TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679
JavaScript Jabber29 Mai 2025

TypeScript, Security, and Type Juggling with Ariel Shulman & Liran Tal - JSJ 679

In this episode, we dove headfirst into the swirling waters of TypeScript, its real-world use cases, and where it starts to fall short—especially when it comes to security. Joining us from sunny Tel Aviv (and a slightly cooler Portland), we had the brilliant Ariel Shulman and security advocate Liran Tal bring the heat on everything from type safety to runtime vulnerabilities.


We started off with a friendly debate: Has TypeScript really taken over the world? Our verdict? Pretty much. Whether it’s starter projects, enterprise codebases, or AI-generated snippets, TypeScript has become the de facto standard. But as we quickly found out, that doesn’t mean it’s perfect.


Key Takeaways:
-TypeScript ≠ Security
We tend to trust TypeScript a bit too much. It’s a build-time tool, not a runtime enforcer. As Liran pointed out, “TypeScript is not a security tool,” and treating it like one leads to dangerous assumptions.
-Type Juggling is Real (and Sneaky)
We explored how something as innocent as using as string on request data can open the door to vulnerabilities like HTTP parameter pollution and prototype pollution. Just because your IDE is happy doesn’t mean your runtime is.
-Enter Zod – Runtime Type Checking to the Rescue?
Zod got some love for bridging the dev-time/runtime gap by validating data on the fly and inferring TypeScript types. But even Zod isn’t foolproof. For example, unless you're using .strict(), extra fields can sneak past your validations, leading to mass assignment bugs.
-Common Developer Fallacies
We discussed the misplaced confidence developers have in things like code coverage and TypeScript alone. One of the big takeaways: defense in depth matters. Just like testing, layering your security practices (like using Zod, type guards, and proper sanitization) is key.
-TypeScript Best Practices Are Evolving
From discriminated unions to avoiding any, from using Maps over plain objects to prevent prototype pollution—TypeScript developers are adapting. And tools like modern Node.js now support type stripping, which makes working with .ts files at runtime a bit easier.


Become a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

Episoder(734)

118 JSJ Web Developer Skills

118 JSJ Web Developer Skills

The panelists talk about what skills you need to be considered a professional web developer. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

23 Jul 201455min

117 JSJ The Koa Framework with Gerred Dillon and Will Conant

117 JSJ The Koa Framework with Gerred Dillon and Will Conant

The panelists discuss the Koa Framework with Gerred Dillon and Will Conant.Special Guests: Gerred Dillon and Will Conant. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

16 Jul 20146min

116 JSJ jQuery UI vs KendoUI with Burke Holland and TJ VanToll

116 JSJ jQuery UI vs KendoUI with Burke Holland and TJ VanToll

The panelists discuss jQuery vs KendoUI with Burke Holland and TJ VanToll.Special Guests: Burke Holland and TJ VanToll. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

9 Jul 20141h 2min

115 JSJ The ES6 Module Loader Polyfill, SystemJS, and jspm with Guy Bedford

115 JSJ The ES6 Module Loader Polyfill, SystemJS, and jspm with Guy Bedford

the panelists discuss the ES6 module loader polyfill, SystemJS, and jspm with Guy Bedford.Special Guest: Guy Bedford. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

2 Jul 201445min

114 JSJ Asynchronous UI and Non-Blocking Interactions with Elliott Kember

114 JSJ Asynchronous UI and Non-Blocking Interactions with Elliott Kember

The panelists talk to Elliot Kember about asynchronous UI and non-blocking interactions.Special Guest: Elliott Kember. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

25 Jun 201456min

113 JSJ Community Dynamics with Reginald Braithwaite

113 JSJ Community Dynamics with Reginald Braithwaite

The panelists talk to Reginald Braithwaite about the dynamics of the JavaScript community.Special Guest: Reginald Braithwaite. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

18 Jun 201449min

112 JSJ Refactoring JavaScript Apps Into a Framework with Brandon Hays

112 JSJ Refactoring JavaScript Apps Into a Framework with Brandon Hays

The panelists talk about refactoring JavaScript Apps Into a Framework with Brandon Hays.Special Guest: Brandon Hays. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

11 Jun 201459min

111 JSJ The Ember.js Project with Erik Bryn

111 JSJ The Ember.js Project with Erik Bryn

The panelists talk to Erik Bryn about the Ember.js project.Special Guest: Erik Bryn. Support this podcast at — https://redcircle.com/javascript-jabber/donationsPrivacy & Opt-Out: https://redcircle.com/privacyBecome a supporter of this podcast: https://www.spreaker.com/podcast/javascript-jabber--6102064/support.

4 Jun 20141h 8min

Populært innen Business og økonomi

stopp-verden
lydartikler-fra-aftenposten
dine-penger-pengeradet
rss-penger-polser-og-politikk
e24-podden
pengepodden-2
rss-borsmorgen-okonominyhetene
utbytte
tid-er-penger-en-podcast-med-peter-warren
pengesnakk
morgenkaffen-med-finansavisen
lederpodden
okonomiamatorene
livet-pa-veien-med-jan-erik-larssen
rss-investering-gjort-enkelt
paretopodden
finansredaksjonen
stormkast-med-valebrokk-stordalen
voksenpoeng-en-guide-til-voksenlivet
rss-fri-kontantstrom