TL;DR
ESLint finds bugs and security issues in JavaScript and TypeScript. Prettier only formats code, and it has no security features at all. You want both: ESLint with security plugins to catch vulnerabilities, Prettier to keep the formatting consistent, and both running in CI on your vibe-coded app.
ESLint and Prettier get mentioned in the same breath, but they don't do the same job. ESLint is a linter: it finds bugs and enforces code patterns. Prettier is a formatter. It makes your code look consistent. If you care about security, ESLint is the one that matters. Here's how they compare and how to run them together.
Comparison Overview
| Feature | ESLint | Prettier |
|---|---|---|
| Primary Purpose | Bug/pattern detection | Code formatting |
| Security Rules | Yes (with plugins) | No |
| Auto-fix | Some rules | All formatting |
| Custom Rules | Extensive | Very limited |
| Performance Impact | Moderate | Fast |
| CI Integration | Essential | Recommended |
ESLint Security Features
Security-Focused Plugins
On its own, ESLint isn't much of a security tool. The plugins are where it earns that:
- eslint-plugin-security: Detects common Node.js security issues
- eslint-plugin-no-unsanitized: Prevents XSS via innerHTML and similar
- eslint-plugin-security-node: Additional Node.js security rules
- @typescript-eslint: Type-aware rules that catch potential issues
Security Rules Examples
ESLint security plugins catch issues like:
// security/detect-non-literal-regexp
new RegExp(userInput) // Dangerous: ReDoS vulnerability
// security/detect-eval-with-expression
eval(userCode) // Dangerous: Code injection
// no-unsanitized/property
element.innerHTML = userData // Dangerous: XSS
Prettier's Role
What Prettier Does
Prettier formats code for consistent style: indentation, line length, quotes, semicolons. It has no concept of bugs or security, so it won't catch a vulnerability or enforce a secure pattern. What it does is end style debates and keep the code readable.
Why Formatting Matters
Prettier doesn't make code safer directly. It makes review easier. When every file looks the same, a reviewer reads for logic and security instead of tripping over style, and a better review catches more.
ESLint's Security Value: This is the one that catches security issues while you build. Add the security plugins and run it in CI, and vulnerabilities get flagged before they reach production. One rule can block a whole class of bug.
Prettier's Value: Consistent formatting, which makes code easier to read and review. It has no direct security value. Run it alongside ESLint, never instead of real security tooling.
Using Both Together
Recommended Setup
Run both. ESLint handles logic and security, Prettier handles formatting, and eslint-config-prettier switches off the ESLint formatting rules that would fight Prettier.
- Install both as dev dependencies
- Configure ESLint with security plugins
- Use eslint-config-prettier to avoid conflicts
- Run both in CI pipeline
- Enable editor integration for both
Security Best Practices
- Enable eslint-plugin-security for Node.js projects
- Use no-unsanitized plugin for browser code
- Configure rules as errors, not warnings
- Block merges on ESLint failures in CI
- Keep ESLint and plugins updated
- Review and customize rules for your codebase
Can Prettier catch security issues?
No. Prettier only formats code. It doesn't analyze it for bugs or security issues, so you'll need ESLint with security plugins for that. Don't rely on Prettier for anything security-related.
Should I run both in CI?
Yes. ESLint catches bugs and security issues, and Prettier keeps formatting consistent. Run both in CI and block merges when either fails, so nothing slips in just because nobody ran them locally.
What about Biome?
Biome (formerly Rome) is a newer tool that does linting and formatting in one. It's faster, but it has fewer rules than ESLint. For a security-focused project, ESLint's mature plugin ecosystem still covers more.
Beyond Linting
CheckYourVibe provides deeper security analysis than ESLint alone can offer.
Further Reading
Made your choice? Here's how to secure your selected stack.