Posts

Delegate account management without granting admin

Add narrowly scoped account-management authority without handing a service role every power carried by an administrator permission.

Prove SMTP authentication on every connection

Treat SMTP authentication as connection state, require fresh proof after every handshake, and fail closed when a server tries to downgrade the protocol.

Separate installation from production activation

Qualify database installation and production activation as separate gates so a successful setup cannot hide a blocked runtime.

Track campaign conversions without storing contact details

Measure which registered campaign links lead to saved contact messages without copying personal details into analytics.

Repair stale digest pins without weakening verification

Treat a stale generated-artifact digest as a fixture migration, then prove the real reference configuration still renders.

Make integration tests independent of your local .env

Give integration tests complete, temporary configuration so they pass for the same reason on every machine.

Preserve failed test evidence before you retry

Design a qualification harness that keeps the first failure, accounts for uncertain resources, and publishes useful evidence without exposing secrets.

CLI help must not mutate your filesystem

Defer application boot and filesystem authority until your CLI framework has validated that a mutating command will actually execute.

Do not let generated content replace your homepage

Keep generated collection routes from replacing your application homepage when detail pages live at the root.

Do not construct authentication policy inside a login helper

Keep login, logout, eligibility, credential upgrades, and HTTP permission checks behind the authentication services configured by your application.