Guides
Practical guides for AI integrations and APIs
Written from real builds, with code that was run before it was published.
9 min read
eMudhra CA compromise: check whether your servers still trust the bad certificates
Browsers blocked the eight compromised eMudhra intermediates within days, but servers, containers and scripts trust whatever their bundled store says. Tested results for Node.js and Python, a checker that tries the real test chains, and what to update.
12 min read
Zeabur, Railway and TiDB Cloud breaches: rotate leaked environment variables in the right order
Three platforms leaked customer secrets in October 2026. What each confirmed, why routine rotation advice keeps leaked keys alive, a script that turns exported variables into a rotation plan, a query that finds planted database objects, and the Zeabur shutdown dates.
11 min read
Node2Shell in Python: the Brotli bug (CVE-2026-111497) in requests, aiohttp, pyarrow and Pillow
The Brotli C decoder bug reaches Python through brotli, brotlicffi and copies bundled in pyarrow and Pillow. Fixed versions, tests showing what requests, httpx and aiohttp decode, a checker that finds every copy, and stop-gaps that actually work.
12 min read
Node2Shell beyond Node.js: Brotli CVE-2026-111497 in Go, Java, .NET, PHP, Ruby, Linux and proxies
One C decoder, copied everywhere. A single table of every affected component (Node.js, Bun, Electron, Python, Go, Java, .NET, PHP, Ruby, Envoy, curl, Debian, Ubuntu, Alpine, RHEL), its status, how to check it and what to do where there is no fix yet.
6 min read
October 2026 security updates: Next.js, Node.js and PHP in one place
Next.js, Node.js and PHP all shipped critical fixes within a week. One table of fixed versions, a two-minute check for each, what to patch first, and the dates coming next.
10 min read
Node2Shell: Node.js Brotli decoder vulnerability (CVE-2026-111497), check and patch
An out-of-bounds write in Node.js's Brotli decoder can lead to remote code execution. Fixed versions, a checker that detects the fix in the binary itself, tests showing that Express 5, fetch() and axios decode outside Brotli data, and safe stop-gaps.
10 min read
Next.js security update, October 2026: check and patch CVE-2026-96889
Two critical RCEs and a denial of service in Next.js: which apps are affected, a no-dependency script that checks your installed versions and features, the sharp 0.34 trap on Next.js 15, and the upgrade I ran on this site.
11 min read
PHP2Shell (CVE-2026-109618, CVE-2026-109619): check and patch your PHP
Two critical PHP flaws allow unauthenticated remote code execution. Fixed versions, a tested script that tells you if a server is patched (including Ubuntu backports), patch steps per setup, and what to do if you cannot update today.
12 min read
Stripe webhooks in Next.js: endpoint, signing secret and events
Everything between 'Stripe should tell my app' and a reliable handler: creating the endpoint, the signing secret, which events to listen to, local testing, duplicates, ordering and retries. Tested handler code.
8 min read
Stripe hosted vs embedded Checkout: which one should you use?
The four ways to run Stripe Checkout today (hosted_page, embedded_page, form, elements), what you gain and give up with each, and type-checked server code for the two most common.
8 min read
Microsoft Teams webhooks with Workflows: send messages from Node.js
Microsoft 365 connectors are on their way out. How to create a Workflows webhook, the message format it accepts, tested Node.js code with retries, and the limits that bite.
9 min read
AWS Lambda cost calculator: estimate your monthly bill
Estimate a Lambda bill from requests, duration and memory, with x86 and Arm prices, the free tier, volume tiers and provisioned concurrency. Checked against AWS's own pricing examples.
9 min read
DynamoDB cost calculator: on-demand vs provisioned
Work out read and write units from item size, compare on-demand with provisioned capacity for your traffic, and see when switching saves money. Checked against AWS's pricing example.
11 min read
PostgreSQL MCP server: connect Claude and Cursor to Postgres safely
A tested Node.js MCP server that lets an assistant explore and query Postgres while a read-only role, a read-only transaction and query rules block writes, private columns and runaway queries.
11 min read
How to store your users' API keys safely in Node.js and MongoDB
If your app saves OpenAI, Anthropic or Stripe keys for your users, a database leak should not leak the keys. Envelope encryption, safe MongoDB reads, redaction and rotation, with tested code.
8 min read
Chrome stops running XSLT on November 17, 2026: fix your styled sitemap and RSS feed
Styled sitemaps and feeds will show raw XML in Chrome from version 158. A checker that finds affected files, and two tested Node fixes that keep a readable page.
14 min read
How to build a Node.js MCP server for your existing API
A working Node.js and TypeScript example that turns an orders API into three MCP tools, with validation, a guarded write action, a test you can run without any AI app, and an HTTP version for teams.
10 min read
Claude Desktop not working with your MCP server? Five checks that fix it
When Claude Desktop stops working with an MCP server: five places it fails, in the order to check them, what -32000 Connection closed and -32001 timeouts really mean, plus a script that starts every server in your config like the app does and prints the actual error.
8 min read
Stripe webhook signature verification failed in Next.js: causes and fix
The one-line cause behind most failures, a tested App Router handler, and a table that tells the error messages apart so you can find the real cause fast.
10 min read
Why your RAG chatbot gives wrong answers, and how to find the cause
Most wrong answers are retrieval problems, not model problems. A short script and three checks tell you which, using your own questions.