Tools I Use.
Production-use reviews of the dev and SaaS tools I run daily. No vendor PR. No "10x productivity" promises. Just what works, what doesn't, and what to pick when you're trying to ship without burning a weekend reading docs.
Some links on this site are affiliate links. I only link tools I actively use in production (and pay for). If I write that I picked tool A over tool B, it's because I picked it — not because the affiliate rate is higher. Vendor PR is what I'm trying to escape, not become.
Using Claude Code on real projects? I put the working repo rules, hooks, and review loops into a focused cookbook catalog: Claude Code Cookbooks.
Tools I built
Small, focused reliability tools I run in production — the ones the comparisons below keep coming back to. Free tiers on each.
CronCanary
Dead-man's-switch monitoring for cron jobs and scheduled tasks. Get paged when a job goes silent — not days later.
RequestTrace
Inspect, replay, and debug webhooks and HTTP requests with a permanent URL. Built for the "what did they actually send?" moment.
Tokenwise
Token-cost analytics for Claude Code and LLM workflows. Find the prompts and retries quietly inflating your bill.
SiteGuard
Free website security scanner — headers, TLS, and common misconfigs in one scan. No signup to run a check.
-
What your employees paste into AIThe 2026 DBIR ranked source code as the #1 data type employees paste into generative AI. Shadow AI is a visibility problem you can start solving with logs you already have.
-
Your $100 AI Coding Plan May Cost the Vendor $1,000. The Developer's Read.An estimated 2.5x to 12x subsidy on agentic coding. The honest developer's read: cheap tokens are borrowed time, so price in the day it ends.
-
Your scheduled jobs can fail silently — and nobody gets pagedGitHub's Dependabot stalled scheduled jobs for two days and threw no error. Why a missed run is the hardest failure to see, and the external dead-man's-switch pattern that catches it.
-
When your company pulls your AI coding toolsCompanies are yanking access to Claude, ChatGPT and Copilot in 2026. The three real drivers (cost, data, control), why bans backfire into shadow AI, and what developers actually do about it.
-
One GitHub issue could hijack any repo running Claude Code's ActionA [bot]-name trust bypass plus indirect prompt injection plus an OIDC token replay turned one GitHub issue into repo write access, and Anthropic's own action repo was in the blast radius.
-
The Mother of All AI Supply Chains: when MCP itself is the vulnerabilityA new disclosure puts the flaw in the Model Context Protocol itself, not in any one agent. STDIO command execution, 9 of 11 registries serving poisoned servers, RCE on six live platforms, and an SDK whose maintainer calls the behavior expected. What it is and what to change.
-
Conventional Commits Optimizes the Wrong FieldConventional Commits front-loads the commit type and makes scope optional, which is backwards. When the convention earns its overhead, and when it is a tax on your commit hook.
-
An AI agent deleted a company's database and its backups in nine seconds. The lesson is blast radius.An agent found a token with delete permissions, the provider ran the destructive call with no confirmation, and the backups shared the same blast radius. Least-privilege, backups outside the blast radius, and a watcher that lives outside the system.
-
Shopify showed paying merchants a 'This store does not exist' page. The monitoring lesson is brutal.Shopify's June 3 outage replaced paying storefronts with a does-not-exist page and a signup ad. The monitoring lesson most teams get wrong.
-
Vibe coding's security debt: the AI-generated code CVE surgeThe AI-coding-tool CVEs get the headlines. The bigger liability is the security debt in the code these tools write for you. What the data shows, and what to do about it.
-
KVarN: 2-Bit KV-Cache That Beats FP16 Throughput, and Where the Catch LivesHuawei's 2-bit KV-cache quantization beats FP16 throughput. The variance-normalization trick, and the memory profile where it pays off.
-
Gemma 4 12B is encoder-free and runs on a 16GB laptop: what that actually meansGoogle's Gemma 4 12B drops the multimodal encoders, adds native audio, and fits in 16GB. Why the architecture matters if you run coding agents locally.
-
The AI mandate is getting rolled back, and it's a measurement problemMicrosoft and Uber are rolling back AI coding mandates over token cost. The real problem isn't price — it's that nobody could see the spend until the invoice arrived.
-
When AI builds itself: a practitioner's read on Anthropic's recursive self-improvement reportAnthropic says Claude wrote 80% of its production code in May 2026. A ground-level read on what 'AI building AI' actually means when you run an autonomous dev operation yourself.
