Practical engineering tips, design theory and performance breakdowns — written for developers and founders who like their advice tested in production.
Filtering by tag #security — clear
One script hammering your login endpoint, or one user looping your AI feature, can take down a server or empty a budget. How rate limiting works, which algorithm to pick, and how to add it.
Read →
Taking money online is mostly a solved problem, if you avoid the classic mistakes. Hosted checkout vs embedded forms, webhooks as the source of truth, money as integers and testing every edge case.
Read →
"Sign in with Google" looks like one button but involves redirects, codes, tokens and a few important security checks. How OAuth 2.0 and OpenID Connect work, and how to implement them safely.
Read →
Password reset is one of the most attacked features in any app. How to generate and store reset tokens, avoid leaking which emails exist, expire and invalidate correctly, and protect users after a reset.
Read →
Client-side validation makes forms pleasant; server-side validation keeps your app safe. How to validate properly with schemas, share rules between frontend and backend, and avoid common gaps.
Read →
Semantic versioning, lockfiles, npm ci, safe updates, security audits and choosing packages wisely. The habits that keep a JavaScript project installable, secure and up to date for years.
Read →