.tips

page 6 of 11, 261 small things in all. back to the first.

.may

2026, 25 tips.

202 Accepted and a status URL for anything that takes seconds
May 31
httpapi-design
Wrap the slow widget in Suspense, not the page
May 30
reactnextjs
Four Cache-Control values cover almost every case
May 29
httpcaching
ETag plus If-None-Match turns a repeat fetch into a 304
May 27
httpcaching
Read request data once, high up, and pass it down
May 27
nextjsreact
CI tokens get the permissions the job uses, and nothing else
May 25
securityci
The key goes on the element the map returns
May 24
react
Dependency alerts need one person and a weekly slot
May 23
securityengineering-practice
X-Content-Type-Options and Content-Disposition on user uploads
May 21
securityhttp
Turn on the React Compiler, then delete the memo hooks
May 21
reactperformance
Rate limit by the key or user, and by IP only as the fallback
May 19
securityhttp
Let a feature render nothing when it cannot work
May 18
reactreliability
Access tokens live minutes, refresh tokens live days and rotate
May 17
security
argon2id for passwords, and tune the cost on your hardware
May 15
security
Put use cache on the component, not the route
May 15
nextjscaching
Webhooks arrive twice, so store the event id
May 13
securitydistributed-systems
trap cleans up temp files even when the script dies
May 12
shell
Verify the webhook signature before you read the body
May 11
securityhttp
Stop parsing JSON with grep, use jq
May 9
shell
Compare tokens with timingSafeEqual
May 9
security
Commit .env.example, never .env
May 7
securitydeveloper-experience
xargs -P is the parallel loop you already have
May 6
shell
Scan for secrets before the commit exists
May 5
securitygit
Session cookies: HttpOnly, Secure, SameSite=Lax
May 3
securityhttp
Run shellcheck on every script in CI
May 3
shellci

.tips

.may

202 Accepted and a status URL for anything that takes seconds

Wrap the slow widget in Suspense, not the page

Four Cache-Control values cover almost every case

ETag plus If-None-Match turns a repeat fetch into a 304

Read request data once, high up, and pass it down

CI tokens get the permissions the job uses, and nothing else

The key goes on the element the map returns

Dependency alerts need one person and a weekly slot

X-Content-Type-Options and Content-Disposition on user uploads

Turn on the React Compiler, then delete the memo hooks

Rate limit by the key or user, and by IP only as the fallback

Let a feature render nothing when it cannot work

Access tokens live minutes, refresh tokens live days and rotate

argon2id for passwords, and tune the cost on your hardware

Put use cache on the component, not the route

Webhooks arrive twice, so store the event id

trap cleans up temp files even when the script dies

Verify the webhook signature before you read the body

Stop parsing JSON with grep, use jq

Compare tokens with timingSafeEqual

Commit .env.example, never .env

xargs -P is the parallel loop you already have

Scan for secrets before the commit exists

Session cookies: HttpOnly, Secure, SameSite=Lax

Run shellcheck on every script in CI