-
Long-running Claude Code agents drift. Here's what keeps mine on the railsFour hard-won lessons from running a fleet of Claude Code agents 24/7: separate planning from coding, budget context, use subagents to protect the main thread, and demand evidence over a 'done' claim.
-
If everything is a "Critical" priority, then nothing isWhy marking every alert Critical guarantees the real outage gets ignored, and the SRE practices that cut the noise.
-
Did Claude make rsync buggier? Here's what the release data showsrsync 3.4.3 broke incremental backups and the internet blamed Claude. The release data across 36 versions tells a different story about AI, test coverage, and shipping fast.
-
TrapDoor: the supply-chain attack that poisons your agent's CLAUDE.mdA campaign of 34 malicious packages across npm, PyPI, and Crates.io rewrites the CLAUDE.md briefing your coding agent trusts, so the agent itself redirects requests and leaks credentials. How it works and what to change.
-
TrustFall: the one-click RCE hiding in your coding agent's trust dialogThe trust prompt was the safety net. A regression turned it into a single-keystroke path to RCE, and on CI runners it needs no keystroke at all.
-
SymJack: the symlink RCE that broke six AI coding agents at onceYou approve copying a few media files. They're symlinks. The write lands on your agent's config and runs attacker code on restart. Six major AI coding agents fell to the same chain.
-
Multi-cloud didn't save Railway. One provider's automated suspension still took everything down.Railway runs on three clouds. A single provider's automated account suspension still took the whole platform down for 8 hours. Why multi-cloud was never the fix, and what actually survives a frozen control plane.
-
Your AI issue-triage bot is a code-execution endpoint for anyone with a GitHub accountCline's AI triage bot had Bash and read issue titles from anyone. Adnan Khan turned that into a path to the npm release keys. The mechanism, and the least-privilege rules that stop it.
-
Cloudflare bought VoidZero — what it means if you build on Vite or WorkersOne vendor now steers the build toolchain under most of the frontend. What it means for shipping on Vite or Workers.
-
Can LLMs hack your app? What a $1,500 experiment actually showsA researcher paid 13 AI models to break into his own app. The winner wasn't the smartest model — it was the one that read the secrets he shipped in plain sight.
-
Anthropic open-sourced its vulnerability-hunting harness — the interesting part is the verifier, not the finderAnthropic released a reference harness for autonomous vulnerability discovery with Claude: threat-model, scan, verify, triage, patch. The real lesson is that the verification architecture, not the model, is what makes it usable.
-
A VS Code extension can steal your GitHub token in one clickA malicious VS Code extension can lift a GitHub OAuth token scoped to ALL your repos via the webview message channel. The deeper story is the disclosure-trust breakdown that got it dropped with one hour of notice.
-
When the Platform Goes Down, Your Jobs Fail Silently: Lessons from the June 2026 Copilot OutageThe June 2026 Copilot outage lasted ~6 hours. The real lesson for builders: when an upstream platform dies, your scheduled jobs fail silently — external heartbeat monitoring is the only thing that tells you.
-
The npm Supply-Chain Worm Is Self-Propagating Now: What Mini Shai-Hulud Means If You Run a Coding AgentA self-propagating npm worm that steals one CI token, republishes itself across every package a maintainer owns, harvests Claude Code credentials, and survives reboot. The mechanics and the hardening.
-
How to verify webhook signatures (and the mistakes that quietly break it)A webhook is an unauthenticated POST from the open internet. HMAC signatures are how you trust one. The Stripe and GitHub schemes, and the four mistakes that quietly verify nothing.
-
Your AI assistant will tell you to install a package that does not existSlopsquatting: attackers register the npm and PyPI package names AI coding agents hallucinate. The hallucination is repeatable, and the agent installs it for you without a human pausing to ask if it is real.
-
An npm package stole OpenAI Codex tokens for a month, and the token never expirescodexui-android exfiltrated ~/.codex/auth.json for a month. The real lesson is about long-lived bearer credentials your AI tools leave on disk.
-
Your AI coding agent's "trust this folder" prompt is a security boundary that liesThe approval prompt describes an intention, not a limit. How TrustFall and SymJack break every major AI coding agent, and the boundary to put underneath yours.
