Welcome to the Showcify Blog
Most portfolios introduce themselves before they show anything. The best ones reverse the order. A short argument for putting the work first.
The eval graded the answer key, not the document
An extraction eval stayed green for weeks while users watched their data get mangled. The cause: it graded output against our labels, not against the source.
Charge the quota when you deliver value, not when you accept the request
A visitor gets two free runs. Two dead links later they have used both and received nothing. Where you decrement a quota is a product decision in disguise.
The eval was grading a prompt we had deleted
Our record/replay eval could not run for two days and reported green throughout, because the scorer kept grading cached results from a prompt we had deleted.
The security gate that defaulted to off
Our docs called the bot challenge mandatory. The env flag behind it defaulted to false in the deploy config, so a routine deploy would ship the gate down.
Two honest counts, one wrong number: Counter and Validator count different things
The live counter said 5,982 of 6,000. The server said too long. Both were honest; they were counting different strings, and multipart encoding was why.
Restorable but not shareable: hiding a token in history.state
A result that survives refresh and the back button but cannot be shared by copying the URL. A forgotten browser API, a header, and one deliberate deletion.
Our rate limits were bypassed by a trailing slash
Five tuned Rack::Attack throttles, all matching the path exactly. Rails normalised the path after they ran, so a dot-json or a trailing slash bypassed every one.
Treat model output like user input
When strangers write the prompt and the answer renders on your page, you have two untrusted boundaries back to back. The layered posture we settled on.
Layered bot defense for a public form: honeypot, Turnstile, email verification, and the pieces between
A public, unauthenticated form that writes to the database and sends email is a bot's favorite denial-of-service target. No single control is enough. The point is layering honeypot, Turnstile, rate limiting, and email verification so one layer failing doesn't sink the rest.
Moving JWTs out of localStorage: the surprises waiting in ActionController::API
A JS-readable token in localStorage is one XSS away from account takeover. Moving it into an HttpOnly cookie is the well-known fix but ActionController::API has no cookies, no CSRF, and a few other surprises waiting on the first commit.
CSP nonces vs. 'unsafe-inline': the silent override that broke our admin UI
A nonce and 'unsafe-inline' in the same CSP directive: the browser silently drops 'unsafe-inline' by spec. Debugging a policy that quietly broke production.
Three Ways VCR Cassette Recording Lied to Me
Three vcr recording behaviors that never raise an error: the config beats the CLI flag, ambient traffic gets taped, and re-records append instead of replacing.
Cross-provider LLM failover without losing observability
Every LLM provider goes down eventually, so the obvious move is to retry against another one. The naive rescue-and-retry works until your bill spikes and the logs can't tell you how often failover fired or what it cost. Here's the version that keeps the receipts.
How a Private Draft Can Hide Your Live Portfolio From Google
A published portfolio — complete, polished, exactly what search engines want — quietly vanished from Google. The culprit wasn't the live page at all. It was a private draft nobody could see, plus a one-line assumption in our SEO gate that counted it as a duplicate. A short debugging story about canonical URLs, sensible defaults, and the danger of de-indexing both copies of a tie.
