• I Spent a Weekend on My Search Library and Deleted Its Best Feature

  A couple weekends ago I shipped nine releases of libsql-search, from 0.3.0 up to 0.11.0. The headline change is that I took out the local embedding feature. It used to generate embeddings locally. No API key, no account, no provider. You …

• I Gave Install-Script Permission to a Package I Don't Have

  There’s exactly one file in one of my wiki projects that’s a security control rather than a config file, and I hadn’t read it in months. pnpm 11 removed onlyBuiltDependencies along with four related settings and replaced all of them with a …

• My Logger Documented Four Environment Variables. None of Them Worked.

  I shipped a logging library with a LOG_LEVEL environment variable. The README documented it. A dedicated docs page documented it with examples and runtime-specific caveats. There were unit tests covering it, and they passed on every CI run …

• My Rate Limiter Documented Its Own Bypass

  I went looking through the rate limiter on a docs search API this weekend and found a comment I’d written explaining exactly how to defeat the code directly underneath it. Not a TODO. Not a “we should probably fix this someday.” An …

• Four Embedding Models, All 1024 Dimensions, All Incompatible

  If you run a vector database, you’ve probably got a startup check that compares your configured embedding dimension against the collection’s actual vector size. Mine has two of them. They’re both useless for the failure I care about. Here …

• Adding a Column With a Default Broke Every Idempotency Key

  Adding a nullable column, or a column with a default, is the textbook example of a safe migration. Old rows get filled in, nothing breaks, no downtime. I’ve repeated that advice to other people. Then I added one to a table whose rows are …

• I Wrote 993 Lines of Tests for a Shell Script, Then Deleted the Script

  My MCP server has a just mcp-install recipe that prints a claude mcp add ... command you paste into a terminal. It reads your .env and emits one --env NAME=value pair per line. Above that block sits a banner: Secret values are redacted …

• My MIME Allowlist Wasn't Enforcing Anything

  I wrote a comment months ago that asserted a security property. Last week I read it back and didn’t believe myself. The comment sat above the function in src/lib/r2.ts that hands out presigned upload URLs, and it said this: Only ContentType …

• I Removed Three Dependencies. One of Them Actually Left.

  In forty-six minutes one morning I opened three pull requests, and every one of them deleted a dependency. The commits are timestamped, so I can be precise about it: 07:33 replace Sharp transforms with Bun.Image 07:55 enforce signed upload …

• Bun Was Faster. I Still Kept the AWS SDK.

  I ran a benchmark that should have ended the argument. One of my sites runs on Bun 1.4 and stores files in Cloudflare R2, which exposes an S3-compatible API. The application still used the AWS SDK for object reads, writes, metadata checks, …