enlightn VS LSP

Enlightn scans your code to check whether it follows best practices in performance, security, and reliability. It's a paid tool, but it also has free checks you can use. At the time of writing, it has 64 checks in the free version and 128 checks in the paid version. For the purposes of this article, we'll only be using the free version.

There are other tools out there, such as Enlightn and Dependabot, that help you to detect dependencies in your project with security vulnerabilities. But I'd like to think of these types of tools more as being "reactive". By that, I mean that they can alert you of vulnerable dependencies after you've installed them in your project. This can result in you introducing potential security holes into your applications without being aware at first. This is by no means a discredit to any of these types of tools though. Vulnerabilities are always being discovered in frameworks, packages, and libraries. So being able to detect them is a great way to stay on top of your project's security.

In this article, we're going to briefly look at different things to look out for when auditing your app's security, or adding new validation. We'll also look at how you can use "Enlightn" to detect potential mass assignment vulnerabilities.

Checkout laravel enlghtn, scans all dependencies, we have it wired for all prs and nightly on all code bases. https://www.laravel-enlightn.com/

you can also check https://www.laravel-enlightn.com

Uhh did you check the link? It's another product. The security checker is an independent package. The Enlightn Github repo is here and the security checker is here. Lol you were so busy criticizing about emojis, you don't even know what I was talking about.

I saw no mention of RBS+Steep, the latter providing a LSP. I use it a lot and very much like it, although it's still young and needs love, but it's making good, steady progress! I've been very pleasantly surprised by some of the crazy things Steep can catch, completely statically!

You appear to be working on projects with Sorbet (which I tried to like but found it fell short in practice, notably outside of the app use case i.e it's mostly useless for gems) so it may be a tall order to try on those. Maybe you can give RBS+Steep a shot on some small project?

RBS: https://github.com/ruby/rbs

RBS collection (for those gems that don't ship RBS signatures in `sig`, integrates with bundler): https://github.com/ruby/gem_rbs_collection

Steep: https://github.com/soutaro/steep

VS Code: https://github.com/soutaro/steep-vscode

Sublime Text: https://github.com/sublimelsp/LSP

Vim (I'm working on it): https://github.com/dense-analysis/ale/pull/4671

Psalm - support for Psalm can be added via the LSP plugin. More information about it can be found in Psalm's documentation.

You obviously never tried the various LSP plugins for ST. It will give you the same intelllgent code tools as the jetbrains IDEs, which goes way beyond just syntax highlighting and linting and there's support for a lot of languages. https://lsp.sublimetext.io/

Add in this and you're golden: https://github.com/sublimelsp/LSP

https://github.com/sublimelsp/LSP with https://github.com/sublimelsp/LSP-typescript works pretty well for me. They are also both being actively maintained. It'd be nice if it was built-in, but it works well enough that I still have not found a compelling reason to switch to VSCode.

I really love sublime and it doesn't seem to be dead just yet. Sublime Text 4 was also a pretty great release.

I tried sublime this year now that it has an LSP (language server), along with the Go plugin. Maybe it would take more getting used to, but VSCode has done such a great job for coding in. Sublime's project view just wasn't as good either.

I really still like sublime for editing text or log files on my dev system, but not for development.

https://github.com/sublimelsp/LSP

not a fan of that but there is https://github.com/sublimelsp/LSP/pull/1702

That's great, try it with SublimeLSP and gopls.