Blog

Thoughts on building products, fullstack engineering, and shipping software.

Code diff showing email string split to prevent Cloudflare email-decode.min.js injection

The Cloudflare Script That Was Slowing Down My Site (And How I Fixed It)

Cloudflare was injecting a render-blocking script into MyTreda because of a plain email address in the footer. Here's what was happening, why it matters for performance, and the small change that fixed it.

June 22, 2026

4 minRead

Diagram showing a login redirect pointing to an external malicious URL instead of the intended internal page

securityweb-developmentnextjs

The Redirect Bug Nobody Would Have Noticed

A quiet open redirect vulnerability was hiding in MyTreda's login flow. Here's how I found it during a routine code review, why it mattered more than it looked, and the small fix that closed it.

June 22, 2026

4 minRead