FIELD NOTES

Posts

Specific incidents, real numbers, no generic advice. Every claim traces to a commit, a log, or a postmortem.

Start here

New here? These show the security work most directly — a real vulnerability and its fix, a compliance gate, a recurring bug finally stopped by automation.

SECURITY

The regulation in my build pipeline

A federal statute constrains what my product is allowed to say. An audit found 18 violations in my own copy — so I wired the forbidden phrasings into the build and made shipping one impossible.

JUN 2026 · 5 MIN
METHODOLOGY

The email that shipped three times

I let AI agents build my own email plumbing on top of Resend. The same bug — marking undelivered mail as “sent” — shipped three times before a build gate finally stopped it.

JUN 2026 · 5 MIN
SECURITY

The REVOKE that didn't

I locked a sensitive database function, verified the lock, and a Supabase default grant to the anonymous role left it open to the internet for three days.

JUN 2026 · 5 MIN

All posts

SECURITY

1 of 16: auditing my own guardrails

I built sixteen guardrails to stop my AI coding agents from destroying work. Then I audited them like a consultant would. One actually worked.

JUN 2026 · 5 MIN
POSTMORTEM

Compile-green, deploy-broken

Every test passed and it worked on my laptop. In production, placing PDF signature fields failed four different ways — pdf.js in a serverless runtime — each one invisible until the previous fix.

JUN 2026 · 6 MIN
SECURITY

The regulation in my build pipeline

A federal statute constrains what my product is allowed to say. An audit found 18 violations in my own copy — so I wired the forbidden phrasings into the build and made shipping one impossible.

JUN 2026 · 5 MIN
METHODOLOGY

The email that shipped three times

I let AI agents build my own email plumbing on top of Resend. The same bug — marking undelivered mail as “sent” — shipped three times before a build gate finally stopped it.

JUN 2026 · 5 MIN
CASE STUDY

Five days, 140 commits, one detective's report

A friend was being stalked. I built an investigation tool to evidence standards in five days — and chose never to publish it.

JUN 2026 · 5 MIN
METHODOLOGY

Knowledge compounds, workarounds don't

I analyzed 52 of my own AI coding sessions. The same six problems had been “solved” more than twenty times — and every solution evaporated when the session ended.

JUN 2026 · 4 MIN
CASE STUDY

Building for a market with an expiration date

A Supreme Court ruling created a multi-billion-dollar refund pool — one that shrinks every month on a fixed legal schedule. A decaying market changes every product decision.

JUN 2026 · 5 MIN
POSTMORTEM

Never make a user wait on an AI

My first product's worst bug wasn't the AI being wrong. It was awaiting the model inside a web request that dies at 26 seconds.

JUN 2026 · 5 MIN
CASE STUDY

StackBadger: the tool that outlived its sprint

I built a black-box security harness to attack my own product. The product sprint ended. The tool kept earning commits — so I generalized it and published it.

JUN 2026 · 5 MIN
META

The register: eight products in 136 days

What shipped, what got shelved, what got killed — and why the kills are documented as carefully as the launches.

JUN 2026 · 5 MIN
SECURITY

The REVOKE that didn't

I locked a sensitive database function, verified the lock, and a Supabase default grant to the anonymous role left it open to the internet for three days.

JUN 2026 · 5 MIN
"Prose documents intent. Gates enforce it."
The operating principle behind every project here. The same bug shipped three times past written rules — and zero times past a CI gate. Deterministic enforcement beats advisory documentation, in agent harnesses and security programs alike.