2026-09-08
Your CSP can silently kill WebAssembly: a production postmortem
Every test was green locally. In production, half the app was dead — blocked by our own security header. What 'wasm-unsafe-eval' does, and why only a live test run caught it.
Engineering notes
What we learned building a PDF toolkit that runs entirely in the browser — the bugs, the design calls, and the verification machinery.
2026-09-08
PDF redaction that proves itself
Drawing a black box over text doesn't remove it — that's how real court filings leak. On building redaction as destruction, and a verifier that treats its own output as untrusted.
2026-09-08
Making a website work in airplane mode
'Works offline' is easy to claim and easy to get subtly wrong. The gap between runtime caching and a real first-visit guarantee, and the build pipeline that closes it.