Development
Closing the door nobody was using
The apex domain sent no mail and had no SPF or DMARC, which meant anyone could forge it. Two DNS records, ninety seconds in a dashboard, one dig to verify.
Dev log
Imperfect Systems
Development
The bug that was actually the debugger
The site-wide mobile clipping bug that didn't exist: headless Chrome silently clamps to a 500px floor and crops the screenshot to whatever width you asked for.
Development
Screenshots for an app that has no simulator
MusicKit returns nothing in the simulator, so the marketing screenshots came from the mock service the app already shipped - plus real cover art from the iTunes Search API.
Development
The bug behind the bug
A broken GitHub widget traced to a paused upstream demo - and, found along the way, a hash-pinned CSP silently invalidated by a one-line accessibility fix.
Development
The CSP that only broke in production
Four failures behind one header: dead middleware, _headers rules that merge instead of override, a blob-URL worker under script-src, and a script only the edge injects.
Development
The 404 that was already correct, and the robots.txt that wasn't
A Sitemap directive that had to point at the index, a 404 fix that almost got overbuilt, and a documented Cloudflare behavior that didn't materialize when checked.
Development
Giving every share link a face
An og:image guard that never fired, a one-line default that fixed it, a purpose-built terminal card, and a retina gotcha in headless Chrome.
Development
Three ways "the spec said X" was wrong
A dead symlink target, a fix already queued by automation, and docs describing components that don't exist - three sources of truth, same lesson each time.
Development
The favicon that was broken for months and nobody would have known
A perf batch with an easy half (prerender, PNG optimization) and a silent failure: an SVG favicon whose external image reference browsers drop without a word.
Development
Testing a deploy gate accidentally deployed the thing I was testing
Adding astro check and Prettier before every deploy, a type error the sibling site had already solved, and a manual build trigger with no concept of a dry run.
Page 1 of 2