Thoughts on building products, fullstack engineering, and shipping software.
A Fluid Active CPU warning on Vercel sent me digging through my Next.js middleware, and I found a mis-scoped matcher burning CPU on every request, plus a routing bug that had quietly 404'd part of the app for six days.
How a Safari ITP third-party cookie block and a React Hook Form autofill bug both caused "logged out on mobile" and looked like one bug, not two.
Login broke on MyTreda with a CORS error in the browser console. The real cause had nothing to do with CORS. Here's how I chased three wrong leads before finding a one-line port mismatch, using Claude Code alongside my own read of the logs.
Cloudflare was injecting a render-blocking script into MyTreda because of a plain email address in the footer. Here's what was happening, why it matters for performance, and the small change that fixed it.
A quiet open redirect vulnerability was hiding in MyTreda's login flow. Here's how I found it during a routine code review, why it mattered more than it looked, and the small fix that closed it.