Security
A shop ledger page, 1899. Every line adds up.
How to Manage Secrets and Environment Variables in Production
Separate configuration from code, keep credentials out of browser bundles and logs, and rotate secrets with a documented process.
2 min read
How to Add Authentication to an Existing Next.js App
Add authentication to an existing Next.js App Router project without treating a login screen as the security boundary.
3 min read
Sandboxing Local AI Coding Agents: Containers, VMs and Separate Users
A practical way to limit what a local AI coding agent can touch, comparing containers, virtual machines and separate user accounts, with secrets and a Docker example.
5 min read
JWTs Need No Database Lookup? Revocation, Logout, and Why Only Half True
JWTs avoid a lookup on every request only until you need logout or revocation. Learn denylists, token versioning, short TTLs, and introspection tradeoffs.
4 min read
Roll Your Own Auth or Use a Provider? A Solo Developer Decision Guide
A practical guide for solo developers deciding between building authentication themselves and using a provider, including what you must get right either way.
4 min read
Access and Refresh Tokens: Where to Store Them in a Browser App
Decide where to keep access and refresh tokens in a browser app, using HttpOnly SameSite cookies, short-lived access tokens, rotation, and CSRF protection.
4 min read
JWT vs Session Cookies: How to Choose for a Web App
Compare JWTs and server-side session cookies on revocation, scaling, and complexity, and learn which one is the safer default for a typical browser-based web app.
4 min read