Build better.
Debug smarter.
Deep technical articles on APIs, security, debugging, and developer tooling.
✦ AI-powered — understands natural language
Why 0 0 1 * 1 Runs 63 Times a Year: The Cron OR Trap
URL Design as API Design: REST Conventions, Versioning Strategies, and the Long-Term Cost of Changing URLs
REST URL conventions, API versioning strategies (URL path vs header vs date-based like Stripe), trailing slash canonicalization, URL length limits, and the link rot problem — URL design decisions made at launch determine API maintainability for years.
Practical JSON Diff Workflows: Debugging APIs, Finding Config Drift, and Verifying Migrations
The most common reason to reach for a JSON diff tool is "something changed and I need to know exactly what, fast." Here's four practical workflows: diagnosing API response changes, finding configuration drift between environments, verifying data migrations changed only what was intended, and triaging failing test assertions where the actual difference is buried in a large JSON structure.
JSON Diff: Why Structural Comparison Matters and How It Handles Key Order, Formatting, and Arrays
Two JSON documents can be semantically identical while looking completely different to a text diff tool — different key order, formatting, or minification all produce false "differences." Here's how structural JSON diffing actually works, why array comparison is the hardest part, and practical uses for API testing, config comparison, and data migration verification.
Credential Breaches and Stuffing Attacks: What Leaked Password Databases Reveal and How HIBP Works
Have I Been Pwned has indexed 12+ billion breached accounts. Here's what a leaked credential database actually looks like, how attackers use credential stuffing at scale, the k-anonymity trick that lets HIBP check passwords without seeing them, and why bcrypt salting defeats rainbow tables.
Design Tokens, CSS Variables, and Dark Mode: How to Build a Colour System That Scales
Design tokens are a three-tier hierarchy: primitive colours → semantic meanings → component-specific use. CSS custom properties implement this at runtime, making dark mode a one-place change. Here's the full token model, how Tailwind's colour system works, and why OKLCH is replacing HSL for design systems.
How Email Attachments Work: MIME Encoding, Base64, and Why Binary Files Need Encoding
Email attachments work because MIME uses Base64 to encode binary files as ASCII text — a system designed in 1992 when email could only carry 7-bit ASCII. Here's how MIME multipart email works, why binary needs encoding, the 33% Base64 overhead on attachment sizes, and how the same system handles HTML form file uploads.
Production Scheduled Jobs: Idempotency, Monitoring, and Modern Alternatives to Cron
Cron jobs fail silently and traditional cron has no alerting, no history, and no overlap prevention. Here's idempotency design for scheduled jobs, modern alternatives (Celery Beat, AWS EventBridge, Kubernetes CronJobs), and the dead man's switch monitoring pattern.
JSON Schema Validation and API Contracts: OpenAPI, Contract Testing, and Validation Libraries
JSON Schema validates structure and constraints — and OpenAPI uses it as the contract format for API documentation, client SDK generation, and contract testing. Here's how JSON Schema works, key validation keywords, how OpenAPI extends it, and how Pact implements consumer-driven contract testing.
JSON Parsing in Python, JavaScript, Go, and Ruby: Edge Cases That Cause Real Bugs
Python's None vs JSON null, JavaScript's integer precision limit at 2^53, Go's strict struct tags, and Ruby's symbolize_names security concern are real production pitfalls. Here's the JSON parsing edge cases in each major language and how they cause bugs at API boundaries.
XSS and HTML Encoding: The Five Contexts That Require Different Escaping
XSS is still the most common web vulnerability — and unescaped HTML is the mechanism. Here's how cross-site scripting actually works, the five encoding contexts that require different treatment, why React is safe by default but PHP isn't, and how CSP adds a second layer.
HTTP Status Codes Explained: A Complete Debugging Guide for API Work
HTTP status codes have precise meanings that most developers only half-know. Here's the complete guide — every important 2xx, 3xx, 4xx, and 5xx code explained with debugging guidance for each.
JWT Security Vulnerabilities: alg:none, Algorithm Confusion, and Secure Token Storage
The alg:none attack, RS256/HS256 algorithm confusion, weak HS256 secrets, localStorage vs httpOnly cookies, and revocation without statefulness — JWT security vulnerabilities are specific and avoidable. Here's how each one works and how to fix it.
