Node.js Forgot Password Without the Account Takeover
A Node.js forgot password route that trusts req.hostname emails users an attacker’s link. Fix the link, token, timing, and sessions. Secure yours today.
-
-
AWS Cognito Without Amplify in Next.js: Just OAuth
Run AWS Cognito without Amplify in Next.js. Write the OAuth flow by hand and fix the logout that signs users back in. Build it today.
-
Node.js Email Verification Without the User-List Leak
Most Node.js email verification tutorials tell attackers who your users are. Give every address the same answer in the same time. Fix your signup today.
-
6 Auth Security Checks to Run on Your App in 20 Minutes
Six auth security checks that catch token, cookie, logout, and rate limit bugs in about 20 minutes. Run them on your app today.
-
Simple Software Architecture Lessons for New Developers
Simple software architecture starts with saying no. Jerry Nixon’s NDC talk explains what every box does. Learn which ones to skip.
-
Role-Based Access Control in Express and Prisma
Most Node tutorials store the role on the user. Fix role-based access control with project memberships, and make missing checks fail the build.
-
JWT Logout Does Nothing: Refresh Token Rotation Fixes It
Most JWT logouts revoke nothing. Learn refresh token rotation, reuse detection, and the race condition that logs users out. Fix your logout today.
-
Why your Claude Code hooks ignore failing checks
Claude Code hooks that exit 1 get ignored. Learn the exit 2 wrapper and two-tier gate that make Claude fix its own code. Build your first hook today.
-
Matt Pocock’s AI Coding Workflow Explained
How Matt Pocock’s AI coding workflow uses grill me, specs, tickets, and old programming books to get better output from agents.
-
Zod with Express: Stop Writing your Types Twice
Zod with Express replaces hand-written checks and duplicate interfaces with one schema that validates and types your request body. Start with one route.
