Field notes
Practical notes on building, securing, and operating software when the details actually matter.
Every "we accidentally emailed someone who unsubscribed" incident has the same root cause: the check lived in the code that sends, and one send path forgot it.
17 Aug 2026
Two CSP headers do not override each other. The browser enforces both, your new allowed origin never takes effect, and nothing in the response looks wrong.
27 Jul 2026
The command that rebuilds the database from nothing is the one command every new machine runs first, and it is the one nobody runs again after the first month.
20 Jul 2026
An element that animates from invisible, told only to stop animating, stays invisible. The page does not lose its motion - it loses its content, for the people who asked for less motion.
13 Jul 2026
