Webhook security past the signature: replay attacks, payload trust, DoS, IP allow-listing, and secret rotation — what verification does not protect.
4 articles
Webhook security past the signature: replay attacks, payload trust, DoS, IP allow-listing, and secret rotation — what verification does not protect.
Feature flags without LaunchDarkly: a Postgres-backed, ~100-line system with deterministic percentage rollout, per-tenant overrides, and caching.
Isomorphic canvas rendering: one drawCard() runs in the browser and on the server via @napi-rs/canvas, so the share image and in-app card never drift.
Deterministic random in JavaScript: why a viral web toy dies if it uses Math.random(), and how FNV-1a + mulberry32 make the same wrong answer reproducible
AvailableGot a project in mind?
Whether it's a new product, an integration, or scaling an existing system — let's talk about how I can help.