Notes from building the things on the homepage

Application code is not allowed to be the thing that keeps tenants apart. Deny-by-default rules, immutable server-owned fields, custom claims, and why an unscoped list query is rejected rather than filtered.

11 min read

If the bill scales with page views rather than signups, the architecture is wrong. Aggregate documents, no live listeners, counters instead of counts, and the two mistakes that cost money first.

10 min read

A Guideline 3.2 rejection caused by one redirect, navigation arrows that lie about where they lead, a service worker that outlived its app, and what Apple and Google each actually review.

11 min read

A build step generated a hundred Cloudflare routing rules for a site that needed two. Deciding the Pages and Workers boundary deliberately, why a quiet override always reverts, and why cost and attack surface are the same variable.

9 min read

Claims make authorisation unforgeable and free to check inside a rule. They are also a snapshot up to an hour old, which makes granting a support ticket and revoking a security problem.

10 min read

Exit code zero is not proof and a green deploy is not proof. Cache and User-Agent traps, controls that fail open silently, and separating what was measured from what was inferred.

9 min read

An in-memory counter in a serverless runtime is a rate suggestion, not a rate limit. What it still buys, where the real ceiling has to live, and which direction to fail in.

9 min read

Storing rendered pages as documents is convenient and charges you a read per view. When that trade is right, why sitemaps must never be one, and the split I settled on.

9 min read

Six finished, deployed, indexable pages on my own site that nothing linked to. Why every green signal missed it, and the symmetric check that catches it.

8 min read

Auth, Firestore and Storage do not roll back together. The ordering that survives a crash, the records you anonymise rather than delete, and doing it without a privileged server.

10 min read

Firebase web API keys and Stripe publishable keys are public by design. Which values genuinely are secret, the four stores I keep them in, and why rotation cost decides how bad a leak is.

9 min read

A rule is a pure function from request and resource to a boolean, so it can be evaluated with no data and no accounts. What to assert, and why untested rules calcify.

9 min read

Rules, data and code deploy separately, so the intermediate states are real. Which order is safe, why, and what a backfill has to guarantee before the rule ships.

10 min read

Security rules evaluate every document in a batch against the world before the batch, so multi-tenant sign-up cannot be atomic. Three ordered writes, and the failure modes you now own.

9 min read

Deleting one fails silently and breaks unrelated things hours later. The thirty-day recovery window, where the identifier survives, and how I name and scope them now.

8 min read

Creating a test user through the sign-up form sends a real message. Why the REST endpoint does not, what a bounce to a reserved domain costs, and why deletion is part of creation.

8 min read

Five weeks of nightly runs producing nothing, with every component working. The two kinds of zero, alerting on staleness instead of errors, and the watchdog that costs more than what it watches.

8 min read

Google Sheets evaluates what you append. Why valueInputOption RAW is a security control, the same bug in any CSV export, and why escaping belongs at each boundary rather than at intake.

9 min read

Field names, plan keys and enum values are stored in every record you have written. Why a rename is a migration, why lookups fail closed, and expand, migrate, contract.

9 min read

Moving a working screen into a second app: the logic travels, the numbers do not. The calc() value that broke a layout, and the five steps I copy features by now.

8 min read

Every scaling fix has a size at which it becomes due. Write the number beside the simple design, derive it from the limit, and check it without paying for the check.

8 min read

Location metadata in a phone photo, a content type the client made up, an SVG served from your own origin, and the nine old profile pictures nobody deleted. The upload design I use now.

8 min read

A catch-all that returns the home page for every path makes a probe for a secret file, a broken-link check and an uptime monitor all report success. Why the body decides, and scoping the fallback.

6 min read

A daily content job that runs git add -A publishes everyone's unfinished work. Staging exact paths, stale remote-tracking refs, never forcing, pushes that do or do not deploy, and validating artifacts.

7 min read

Missed runs, retries and manual restarts all repeat work. Keying on the output instead of the run, checking state before writing, ordering steps so a crash is repairable, and reporting skips.

7 min read

Reading landing-page copy as data: which sentences are really queries, why a badge should be driven by a field, why a price renders with its renewal terms, and the one-question test for every line.

7 min read

Scroll that bleeds between states, a message bar over the inbox, a back gesture that leaves the tab. Why the messaging inbox and thread are separate screens, and how the thread layout is derived.

7 min read