Security
Middleware is not authorization
Four NestJS advisories in seven months, all one bug: the matcher and the handler disagreed about the request. The check belongs where the data is read.
Technical articles
Technical articles
SEO
How we shipped 24 pages that called themselves duplicates
Next.js merges metadata key by key, so a route that omits alternates inherits its layout canonical. Ours pointed every page at the homepage.
Security
Deserialization at the framework boundary
One RCE at CVSS 10.0, then six denial-of-service patches in eight months. When the contract is "accept whatever the format encodes", fixing one lever leaves the rest.
Security
npm install runs code you have never read
Eighteen malicious versions of one package went out in two and a half hours, harvesting tokens on install. Lockfiles, disabled scripts and short-lived credentials.
DevOps
Drupal tells you before it patches. Use the window.
A PSA names the date and the hours before the fix exists. That is time to verify versions, test a restore and book the slot — not time to read the advisory.
Security
Drupal core is fine. Your contributed modules are the risk.
Sixteen advisories in one day across fourteen projects, and most of them say access bypass. The fix is not more diligence, it is a shorter module list.
Performance
Why your NestJS API is slow
Two numbers explain most of it: how many queries one request ran, and how long the slowest took. Sixty small queries is a structure problem, not an index one.
Performance
Why a WordPress site gets slow, and how to actually diagnose it
Time to first byte separates a server problem from a browser one. Start there, chase the queries and the options table, and add caching last.
DevOps
From manual uploads to automated deploys — your first CI/CD pipeline
Four stages, a directory per release, and a symlink that flips in one operation. One file makes "what is running now?" answerable with a commit hash.
Security
Harden your site before it is breached, not after
Automated scanners do not read your project name first. Patching, blocking execution paths and two-factor auth come before any security plugin.