Thoughts on building products, fullstack engineering, and shipping software.
How a Safari ITP third-party cookie block and a React Hook Form autofill bug both caused "logged out on mobile" and looked like one bug, not two.
Login broke on MyTreda with a CORS error in the browser console. The real cause had nothing to do with CORS. Here's how I chased three wrong leads before finding a one-line port mismatch, using Claude Code alongside my own read of the logs.
Cloudflare was injecting a render-blocking script into MyTreda because of a plain email address in the footer. Here's what was happening, why it matters for performance, and the small change that fixed it.
A quiet open redirect vulnerability was hiding in MyTreda's login flow. Here's how I found it during a routine code review, why it mattered more than it looked, and the small fix that closed it.