Field guides for building software that survives contact with real users, real money and real attackers.
Where the UI, the API and the database disagree about who is allowed to do what.
An endpoint checks that someone is logged in, then performs a destructive or data-revealing action on any object by ID — without checking whether the logged-in user actually owns, is assigned to, or has permission over that object.
AI coding tools happily generate an endpoint that does something powerful (sends an email, triggers a webhook side-effect, writes to a database) without asking "who is allowed to call this?", because nobody asked it to.
The app hides the admin panel from non-admins in the UI, but the database itself will still let any logged-in user write is_admin = true on their own row — because nobody locked that column down at the data layer.
A secret key ends up somewhere the public can read it (a browser bundle, a git commit, or an AI chat transcript) because it was treated like configuration instead of a credential.
A comprehensive template for implementing form validation and security in React and Next.js applications.
Money paths that only break under retries, duplicates and refunds.
Payment code is written and tested for the single, successful, non-concurrent request — and webhooks, refunds, and duplicate deliveries all happen outside that path, so that's exactly where the bugs live.
Working with the browser's rendering pipeline instead of against it.
A practical guide to designing modern websites that work with the browser's rendering pipeline instead of against it. Adapted from Addy Osmani's writing on modern browser internals.
Your app downloads its whole codebase before a single pixel renders. Every page, every admin screen, every heavy third-party widget ships in the same bundle, because nothing was ever split into separate chunks.
Starter tracks stay public. Pro seats are for CashPlanet drive winners — not an open checkout.
How the web actually works, then HTML, CSS and JavaScript you can use on a phone or a laptop.
Use assistants and agents for real work — drafts, research, and checks — without handing over your thinking.
Pick a finishable problem, build a simple web app, put it online, and ask one real person to use it.
Workspace notes for drive winners. Claim a code. Nothing here is for sale.
