{
  "id": 18666390,
  "title": "The Most Precise Plugin in My Benchmark Scored 10.8%",
  "url": "https://urgent.news/2026/11/07/the-most-precise-plugin-in-my-benchmark-scored-10-8",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T07:59:36.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ofri-peretz/the-most-precise-plugin-in-my-benchmark-scored-108-p64"
  },
  "original_language": "en",
  "account": "In a recent benchmark, the most precise ESLint security plugin scored 10.8%. This plugin, named eslint-plugin-no-unsanitized, detected four vulnerabilities out of 69 fixtures written by the plugin's creator. The plugin achieved 80% precision, meaning it correctly identified 80% of the vulnerabilities. While its recall, or the percentage of actual vulnerabilities it found, was not as high as other tools, its high precision makes it a useful tool to keep enabled. The creator emphasizes that a plugin with a high precision and narrow scope is valuable, as a tool that finds more but is wrong more often may be disabled later. The 100% score achieved by the plugin against its own fixtures is expected and serves as a regression gate, ensuring the plugin still detects what it was designed to detect. However, this score does not reflect the plugin's performance in the broader field. The benchmarks were conducted using a specific corpus of 69 vulnerable fixtures, and a plugin's performance on a different surface, such as browser DOM or Angular, may vary. The article stresses that the F1 score, which combines precision and recall, can be misleading, and it suggests that readers should compute these values independently to ensure accuracy. The purpose of the table is not to compare plugins but to provide a scope map and a regression gate. To trust the results, readers are encouraged to run the benchmarks themselves using the provided repository and command.",
  "summary": "Six ESLint security plugins, one labelled corpus of 69 vulnerable fixtures, same harness, same day — eslint-plugin-security@4.0.1 , @microsoft/eslint-plugin-sdl@1.1.0 , ESLint 10.8.1, Node 24. I wrote the fixtures. That sentence has to come before the table, because it changes what every row below is worth. TP, FP and FN are the four boxes everything below is derived from. Plugin TP FP FN F1…",
  "key_points": [
    "eslint-plugin-no-unsanitized scored 10.8% in benchmark",
    "Detected 4 vulnerabilities out of 69 fixtures",
    "High precision makes it useful despite lower recall"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}