Long-form notes on debugging, dev tools, and privacy-respecting workflows. Each post links the tools that solve the problem.
Your app works on localhost and throws crypto.randomUUID is not a function when you open it on your phone at http://192.168.1.20:5173. randomUUID is secure-context only, and a private LAN IP over http is not a secure context.
npm v12 blocks dependency lifecycle scripts, git dependencies and remote tarballs by default. What breaks, how to read the skipped list, and how to write an allowlist you can commit.
The same JSON file parses over HTTP and throws when read from disk. The three invisible bytes at the front, why one path strips them and the other does not, and the one-line fix.
A family emoji is one character to a user, seven code points to a spread, and eleven to .length. Counters, limits and truncation all disagree unless you count graphemes.
A date-only string parses as UTC, the same string with a time parses as local, and the difference is a whole calendar day west of Greenwich. Why the off-by-one happens and what to use instead.
The same JavaScript number formatted two ways gives 1.00 and 1.01. toFixed rounds the exact binary value; Intl.NumberFormat rounds the printed decimal. Pick one deliberately, especially for money.
YAML 1.1 parsers turn no, off and yes into booleans, so a country code becomes false and an "on:" key becomes true. Which parser you use decides whether your config survives.
DMARCbis shipped in May 2026 as RFC 9989, 9990 and 9991, obsoleting RFC 7489. Most of your record survives — but pct, rf and ri are gone, and the Organizational Domain is now found by a DNS tree walk instead of the Public Suffix List.
Redirect a POST with 301, 302 or 303 and clients are allowed to drop the method and the body. The request still returns 200, so the bug looks like the server ignoring your payload.
The same + is a literal in a URL path and a space in a query string. That split silently corrupts base64, signatures, and any value you pasted straight into a URL.
A 19-digit ID goes into JSON.parse and a different 19-digit ID comes out. No error, no warning. Why it happens, how to detect it, and the three ways to fix it.
The same accented word has more than one legal encoding. If one comes from a macOS filename and the other from a form field, equality checks, uniqueness constraints and search all quietly break.
Backtracking engines can take exponential time on inputs a few dozen characters long. Here is how to spot the shape that does it, and what each language actually gives you to stop it.
no-cache stores the response and revalidates it. no-store is the one that refuses to write anything down. Getting them backwards either leaks private data into a shared cache or throws away every conditional request you could have had.
SVG is XML that can carry <script> and onload. If your users upload avatars or logos and you serve them from your own origin, you are hosting stored XSS. Here is what actually stops it and what only looks like it does.
A cell that starts with =, +, -, @, tab, or carriage return is a formula, not text. If your export contains user-supplied strings, someone else opens your CSV and runs their code. Here is the fix and why the obvious one is wrong.
OpenAI cut its cheapest GPT-5.6 tier by 80% on July 30. Your bill will not drop 80%, because output tokens cost 6x input and retries and resent context are billed in full. Here is the arithmetic that actually predicts your invoice.
A single as unknown as turned a working library call into a feature that failed on every input — and typecheck, unit tests and the build all stayed green. Here is why the double cast disables the one guardrail that would have caught it, and what to write instead.
Introspection lets any client download your entire schema — every type, field, argument, and deprecation note — with one query. Great in development, a reconnaissance gift in production. What __schema returns, how it is abused, and the right way to lock it down.
A .har export from your browser Network panel captures every request and response — Authorization headers, session cookies, CSRF tokens, full request bodies. Here is what is inside, why support keeps asking for one, and how to redact it safely.
The three base64url segments of a JWT are readable by anyone — decoding tells you what a token claims, not whether the claim is true. The structure, the decode-versus-verify gap, and the alg:none and RS256-to-HS256 attacks that turn that gap into account takeover.
The Unix epoch is simple until it is not. Milliseconds versus seconds, signed 32-bit overflow in 2038, leap-second smearing, and timezone assumptions cause real production bugs. The field guide with the conversions that actually matter.
Base64 is a reversible text encoding with no key. Anyone can decode it in one line. Here is why it keeps getting mistaken for protection — in Basic Auth, JWTs, and Kubernetes Secrets — and what each of those actually relies on.
PDFs carry an Info dictionary and an XMP stream that record author name, the exact software and version that made the file, timestamps, and sometimes earlier revisions. Here is what is in there and how to remove it without uploading the file anywhere.
Random UUID v4 primary keys scatter inserts across a B-tree, causing page splits and cache churn. UUID v7 is time-ordered and inserts append to the right edge. Here is the mechanism, per database engine.
A practical look at ffmpeg compiled to WebAssembly — what video work it does well in a browser tab, where it stalls, the COOP/COEP headers it needs to run multithreaded, and the size cost of shipping a video editor with no backend.
iPhones record 4K HEVC at 16:9 by default. YouTube Shorts wants 9:16 vertical MP4 under 60 seconds. The mismatch causes silent upload failures, letterboxed playback, and quality loss. Here is the conversion in two browser-only steps, with no upload to a third-party service.
A 4-word EFF diceware passphrase has more entropy than a 12-character random password and is dramatically easier to remember. NIST has recommended length over complexity since 2017. Here is the math, the standards, and why memorable-sentence generators are the right default in 2026.
Sunday is 0 in POSIX cron, 1 in Quartz, and 1 in AWS EventBridge — and the difference silently shifts your job by a day. A field-by-field guide to the four dialects you will actually encounter, with a side-by-side comparison and the conversion rules.
Decoding the most common JSON.parse error in JavaScript: how to find the byte offset, what each variant of the message means in Chrome / Firefox / Safari, and the five mistakes that trigger it.
A fast browser-only workflow for syntax-checking a YAML manifest, converting it to JSON for tooling that does not speak YAML, and avoiding the silent type coercions that bite production deploys.
