Topic
Secrets delivery, response headers, a cookie banner that sets no cookies — and what happens when you attack your own features.
I added a privacy notice to my site and refused to make it a cookie banner — because the only cookie I set is a functional one. Here's the reasoning, and why the dismiss flag lives in localStorage, not a cookie.
The cheapest security win on a single-container stack lives at the reverse proxy. Here's the four-header Traefik middleware I shipped, the two things I deliberately held back, and the report-only CSP rollout I'm lining up next.
Five ways to hand a secret to a Docker container, ranked by who can read it back out. The source is just plumbing - environment variable vs file is what actually decides your exposure.
Posts that touch this subject but live under another topic.
I pointed the new claude-security plugin at this very site. It spawned 82 agents, proposed 10 vulnerabilities, and then argued itself out of 9 of them. The one that survived was real — and it shipped to prod the same afternoon.
Shipping an AI feature into my own product · Part 3
I added job-description matching to the AI concierge on my career site. It shipped with no new bean, no new table, and no migration — because the leverage was in a seam I'd already built. A design note on shared streaming cores, streamable structured output, and treating a pasted JD as hostile.
Shipping an AI feature into my own product · Part 2
My site has an 'Ask Zakaria' AI box that answers untrusted recruiter input. So I spent an afternoon trying to break it — prompt leaks, tool-call injection, XSS, a cross-language jailbreak. Here's what held, and why the real defense isn't a clever prompt.