Nonces are not a permission check
A common mistake that keeps turning up in otherwise careful code.
Tag
Contact
#performance
17 posts, newest first.
Posts here
17
Updated
Nov 06
Avg read
2m
Categories
8
Posts tagged #performance
Page 2 of 2
The handover document nobody writes
What the next maintainer needs, in the order they need it.
Reviewing a contact form like an attacker
Header injection, rate limits and what a honeypot really buys you.
Screen readers and the hidden sidebar
What we learned watching someone use the site for real.
Filters over forks
Why we leave a seam in the code instead of a note in the readme.
Reviewing the review checklist
We audited our own process and kept about half of it.
Archive pages that earn their place
Date archives can be useful if you give them a reason to exist.
A second opinion on your architecture
What an outside reviewer sees in the first ten minutes.