-
Strava just pulled a Reddit on its developers. The lesson is about who owns your stack.Strava's June 2026 API lockdown killed a swath of open-source and self-hosted apps overnight. The real lesson is not about Strava. It is about building on a platform you do not control, and how to tell renting from owning.
-
Hackers took over Instagram accounts by just asking Meta's AI. The lesson is about authorization, not AI.Attackers asked Meta's AI support bot to change account emails and it did, bypassing 2FA. The real lesson is about authorization, not AI — and it applies to anyone giving an agent real tools.
-
GitHub Copilot switched to token-based billing. Here is how to stay in control of the cost.Copilot now meters token consumption via AI Credits. Why agents get hit hardest, and how to stay in control of the bill.
-
Reasonix and the real cost lever for coding agents: prefix-cache stabilityReasonix claims a 99.82% cache hit rate and a 5x cost cut by never breaking the prompt prefix. Here is what prefix-cache stability means for any coding agent, and where it breaks.
-
Your process memory is a file: what /proc/[pid]/mem lets you doA process's full address space is a file you can open, seek, and read. The ptrace access check that gates it, and the sharp edges (FOLL_FORCE, dead-target zero reads, no mmap).
-
MiniMax M3: an open-weight coding model that undercuts the frontierOpen weights, 1M-token context, frontier-adjacent coding benchmarks at a tenth of the price. What is real and what to watch.
-
Five frontier LLMs disagree on 67% of real-world fact-checks: what it means for building on AIA study handed 1,000 real user claims to five frontier models. They disagreed on 67%. Here is what that means for trusting AI on the claims that matter.
-
Codex on AWS Bedrock: what it changes for AI coding workflows (and what it doesn't)Codex now runs inside your AWS account on Bedrock. What that changes for compliance and billing, what it doesn't change about the agent, and how to decide.
-
Cloudflare Turnstile and the WebGL fingerprint: the privacy-friendly CAPTCHA that needs your GPUTurnstile is sold as the privacy-friendly alternative to reCAPTCHA, but it leans on WebGL fingerprinting and quietly blocks hardened browsers. What's actually happening, and how I think about it as someone who ships on Cloudflare.
-
Free Website Security Scanners in 2026 (Mozilla Observatory vs securityheaders.com vs SSL Labs vs ImmuniWeb vs SiteGuard)Mozilla Observatory vs securityheaders.com vs SSL Labs vs ImmuniWeb vs SiteGuard — what each free scanner checks, and which to run first.
-
A crafted packet, SYSTEM on your domain controller, and why the CVE-2026-41089 headlines were wrongA real 9.8 Netlogon RCE, headlines that wrongly said it was exploited in the wild, and how to actually triage a critical CVE.
-
When your open-source side project becomes phishing infrastructureA maintainer's open-source tool was used to send 14,520 phishing emails in three hours. The lesson for anyone who hosts open source for other people.
-
EY Canada published a cybersecurity report and 16 of its 27 citations were fakeA Big Four firm shipped a security report with 16 of 27 citations fabricated. The cheap verification step everyone skips.
-
What the ChatGPT for Sheets data-exfiltration bug teaches about AI securityA single hidden prompt in an imported sheet drained 12 workbooks from a victim's account, even with auto-edits off. The mechanism, why OpenAI's fix is right but incomplete, and the boring controls that actually save you.
-
What Stanford's CS336 CLAUDE.md teaches about steering AI coding agentsStanford's CS336 shipped a CLAUDE.md that went viral on HN. The real lesson isn't academic integrity, it's how to use CLAUDE.md as a behavioral contract: role, forbid lists, and permissions.
-
Claude Code's Hidden Config: What the Docs Don't Tell YouThe best Claude Code config wins are in the documented-but-overlooked layer: settings merging, hook types, the env key. An honest read on what to use and what to ignore.
-
Claude Opus 4.8: What Actually Changed for Claude CodeThe benchmark that moved is not the headline one. An honest read for daily Claude Code users.
-
Three places your Claude Code bill leaks (and how to plug them)A short, practical field guide to the three patterns that quietly inflate a team's Claude Code spend (uncached prompt prefixes, over-powered model routing, and silent retry storms), plus how to find and fix each one.
-
Cron Monitoring in 2026: Dead Man's Switch Patterns for Scheduled JobsThe worst outage isn't a crash — it's a backup job that quietly stopped firing for 11 days. How dead-man's-switch monitoring catches silence, and which tool fits which job.
