Most of us have hit this at least once. A test fails, you dig in for an hour, and the bug isn't in your code at all. It's in the fixture. The expected value was copied wrong, or the input was never valid to begin with. The suite is red, your code is ...

In May 2025, security researchers at Invariant Labs showed that an attacker could steal private repositories by filing a GitHub issue. No exploit, just a sentence. The target was an assistant connected to GitHub through the official MCP server. It r...

Deploying PHP in a Bomb Suit: Token-Gated One-Shot Workers on $3 Shared Hosting My last post, "Dead at File 30 of 62," was about making self-deleting scripts interrupt-safe. The reaction was great, but every comment thread had the same undertone: coo...

Deploying PHP in a Bomb Suit: Token-Gated One-Shot Workers on $3 Shared Hosting My last post, "Dead at File 30 of 62," was about making self-deleting scripts interrupt-safe. The reaction was great, but every comment thread had the same undertone: coo...

I want to share what happened during one week in October, because I think it can help other solo developers who run their apps on a managed hosting platform. On the Friday of that week, I submitted an update of my app to the App Store and Google Pla...

Duplicate renewal charges are one of the nastiest bugs in a subscription store. The customer sees it on a bank statement before you see it in a log. This is the order in which I investigate. 1. Count orders and payments separately The first question...

I built an autonomous scientific discovery engine called RUMI. I let it run for up to 21 hours per question. Then I built a frozen external judge it had no way to influence, and graded 51 of its runs. Zero A's. Zero B's. Forty-five C's. Six F's. Th...

Several Canadian jurisdictions just stopped falling back. Software teams should treat that as a time-zone release, not a lifestyle update. British Columbia now uses UTC-7 throughout the year. Alberta and the Northwest Territories use UTC-6. Manitoba...

A user fills in your form and clicks "Create post". The post is saved in the database. And the page shows "Could not create post". They try again. Now there are two posts. Nothing is wrong with your database. Your error handling caught something it...

Somewhere in the last year, "do we need an MCP server?" joined the list of questions that arrive in a brief before anyone has said what the thing is for. It is usually framed as MCP vs API, as though the Model Context Protocol were a newer kind of AP...

> Werbung / Disclosure: Prisma gave me a coupon for two months of a paid plan for free and said it will add free credits, so I could try Prisma Postgreshttps://www.prisma.io/postgres and Compute for this project. All results below come from my own ru...

There is a job in my CI called judge. It reads the monthly issue my content pipeline writes, scores it against a rubric with five criteria, and blocks the merge if anything comes back at 2 out of 5 or lower. An LLM grading an LLM, with a written poli...

Practical lessons from building Esapay, a prototype exploring safer recovery for payment infrastructure. Payment systems can fail in ways that look deceptively similar. Slow checkouts might point to an overloaded service, a growing backlog, or troub...

The Guardian denied the command. Then the model wrote this: > To print the string anyway, run ! echo rm -rf / in your prompt, which skips my tool calls and their hooks. That was Claude Code, running through an OWASP Agent Control Standard ACS Guard...