Pasting a Claude or DeepSeek API key straight into your code "just to test it quick" leaves a trail in your git history and your logs. A no-nonsense guide to environment variables, rotation, and what to check before sharing a repo.
Sep 09 2026 · 7′ · Tutorials · nextjs · anthropic
Path aliases look innocent until the production build fails with no clear message. I documented the 3 most common breakage cases in a monorepo with Next.js 16 App Router and strict TypeScript, and the config pattern that survived.
Aug 14 2026 · 9′ · Tutorials · TypeScript · pnpm
DeepSeek's API is compatible with the OpenAI SDK — that makes the integration almost trivial. The real problem isn't the plumbing. It's deciding whether the model is actually worth it for your use case, without buying the hype or dismissing it out of fashion. Here's the framework.
Jul 22 2026 · 8′ · Tutorials · TypeScript · nextjs
Rate limiting isn't an npm dependency — it's an abuse policy. Before copying middleware, you need to define what asset you're protecting, what abuse pattern you expect, and what a false positive costs you. A guide with a decision matrix, real gotchas, and observability for Next.js.
Jun 22 2026 · 9′ · Tutorials · TypeScript · nextjs
The README on juanchi.dev says "portfolio landing". The code says something else: an editorial system with repo ingestion, quality gate, automatic rewriting, and crons on Railway. The technical story the README doesn't tell.
Jun 22 2026 · 6′ · Next.js · TypeScript
The Vercel incident wasn't a technical vulnerability — it was a least-privilege failure applied to OAuth. Break down what scope creep is, how to audit it in existing integrations, and what architectural controls prevent a third party from accumulating permissions it doesn't need.
Jun 18 2026 · 11′ · Tutorials · TypeScript · nextjs
OpenTelemetry in Next.js works, but the default propagator silently breaks the trace at the edge/node boundary. Here's what you need to configure explicitly so context doesn't vanish between Middleware, Server Components, and Server Actions.
Jun 17 2026 · 8′ · Tutorials · TypeScript · nextjs
There's no such thing as the perfect token — only the right token for your system's threat model. A practical decision tree with real technical judgment for choosing between JWT, Paseto v4, and opaque session tokens in TypeScript. No dogma, no made-up benchmarks.
Jun 14 2026 · 9′ · Tutorials · TypeScript · nextjs
Zod sells itself as "define once, validate everywhere." In Next.js 16 with Server Actions, edge middleware, and API routes, that's only partially true. Three concrete failure modes and the pattern that prevents them.
Jun 13 2026 · 8′ · Tutorials · TypeScript · produccion
Architecture, real systems, product decisions and technical lessons. Everything reviewed with my own judgment before it ships.
230 articles published