Pasting a Claude or DeepSeek API key straight into your code "just to test it quick" leaves a trail in your git history and your logs. A no-nonsense guide to environment variables, rotation, and what to check before sharing a repo.
Sep 09 2026 · 7′ · Tutorials · nextjs · anthropic
Spring Boot Actuator exposes more by default than most teams realize. The difference between an endpoint that's useful for monitoring and a map of environment variables handed to an attacker comes down to a decision almost nobody makes explicitly: allowlist versus disabling what looks obvious.
Aug 23 2026 · 8′ · Tutorials · spring-boot · java
The README on juanchi.dev says "portfolio landing". The code says something else: an editorial system with repo ingestion, quality gate, automatic rewriting, and crons on Railway. The technical story the README doesn't tell.
Jun 22 2026 · 6′ · Next.js · TypeScript
Actuator isn't the problem. Enabling it without a clear exposure policy is. A practical guide to using it as an operational tool without turning it into unnecessary public attack surface.
Jun 17 2026 · 8′ · Tutorials · devops · backend
The most common mistake when implementing MCP tools is coupling them to the provider's SDK. The spec exists to prevent exactly that. A practical architecture guide: the input/output contract that makes a tool work across Claude, GPT, and local models without rewriting anything.
Jun 10 2026 · 8′ · Tutorials · TypeScript · LLM
Cline's official docs describe an autonomous coding agent for VS Code with an approval loop, auto-approve modes, and multi-provider support. Here's what those docs say — plus what two weeks of real use on a TypeScript project taught me that the docs don't.
Jun 07 2026 · 11′ · Tutorials · TypeScript · developer tools
After publishing my Jakarta EE vs Spring Boot analysis, I audited Actuator's defaults on a backend I own and found sensitive endpoints wide open — ones I never consciously configured. Here's the hardening checklist I built afterward.
May 11 2026 · 7′ · Experiments · devops · backend
The autonomous agent incident forced me to redesign everything — from permissions to observability. This is what ended up running in production after the crisis: the real graph, the real numbers, and what still doesn't sit right with me.
May 08 2026 · 9′ · Experiments · TypeScript · produccion
npm audit tells you you're safe. I stress-tested that claim with real methodology against my production dependencies and found three attack vectors the scanner doesn't even register. The Node ecosystem has a structural problem that green badges keep hidden.
May 07 2026 · 9′ · Experiments · TypeScript · npm
Architecture, real systems, product decisions and technical lessons. Everything reviewed with my own judgment before it ships.
228 articles published