TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679
JavaScript Jabber29 Mai 2025

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Episoder(735)

127 JSJ Changes in npm-Land with Forrest Norvell, Rebecca Turner, Ben Coe, and Isaac Z. Schlueter

127 JSJ Changes in npm-Land with Forrest Norvell, Rebecca Turner, Ben Coe, and Isaac Z. Schlueter

The panelists discuss changes in the npm package manager with Forrest Norvell, Rebecca Turner, Ben Coe, and Isaac Z. Schlueter.Special Guests: Ben Coe, Forrest Norvell, Isaac Schleuter, and Rebecca Turner. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

24 Sep 201456min

126 JSJ The Ionic Framework with Max Lynch and Tyler Renelle

126 JSJ The Ionic Framework with Max Lynch and Tyler Renelle

The panelists discuss the Ionic Framework with Max Lynch and Tyler Renelle.Special Guests: Max Lynch and Tyler Renelle. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

17 Sep 201459min

125 JSJ WebGL with Sean Griffin

125 JSJ WebGL with Sean Griffin

The panelists discuss WebGL with Sean Griffin.Special Guest: Sean Griffin. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

10 Sep 201443min

124 JSJ The Origin of Javascript with Brendan Eich

124 JSJ The Origin of Javascript with Brendan Eich

The panelists talk to Brendan Eich, the creator of JavaScript.Special Guest: Brendan Eich. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

3 Sep 20141h 44min

123 JSJ Traceur with Erik Arvidsson

123 JSJ Traceur with Erik Arvidsson

The panelists chat with Erik Arvidsson about Traceur.Special Guest: Erik Arvidsson. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

27 Aug 201431min

122 JSJ Socket.IO with Guillermo Rauch

122 JSJ Socket.IO with Guillermo Rauch

The panelists talk to Guillermo Rauch about Socket.io.Special Guest: Guillermo Rauch. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

20 Aug 201448min

121 JSJ Broccoli.js with Jo Liss

121 JSJ Broccoli.js with Jo Liss

The panelists discuss Broccoli.js with its creator, Jo Liss.Special Guest: Jo Liss. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

13 Aug 201437min

120 JSJ Google Polymer with Rob Dodson and Eric Bidelman

120 JSJ Google Polymer with Rob Dodson and Eric Bidelman

The panelists talk to Rob Dodson and Eric Bidelman about the Google Polymer project and Google I/O.Special Guests: Eric Bidelman and Rob Dodson . Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

6 Aug 20141h

Populært innen Business og økonomi

stopp-verden
dine-penger-pengeradet
lydartikler-fra-aftenposten
rss-penger-polser-og-politikk
e24-podden
rss-borsmorgen-okonominyhetene
utbytte
pengepodden-2
finansredaksjonen
tid-er-penger-en-podcast-med-peter-warren
morgenkaffen-med-finansavisen
pengesnakk
rss-investering-gjort-enkelt
rss-markedspuls-2
lederpodden
rss-fa-makro
livet-pa-veien-med-jan-erik-larssen
lederskap-nhhs-podkast-om-ledelse
shifter
boligbobla