.tips
page 5 of 10, 228 small things in all. back to the first.
.may
2026, 18 tips.
X-Content-Type-Options and Content-Disposition on user uploads
securityhttp
Turn on the React Compiler, then delete the memo hooks
reactperformance
Rate limit by the key or user, and by IP only as the fallback
securityhttp
Let a feature render nothing when it cannot work
reactreliability
Access tokens live minutes, refresh tokens live days and rotate
security
argon2id for passwords, and tune the cost on your hardware
security
Put use cache on the component, not the route
nextjscaching
Webhooks arrive twice, so store the event id
securitydistributed-systems
trap cleans up temp files even when the script dies
shell
Verify the webhook signature before you read the body
securityhttp
Stop parsing JSON with grep, use jq
shell
Compare tokens with timingSafeEqual
security
Commit .env.example, never .env
securitydeveloper-experience
xargs -P is the parallel loop you already have
shell
Scan for secrets before the commit exists
securitygit
Session cookies: HttpOnly, Secure, SameSite=Lax
securityhttp
Run shellcheck on every script in CI
shellci
Ship the Content-Security-Policy as Report-Only first
securityhttp
.april
2026, 7 tips.
Start every shell script with set -euo pipefail
shell
paths filters keep a docs change from running the full suite
ci
Never plain force push, use --force-with-lease
git
Write the report to GITHUB_STEP_SUMMARY, not the log
ci
fail-fast: false when the matrix entries are independent
ci
git log -S finds when a string appeared or vanished
git
Cache keys need the lockfile hash, and a restore-key without it
ci