ESLint Integration Guide

Integrate ESLint with Vulnetix. Lint JavaScript and TypeScript code with the Microsoft SARIF formatter and upload results.

Install & scan

$ npx eslint --version
$ npx eslint -f @microsoft/eslint-formatter-sarif -o eslint.sarif .

Run ESLint in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install dependencies
  run: npm ci

- name: Run ESLint with SARIF
  run: npx eslint -f @microsoft/eslint-formatter-sarif -o eslint.sarif .

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: eslint
    path: eslint.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under ESLint's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace ESLint. Keep running it. Vulnetix sits on top of ESLint (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

ESLint is strongest at its core category and also carries features in Secret Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What ESLint does well

• De facto standard linter for JavaScript/TypeScript with an enormous plugin ecosystem and deep editor/IDE and CI integration
• Highly configurable custom-rule engine (AST-based) that teams extend to enforce their own code-quality and safety patterns
• Security plugins (eslint-plugin-security, eslint-plugin-no-unsanitized, @microsoft/eslint-plugin-sdl) catch anti-patterns like eval(), innerHTML/dangerouslySetInnerHTML, and unsafe regex
• Ubiquitous, free, and fast: runs on every save and every commit, making it a natural first-line guardrail

Where Vulnetix adds to it: ESLint is the JS/TS linting core; Vulnetix ingests its SARIF (via @microsoft/eslint-formatter-sarif) into a cross-scanner deduplicated queue, then layers EPSS/KEV exploit-intel prioritisation, reachability, versioned VEX, and Safe Harbour autofix that ESLint's per-file rules cannot provide. Vulnetix adds SCA, container, IaC, cloud, and malware coverage ESLint never attempts.

No migration, no rip-and-replace. ESLint keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise ESLint results in Vulnetix

Upload ESLint SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

ESLint documentation ↗  ·  Source repository ↗

Wire ESLint into your CI/CD pipeline →