panelists talk to Henrik Joreteg and Philip Roberts of &yet.Special Guests: Henrik Joreteg and Philip Roberts. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

10 Joulu 20141h 1min

136 JSJ TrackingJS with Eduardo Lundgren

136 JSJ TrackingJS with Eduardo Lundgren

The panelists discuss TrackingJS with Eduardo Lundgren.Special Guest: Eduardo Lundgren. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

3 Joulu 201447min

Suosittua kategoriassa Liike-elämä ja talous

sijotuskasti
psykopodiaa-podcast
mimmit-sijoittaa
rss-rahapodi
herrasmieshakkerit
ostan-asuntoja-podcast
hyva-paha-johtaminen
taloudellinen-mielenrauha
rss-lahtijat
sijoituskaverit
rss-rahamania
rss-huomisen-talous
rss-merja-mahkan-rahat
rss-sisalto-kuntoon
rss-lentopaivakirjat
rss-vaikuttavan-opettajan-vierella
rss-neuvottelija-sami-miettinen
kasvun-kipuja
rss-bisnesta-bebeja
rss-paasipodi