Journal
Security
5 posts
- The Senior Frontend Engineering Blueprint, Part 6: Regex Engines, ReDoS and Defending Untrusted InputA validation regex that passes code review can still be an O(2^n) time bomb. Here is how V8's regex engine actually backtracks, the exact shape of pattern that wedges it, and the rest of the perimeter — Zod pipelines, parameterised SQL, DOMPurify, CSP — that a Next.js app needs around untrusted input.JavaScriptPerformance12 min
- The Senior Frontend Engineering Blueprint, Part 5: Edge Proxies, Auth.js Credentials and a Server-Side Data Access LayerA redirect from the edge feels like security, but an attacker can skip it entirely by calling your Server Action directly. Here is the request pipeline Next.js 16 actually runs, a Credentials-based Auth.js v5 setup with Prisma and RBAC, and the data access layer that is the only boundary that actually holds.ArchitectureEngineering13 min
- Self-Hosted SSO: Wiring authentik to Next.js 16 and Auth.js v5, Including the Logout That Does Not Log OutPutting an identity provider you own in front of your own applications is a weekend of work and a decade of consequences. Here is the whole mechanism — the discovery document, the id_token, the encrypted session cookie — and the single logout that Auth.js cannot perform at all.EngineeringSecurity13 min
- Hardening Agent Sandboxes: MicroVMs, gVisor and WebAssembly for Untrusted CodeAn AI agent running shell commands is an arbitrary code execution primitive you installed on purpose. Here is the isolation ladder — container, gVisor, Firecracker, WebAssembly — what each one actually stops, and what it costs per sandbox.AIAgents7 min
- Senior Frontend Interview Prep, Part 5: The Object Model, Prototypes and MetaprogrammingFifteen questions on what an object really is: prototype chains, property descriptors, what `class` desugars to, prototype pollution with a working exploit, and why `Proxy` and private fields do not get along.JavaScriptFrontend13 min