A clean package.json says nothing about who's going to fix that library when it breaks. Practical criteria for evaluating maintenance, surface area, types and transitive deps before adding a dependency to a TypeScript stack.
Jul 28 2026 · 8′ · Tutorials · TypeScript · pnpm
DeepSeek's API is compatible with the OpenAI SDK — that makes the integration almost trivial. The real problem isn't the plumbing. It's deciding whether the model is actually worth it for your use case, without buying the hype or dismissing it out of fashion. Here's the framework.
Jul 22 2026 · 8′ · Tutorials · TypeScript · nextjs
Rate limiting is not a dependency you drop into middleware and call it done. It's an abuse policy. Before you copy that snippet, you need to define what asset you're protecting, what abuse you're expecting, and what a false positive actually costs you.
Jul 07 2026 · 10′ · Tutorials · TypeScript · nextjs
Actuator isn't the problem. The problem is enabling it without a clear exposure policy. A pragmatic guide to using it as an operational tool without turning it into unnecessary public attack surface.
Jul 06 2026 · 8′ · Tutorials · devops · backend
Not every signature error is a cryptographic problem. Most of the time the mess is in the format you picked, the certificate that doesn't fit the required profile, or the validation policy the verifier applies. A guide to understanding each layer before you blame the algorithm.
Jul 02 2026 · 9′ · Tutorials · seguridad · pki
Rate limiting isn't an npm dependency — it's an abuse policy. Before copying middleware, you need to define what asset you're protecting, what abuse pattern you expect, and what a false positive costs you. A guide with a decision matrix, real gotchas, and observability for Next.js.
Jun 22 2026 · 9′ · Tutorials · TypeScript · nextjs
Adding an npm dependency isn't just installing code — it's taking on its maintenance, its attack surface, and its transitive deps. Here's the checklist I run before adding any package to a serious TypeScript project.
Jun 22 2026 · 9′ · Tutorials · TypeScript · pnpm
Running the OWASP LLM Top 10 as a real audit is a completely different experience than reading it as a checklist. I ran it against my TypeScript agent stack with system prompts, MCP tools, and Cline — and the findings were uncomfortable.
Jun 20 2026 · 9′ · Tutorials · TypeScript · LLM
The Vercel incident wasn't a technical vulnerability — it was a least-privilege failure applied to OAuth. Break down what scope creep is, how to audit it in existing integrations, and what architectural controls prevent a third party from accumulating permissions it doesn't need.
Jun 18 2026 · 11′ · Tutorials · TypeScript · nextjs
Architecture, real systems, product decisions and technical lessons. Everything reviewed with my own judgment before it ships.
213 articles published