Practical, no-fluff writeups on performance, security, browser auditing, and code quality.
More Security
The handful of API security mistakes that show up constantly - missing rate limits, weak auth, and overly permissive CORS - and what a reasonable baseline actually looks like.
Why a redirect parameter that accepts any URL turns your own trusted domain into free phishing infrastructure, and how to lock it down.
What the same-origin policy actually restricts, what CORS headers do to relax it safely, and the wildcard-plus-credentials mistake that turns a convenience header into a critical exposure.
Three cookie flags, three completely different attacks they stop - what each one actually does, and why a cookie missing even one of them is a real, exploitable gap.
The industry's most-cited security list, translated out of developer jargon - what each category actually means for a site you own but didn't build yourself.
Every third-party script you load is code execution on your site by a company you don't control - what SRI actually verifies, and where it can and can't help.
Expired certs, name mismatches, incomplete chains, and mixed content warnings - what each browser error actually means and how to fix it.
How a malicious page can make a logged-in user's own browser perform actions they never intended - and the tokens, cookie flags, and headers that actually stop it.
What an external security scan can and can't prove for a SOC 2 or GDPR audit, and how its findings map to the technical controls each framework actually requires.
