Development
The bug behind the bug
A broken GitHub widget traced to a paused upstream demo - and, found along the way, a hash-pinned CSP silently invalidated by a one-line accessibility fix.
Dev Log
Building in public
Notes on the software, games, and music coming out of Imperfect Systems.
RSS feedDevelopment
Three doors that were never locked
A null CSP, a config value joined onto a filesystem path unchecked, and a vault picker that would accept your home directory - none broken yet, all unlocked.
Development
The 404 that was already correct, and the robots.txt that wasn't
A Sitemap directive that had to point at the index, a 404 fix that almost got overbuilt, and a documented Cloudflare behavior that didn't materialize when checked.
Development
The CSP that only broke in production
Four failures behind one header: dead middleware, _headers rules that merge instead of override, a blob-URL worker under script-src, and a script only the edge injects.
Development
Giving every share link a face
An og:image guard that never fired, a one-line default that fixed it, a purpose-built terminal card, and a retina gotcha in headless Chrome.
Page 36 of 53