Security & Privacy
Building production systems that hold up under hostile traffic, browser quirks, and regulator-grade scrutiny.
Layered bot defense for a public form: honeypot, Turnstile, email verification, and the pieces between
A public, unauthenticated form that writes to the database and sends email is a bot's favorite denial-of-service target. No single control is enough. The point is layering honeypot, Turnstile, rate limiting, and email verification so one layer failing doesn't sink the rest.
Moving JWTs out of localStorage: the surprises waiting in ActionController::API
A JS-readable token in localStorage is one XSS away from account takeover. Moving it into an HttpOnly cookie is the well-known fix but ActionController::API has no cookies, no CSRF, and a few other surprises waiting on the first commit.
CSP nonces vs. 'unsafe-inline': the silent override that broke our admin UI
A nonce and 'unsafe-inline' in the same CSP directive: the browser silently drops 'unsafe-inline' by spec. Debugging a policy that quietly broke production.
