Updates from the Eternalsix studio.
There is no such thing as 'escaped text' — only text escaped for a specific place. Here's what each context needs, the bugs that come from mixing them, and why you escape on output.
A slug looks like a formatting problem and behaves like a database key. Here's what actually goes wrong — accented characters, duplicate titles, route collisions — and how to decide before you ship.
YAML is JSON with nicer syntax, right up until a country code turns into false and a version number loses a digit. Here's every trap worth knowing, and when to use which.
The complexity rules everyone was taught optimized for the wrong thing. Here's how password strength really works, measured in bits.
A number counting seconds since 1970 sounds simple. Here's why time is the hardest 'simple' thing in software — and how to stop getting it wrong.
Random IDs you can generate anywhere, with no coordination — but the version you pick has real consequences for your database. Here's how to choose.
Three words developers use interchangeably that mean completely different things. Confusing them causes real security bugs — here's the clean mental model.
You don't need to memorize the whole grammar. A dozen constructs cover almost every regex you'll ever write — here they are, with the traps.
Three encodings developers mix up constantly. None of them is encryption — here's what each one solves and when to reach for it.
Five little fields control almost every scheduled job on the internet. Here's how to read and write them without guessing.
A JWT is three base64 chunks and a signature. Here's what each part means, what it protects, and the mistakes that turn tokens into vulnerabilities.
A working guide to reading, fixing, and trusting the JSON that flows through every API you touch.