.tip

Aug 27, 2026 · one of the small things

Prompts live in the repository with a version and a changelog line

A prompt edited in a dashboard has no history, no review and no way to know which version produced last Tuesday's bad outputs.

prompts/classify-ticket/v7.md
prompts/classify-ticket/CHANGELOG.md   # v7: added the refund-vs-chargeback example, +1.5 on eval

Log the prompt version on every call's trace. When the output is wrong, the version tells you what the model was told.

ai-engineeringengineering-practice

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close