What is oxlint and how to use it
oxlint is a JavaScript and TypeScript linter written in Rust, 50-100x faster than ESLint. How to configure it, what it actually covers, and why it doesn't fully replace ESLint.
Diego Betto · Technical consulting for companies
Solid web architecture for companies that can't afford downtime or technical debt
I'm Diego Betto, Co-Founder & CTO of PAPION. My team and I help companies, agencies, and product teams design, build, and secure scalable React, Node.js, and TypeScript applications.
Services
End-to-end technical consulting, from frontend to security, for companies that need to scale without surprises.
Frontend Architecture
Design and scalability for React, Next.js, and Astro applications: maintainable components, solid performance, less technical debt over time.
Backend & APIs
Development and optimization of Node.js, Fastify, and TypeScript APIs: reliable services built to handle business growth.
Code Review & Mentoring
Hands-on support for dev teams to raise TS/JS code quality, cut production bugs, and speed up onboarding.
Security & Performance
Application hardening, dependency/CVE monitoring, Core Web Vitals optimization.
About me
My name is Diego Betto. I am Co-Founder & CTO, senior full-stack engineer at PAPION, with 20+ years of experience. I'm based in Udine, Italy, working mostly remotely for clients across the country. I work across frontend and backend architecture, application security, and mentoring other developers, with particular depth in React, JavaScript/TypeScript, and Node.js.
Learn more →Where we work
Detailed case studies coming soon — in the meantime, here are the contexts we work in most often with PAPION.
E-commerce & Retail
High-traffic React frontends and order-management system integrations.
B2B SaaS Products
Node.js/Fastify backends for growing products, with a focus on security and observability.
In-house Tech Teams
Code review, mentoring, and security hardening without slowing delivery down.
From the blog
Technical notes on React, Node.js, security, and performance.
AI agents and the agentic web: preparing sites and apps for agents that browse on the user's behalf
How to integrate AI agents into sites and apps: machine-readable HTML, WebMCP to expose tools from the browser, server-side MCP, human confirmation and security.
European Accessibility Act and WCAG 2.2: a practical compliance guide for developers
What the European Accessibility Act requires, who must comply, penalties, and how to make a site WCAG 2.2 compliant: keyboard, contrast, screen readers, ARIA and testing.
React 19: the "A props object containing a key prop is being spread into JSX" warning
Why React 19 now warns when key ends up inside a spread props object, and how to destructure it out explicitly to fix it.
Faster builds: migrating to the TypeScript 7 native compiler and Rolldown
Migration strategies for TypeScript 7 and Rolldown in a monorepo: default breaking changes, --checkers and --builders, Vite 8, tsdown, and reliable CI/CD benchmarks.
Securing Server Actions and React Server Components: data leaks, validation, and taint APIs
How to secure Server Actions and React Server Components: implicit endpoints, input validation, authorization, environment variables, taint APIs, and recent CVEs.
Building a Custom MCP Server in TypeScript: Step-by-Step Guide (Docker and Linting)
How to build a Model Context Protocol server in Node.js and TypeScript: tools, resources, prompts, stdio, Docker API and oxlint, testing with the Inspector, and security.
Let's talk about your project
Tell me about your technical challenge: architecture, performance, security, or a team that needs reinforcing. I answer every email personally.