Things I build, break, fix, and write about

1 September 2026
Metadata schema choices for content libraries

Structured metadata only works when it matches how people actually retrieve content. I have seen neat schemas fail as soon as the library meets real records, and tarot makes the problem obvious. If the fields do not support search, filters, and odd edge cases, the catalogue stops being useful.

31 August 2026
Federation trade-offs in self-hosted social feeds

Federation looks tidy until you let it touch the edges, and then the odd cases arrive fast. I prefer self-hosted social feeds that stay explicit about...

31 August 2026
FireAvert Z-Wave stove shutoffs for offline safety

FireAvert’s setup does the part that matters without asking Home Assistant to babysit it, which is exactly how I want stove protection to behave. The...

31 August 2026
Weekly Tech Digest | 31 Aug 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's...

Latest blog posts you might like

25 July 2026
Check npm and PyPI packages for compromise

A clean package yesterday means very little if a fresh update arrives with new maintainers, odd install scripts, or a version jump that does not make sense. I look for software supply chain trouble by...

25 July 2026
Missing checks in Cognito external IdP flows

AWS Cognito PreSignUp_ExternalProvider is the last sane place to stop a bad federated login before Cognito writes the user down. I have seen enough messy JIT provisioning to know that putting the...

24 July 2026
HTTP and FTP fetches via CFITSIO EFS

CFITSIO Extended Filename Syntax is not just a fancy path parser, it can turn a filename into a network request or a file copy before anyone checks the data. I have seen enough of that sort of trick...

24 July 2026
ALB listener rule order can skip auth

AWS ALB listener rules are one of those things that look tidy until priority bites you, and the broad path wins before auth ever has a chance. I have seen a protected URL that was only protected on...

23 July 2026
Comparing true positives and false positives in pentests

I tested AI pentest platforms against live web apps and checked every finding by hand, because confidence is cheap and reproduction is not. The real question is not how much they report, but how much...

23 July 2026
WrappedADS wrapTo mint path allowance checks

WrappedADS wrapTo mint path looks tidy on paper, but the trace tells a sharper story. The mint happens before the allowance moves, and that means the real question is who was allowed to call it, not...

22 July 2026
SEA settlement adapter rounding error inflates redemptions

SEA settlement adapter rounding logic turned a fixed USDT lot into too much SEA, and the loop only worked because the state kept pretending nothing had changed. I have seen enough accounting bugs to...

22 July 2026
Tracing unauthorised payouts in bridge dispatcher

I spent more time than I wanted tracing Ethereum bridge proof verification through the dispatcher, and the uncomfortable bit is simple, the proof path and the payout path were effectively the same...

21 July 2026
Spot-price oracle manipulation in staking vaults

spot-price oracle manipulation is not a theoretical edge case, it is what happens when a vault trusts raw reserves as if they were market truth. I have seen enough broken staking logic to know the...

21 July 2026
SquidRouterModule express path and forged sourceAddress

SquidRouterModule express path looked tidy until I traced the forged sourceAddress and a zero-amount call straight through to Safe actions. Once attacker-controlled bytes were trusted for the delegate...