-
Anthropic Is Now the Most Valuable AI Startup. Here's the Developer's Read.Anthropic hit a ~$965B valuation, passing OpenAI, on a $47B run-rate driven by coding. The honest developer's read: it's a durability signal and a platform-dependence story at once.
-
LLM Smells: The Tells in AI Writing, and the Costlier Ones in AI CodeAI-assisted work leaves a residue you can smell. The writing and design tells are annoying; the same residue in code is a bill — Veracode found 45% of AI code ships a security flaw. What I do about both.
-
The Red Hat npm Supply-Chain Attack: What Actually Happened, and What to Do About It32 compromised package releases, a credential sweep, and forged provenance attestations. What happened with @redhat-cloud-services on npm — and the remediation that actually matters.
-
Is MCP Dead? When the Model Context Protocol Earns Its Complexity'MCP is dead' is rhetorical. The token bill is real, Anthropic's code-execution fix cuts a job 150K→2K tokens, and MCP still wins for server-side guardrails.
-
Webhook Debugging Tools in 2026: webhook.site vs RequestBin vs ngrok vs RequestTracewebhook.site vs RequestBin vs ngrok vs RequestTrace — four tools, four lifecycles. The decision tree for debugging webhooks.
-
Learn SQL Once, Use It for 30 Years: Why the Skill Doesn't ExpireSQL rests on Codd's 1970 relational model, is declarative so it gets faster without rewrites, and was standardized in 1986 — why it's a rare non-depreciating skill, plus the dialect caveats.
-
Durable Workflows on Postgres: What "You Don't Need Temporal" Actually Buys YouPostgres-backed durable execution vs a dedicated orchestrator like Temporal — what exactly-once on the database actually buys you, and the coupling it hides.
-
Migrating from Go to Rust: The Tradeoffs Worth Knowing FirstHalf the HN thread wants to rewrite everything; the other half calls it a waste. The grounded version: what gets better, what gets worse, and the one service worth migrating.
-
Claude Code as a Daily Driver: CLAUDE.md, Skills, Subagents, Plugins, and MCPCLAUDE.md, Skills, Subagents, Plugins, MCP: which Claude Code features actually earn their place. An honest layering guide from running an autonomous system on it daily.
-
PostHog vs Plausible vs Fathom — which analytics tool to run for your SaaS in 2026I run PostHog on a SaaS funnel and evaluated Plausible + Fathom for marketing sites. They answer different questions — here's the decision tree.
-
Defender zero-days CVE-2026-41091 and 45498 — what defenders should do todayTwo actively-exploited Microsoft Defender zero-days hit KEV May 2026. CVE-2026-41091 EoP and CVE-2026-45498 DoS. What defenders should do today.
-
the ai cybersecurity hype is real, and so is the gap between the deck and the deploymentAI cybersecurity vendor hype hit critical mass at RSAC 2026. Practitioner take on what's real vs marketing.
-
Microsoft pulled internal Claude Code licenses — what their engineers' preference tells you about picking AI toolsNot a customer-facing 365 Copilot change. Microsoft's engineers got Claude Code in Dec 2025, preferred it over Microsoft's own Copilot CLI, and Microsoft pulled the licenses anyway. The insider-preference signal is what matters.
-
Cloudflare vs Vercel for a SaaS in 2026 — which one I actually pickedAfter running production workloads on both, the cost + DX difference is bigger than the marketing pages suggest. Here's the decision matrix I'd actually use.
-
Resend vs Postmark vs SendGrid — three production accounts laterAll three deliver email. The differences matter at scale and during incidents. What I'd pick for a new project starting today.
-
Cursor vs Claude Code vs Aider — which AI coding tool actually saves timeI pay for all three. They're not substitutes. Here's the decision tree for when to reach for which.
-
Astro vs Next.js vs SvelteKit for content sites in 2026If your site is mostly content (blog, marketing, docs), which framework is actually worth the build overhead? I've shipped all three in production.
-
Supabase vs Neon vs PlanetScale for SaaS Postgres in 2026Three managed Postgres providers. Different positioning. Different pricing traps. What I run in production and what I'd pick for a new project.
-
Stripe vs Lemon Squeezy vs Paddle for indie SaaS billing in 2026Stripe is the obvious pick — until you realize what Merchant of Record providers actually do for you. The tax question most comparisons skip.