Build better.
Debug smarter.
Deep technical articles on APIs, security, debugging, and developer tooling.
✦ AI-powered — understands natural language
Why API Key Rotation Is Harder Than It Should Be — Zero-Downtime Rotation, Secure Distribution, and the Permanent Git History Problem
JSON Parsing in Python, JavaScript, Go, and Ruby: Edge Cases That Cause Real Bugs
Python's None vs JSON null, JavaScript's integer precision limit at 2^53, Go's strict struct tags, and Ruby's symbolize_names security concern are real production pitfalls. Here's the JSON parsing edge cases in each major language and how they cause bugs at API boundaries.
XSS and HTML Encoding: The Five Contexts That Require Different Escaping
XSS is still the most common web vulnerability — and unescaped HTML is the mechanism. Here's how cross-site scripting actually works, the five encoding contexts that require different treatment, why React is safe by default but PHP isn't, and how CSP adds a second layer.
HTTP Status Codes Explained: A Complete Debugging Guide for API Work
HTTP status codes have precise meanings that most developers only half-know. Here's the complete guide — every important 2xx, 3xx, 4xx, and 5xx code explained with debugging guidance for each.
JWT Security Vulnerabilities: alg:none, Algorithm Confusion, and Secure Token Storage
The alg:none attack, RS256/HS256 algorithm confusion, weak HS256 secrets, localStorage vs httpOnly cookies, and revocation without statefulness — JWT security vulnerabilities are specific and avoidable. Here's how each one works and how to fix it.
Secure Randomness: Why Math.random() Fails for Security Tokens — and the Right Alternatives
Math.random() in JavaScript is predictable from 128 observations. Python's random module explicitly warns it's not for security. Here's why PRNGs fail for tokens, the secure alternatives in every major language, and the specific bit lengths needed for different security contexts.
API Authentication Methods Compared: Keys, Bearer Tokens, OAuth 2.0, and HMAC
API keys, Bearer tokens, Basic Auth, OAuth 2.0, and HMAC signatures each fit different authentication scenarios. Here's how each method works, when it's the right choice, and how to test each one in an API checker — with the specific header formats.
Bit Manipulation and Bitmasks: From Unix Permissions to Feature Flags
Bit manipulation is where number bases become practical: Unix permissions, feature flags, IP subnetting, and protocol fields all use bitmasks. Here's how AND, OR, XOR, and shifts work, with real examples from file permissions and flag systems.
Merkle Trees and Hash Functions: How Git, Blockchain, and Certificate Transparency Work
Hash functions underpin Git commits, blockchain blocks, and certificate transparency logs through Merkle trees. Here's why MD5 and SHA-1 are "broken," how Merkle trees verify large datasets with O(log n) hashes, and how Bitcoin light clients verify transactions without the full blockchain.
ReDoS: How Catastrophic Backtracking in a Single Regex Can Take Down a Server
A single regex with a crafted input knocked Stack Overflow offline for 34 minutes and caused a global Cloudflare outage. Here's how catastrophic backtracking works, which patterns are vulnerable, how to test for ReDoS, and how to write safe alternatives.
Why JSON Gets Double-Encoded — and How to Detect and Fix It
Double-encoded JSON — JSON strings where objects were expected — happens when serialisation runs twice at different layers. Here's how it happens, how to detect it, how to fix it programmatically, and what the common Unicode escape sequences mean.
ISO 8601 and Date Handling Mistakes: The Bugs That Surface Months Later
"06/07/2024" means different dates in the US and UK. ISO 8601 solves this unambiguously. Here's the standard, common date handling mistakes (adding months with timedelta, DST in date arithmetic), storing UTC in databases, and the MySQL 2038 timestamp problem.
Why bcrypt: The History of Password Hashing, Cost Factors, and When Argon2 Is Better
SHA-1 and MD5 are fast by design — which is why GPUs crack them in hours after a breach. bcrypt's deliberate slowness and automatic salting are its defence. Here's how bcrypt works, the 72-byte limit, choosing a cost factor, and when Argon2 is the better choice.
