Build better.
Debug smarter.
Deep technical articles on APIs, security, debugging, and developer tooling.
✦ AI-powered — understands natural language
UUID v4 Breaks Database Performance at Scale — What UUID v7 Changed and Why It's Still Not the Default
ReDoS: How Catastrophic Backtracking in a Single Regex Can Take Down a Server
A single regex with a crafted input knocked Stack Overflow offline for 34 minutes and caused a global Cloudflare outage. Here's how catastrophic backtracking works, which patterns are vulnerable, how to test for ReDoS, and how to write safe alternatives.
Why JSON Gets Double-Encoded — and How to Detect and Fix It
Double-encoded JSON — JSON strings where objects were expected — happens when serialisation runs twice at different layers. Here's how it happens, how to detect it, how to fix it programmatically, and what the common Unicode escape sequences mean.
ISO 8601 and Date Handling Mistakes: The Bugs That Surface Months Later
"06/07/2024" means different dates in the US and UK. ISO 8601 solves this unambiguously. Here's the standard, common date handling mistakes (adding months with timedelta, DST in date arithmetic), storing UTC in databases, and the MySQL 2038 timestamp problem.
Why bcrypt: The History of Password Hashing, Cost Factors, and When Argon2 Is Better
SHA-1 and MD5 are fast by design — which is why GPUs crack them in hours after a breach. bcrypt's deliberate slowness and automatic salting are its defence. Here's how bcrypt works, the 72-byte limit, choosing a cost factor, and when Argon2 is the better choice.
Password Managers: How Zero-Knowledge Encryption Works and Which One to Choose
Credential stuffing is the main threat, and unique passwords are the defence — but only a password manager makes that practical at scale. Here's how zero-knowledge encryption works, Bitwarden vs 1Password vs KeePass compared, and how to set up recovery.
URL Structure: Query String Parsing Ambiguities, Punycode, and Open Redirect Vulnerabilities
A URL has five components — and bugs come from confusing which part you're encoding. Here's query string parsing ambiguities between frameworks, IDN Punycode for international domains, URL normalisation for comparison, open redirect vulnerabilities, and relative URL resolution edge cases.
Data URLs and Base64: When to Embed Resources Inline vs Link to Them
Data URLs embed files directly in HTML and CSS as Base64 strings — no separate HTTP request. Here's when that's faster, when it makes things worse, how JWT tokens use Base64URL, and how inline images in emails work around image blocking.
Beyond UUID: How Twitter's Snowflake IDs, ULID, CUID2, and Nano ID Work
Twitter, Discord, and Instagram all built custom ID systems because UUID couldn't handle time-sortability, distributed generation, and 64-bit constraints simultaneously. Here's how Snowflake IDs work, what ULID and CUID2 offer, and when each alternative makes sense.
Colour Contrast and Accessibility: WCAG Ratios, Common Failures, and Accessible Design Systems
WCAG contrast requirements are now enforceable law in the EU and UK. Here's how contrast ratios are calculated from RGB values, which common colour combinations fail (including Bootstrap blue), and how to build accessible colour systems from the start.
JSON vs YAML vs MessagePack vs Protocol Buffers: Which Format for Which Use Case
JSON has no comments, no date type, and a number precision problem that caused Twitter to change their API. Here's how JSON compares to XML, YAML, MessagePack, and Protocol Buffers, when each format makes sense, and what JSON Schema adds.
URL Encoding Edge Cases That Break Real Applications
The difference between encoding a full URL and a URL component, why + and %20 aren't always interchangeable, how double-encoding silently corrupts data, and the characters that break most URL handling code.
UUID v1, v4, v5, v7 Compared — Which Version Should You Actually Use?
UUID v1, v3, v4, v5, and v7 all work differently and suit different use cases. Here's when to use each — including why v7 is now the recommended choice for database primary keys.
