When Tree Shaking Fails: Security Risks in Nuxt & Vue

on YouTube ↗26m

" summary

Tree shaking sometimes keeps unused code and can leak secrets when CommonJS patterns, default-exported objects, or side-effecting APIs prevent static analysis. The talk shows concrete failures (over 45,000 GitHub modules with export-aggregation), demonstrates a low-tech console.log probe to detect bundled secrets, and explains fixes: split files, add /pure or no side effects* annotations, and structural changes. Several PRs to Svelte Mini Pinia and VueUse are already merged and reduce leakage.

AI-written summary · about

" chapters (9)

1. 0:00Introduction
2. 3:54Tree shaking basics
3. 6:20Pitfalls breaking tree shaking
4. 11:43Side effects in code
5. 15:56Security risks when tree shaking fails
6. 18:50Detecting tree shaking failures
7. 20:36Fixing tree shaking issues
8. 22:21Real-world optimizations
9. 25:12Summary

" related talks

• 08mUnderstand the hard parts of NuxtKonstantin Bifert · Vue.js London Live 2021
• 12mLet's Vue Like It's 1999Mike Dodge · Vueconf.US 2020
• 47mNode.js Security: Breaking The LoopLiran Tal · jsDay 2018
• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 27mState of Node.js SecurityVladimir de Turckheim · NodeConf NL 2019
• 22mDeep dive into Nuxt.jsPooya Parsa · Vue.js Amsterdam 2020
• 29mA Node.js Security RoadmapMike Samuel · JSConf EU 2018
• 14mStranger Danger: Tracking Vulnerabilities in Your Third Party CodeGuy Podjarny, Assaf Hefetzz · Velocity Conference Amsterdam 2015