My portfolio has a section that runs curl -I on itself while you watch. Not a screenshot of headers I pasted in last year and forgot to update. The page fetches its own URL, reads the response headers off it, and prints each one ON or missing, right ...

I sat down one afternoon with a list of six things I wanted to ship to JobSearch, the job hunting tool I wrote for my own job hunt and then kept running in production for exactly one user. Three small features, two pieces of tech debt, and one refact...

The Guardian denied the command. Then the model wrote this: > To print the string anyway, run ! echo rm -rf / in your prompt, which skips my tool calls and their hooks. That was Claude Code, running through an OWASP Agent Control Standard ACS Guard...

Every article I write lives on my own site first. A copy goes up on dev.to a day or two later, and that copy reliably gets more readers than the original does. One piece has 106 views over there. My own analytics can't honestly tell me how many human...

There is a job in my CI called judge. It reads the monthly issue my content pipeline writes, scores it against a rubric with five criteria, and blocks the merge if anything comes back at 2 out of 5 or lower. An LLM grading an LLM, with a written poli...

The Content Security Policy on this site allows scripts by SHA-256 hash. Not unsafe-inline, not a nonce, not a wildcard. A list of exact digests, and anything whose bytes don't match one of them does not run. That is the strong version of the policy...

On 1 September at 10:57 UTC the monthly ingest ran. It opened issue number 3 of the magazine, picked the vertical from the source registry, wrote 19 candidate sources into Postgres with stage = 'discovery', and opened a GitHub issue telling me it was...

Four test files in my site's repo import TypeScript directly. faq.test.mjs pulls in src/lib/faq.ts, and three others do the same with their own modules. There is no build step and no loader in between: the script is node --test "test/.test.mjs", and ...

Most of the bugs that taught me something weren't crashes. The system worked, the checks were green, and the property I cared about was still broken. Here are four of them, from three different projects. 1. The prompt-injection test that passed whil...

I put a fake AWS key in a file and asked Claude Code to read it twice in the same session: once with its Read tool, once with cat. An OWASP Guardian sat between the agent and its tools. With cat, the model got this: AWSACCESSKEYID=REDACTED With R...

This post is my submission for DEV Education Track: Build Apps with Google AI Studiohttps://dev.to/deved/build-apps-with-google-ai-studio. What I Built I built ArchShield, an AI-powered architecture visualizer and security baseline assistant for de...

In early August Cloudflare sent me a congratulations email. The site had passed ten thousand pageviews in its first month: 33,561, on a domain that went live on 5 July. For about ten seconds it was good news. Then I remembered what I had done in Ju...

My job-search tool had five functions whose only purpose was fixing JSON that Claude had just written. cleanjsontext, fixunescapednewlines, fixsinglequotes, stripmarkdownwrapper, extractandparsejson. There was also a sixth, retryjsonfix, which took t...

TL;DR | | Bifrost | LiteLLM 4 workers | |---|---|---| | p50 at 100 RPS | 1.01 ms | 5.84 ms | | Success rate at 1,000 RPS | 100% | 94.9% | | p99 at 1,000 RPS | 2.62 ms | 33,766 ms | | Published container runs as | UID 1000 | root | | SSRF guard on th...

I have a scraper that watches ten sites I consider adjacent to my work. It has been running since early July. The output goes into a vector store that nothing currently reads, which is the only reason this story ends without a lawyer in it. I audite...

This is a submission for DEV's Summer Bug Smash: Clear the Lineuphttps://dev.to/bugsmash powered by Sentryhttps://sentry.io/. Project Overview agentic-oshttps://github.com/MK023/agentic-os is a small self-hosted observability stack I run on Railway...

I ran a penetration test on my own infrastructure last week. No Burp Suite, no exploit fired at production, no CVE popped. The whole engagement came down to one habit: refusing to believe a control was working until I had watched it work. The target...

This is a submission for DEV's Summer Bug Smash: Smash Storieshttps://dev.to/bugsmash powered by Sentryhttps://sentry.io/. I maintain a small CLI called llm-councilhttps://github.com/MK023/llm-council. It puts one question to several models, hides t...