Pasting a Claude or DeepSeek API key straight into your code "just to test it quick" leaves a trail in your git history and your logs. A no-nonsense guide to environment variables, rotation, and what to check before sharing a repo.
Sep 09 2026 · 7′ · Tutorials · nextjs · anthropic
Stateless JWT isn't the universal answer tutorials promise. If your system needs immediate revocation or fine-grained auditing, state isn't the enemy — it's the solution. Here's the decision framework I use in real identity systems.
Aug 18 2026 · 9′ · Tutorials · seguridad · JWT
Cline can create files, run commands, and open the browser autonomously from inside VS Code. That sounds like productivity. It also smells like risk if you haven't thought through the permissions before you start. My thesis: the mental model matters more than the tool.
Aug 17 2026 · 9′ · Tutorials · TypeScript · LLM
CAdES and XAdES aren't interchangeable even though both are "advanced signatures." The choice depends on document type, trust profile, and what the CA actually expects to validate. A technical guide with DSS and Java to make the right call before you sign anything.
Aug 12 2026 · 9′ · Tutorials · seguridad · certificados
DeepSeek's API is compatible with the OpenAI SDK — that makes the integration almost trivial. The real problem isn't the plumbing. It's deciding whether the model is actually worth it for your use case, without buying the hype or dismissing it out of fashion. Here's the framework.
Jul 22 2026 · 8′ · Tutorials · TypeScript · nextjs
Rate limiting isn't an npm dependency — it's an abuse policy. Before copying middleware, you need to define what asset you're protecting, what abuse pattern you expect, and what a false positive costs you. A guide with a decision matrix, real gotchas, and observability for Next.js.
Jun 22 2026 · 9′ · Tutorials · TypeScript · nextjs
Adding an npm dependency isn't just installing code — it's taking on its maintenance, its attack surface, and its transitive deps. Here's the checklist I run before adding any package to a serious TypeScript project.
Jun 22 2026 · 9′ · Tutorials · TypeScript · pnpm
Running the OWASP LLM Top 10 as a real audit is a completely different experience than reading it as a checklist. I ran it against my TypeScript agent stack with system prompts, MCP tools, and Cline — and the findings were uncomfortable.
Jun 20 2026 · 9′ · Tutorials · TypeScript · LLM
The Vercel incident wasn't a technical vulnerability — it was a least-privilege failure applied to OAuth. Break down what scope creep is, how to audit it in existing integrations, and what architectural controls prevent a third party from accumulating permissions it doesn't need.
Jun 18 2026 · 11′ · Tutorials · TypeScript · nextjs
Architecture, real systems, product decisions and technical lessons. Everything reviewed with my own judgment before it ships.
230 articles published