News

Multer's default file size limit is unlimited, and that's not a typo

Node's most popular file upload middleware has no size cap unless you set one. A single request can fill your disk or your memory before you notice.

A close-up of stacked jigsaw puzzle pieces in various colors

dependencies5 min read

The peer dependency warning you scrolled past is sometimes the whole bug

npm install prints peer dependency warnings and lets you proceed anyway. Most of the time that's fine. Sometimes it silently installs a version combination nobody has ever tested.

A red and black vintage alarm clock against a dark background

ops5 min read

Your backup cron job has been failing silently for three weeks

A scheduled job that fails without alerting anyone is worse than no job at all, because everyone assumes it's working. A dead man's switch catches what try/catch can't.

A clear hourglass with sand falling through it against a plain background

resilience5 min read

The outbound fetch call with no timeout that takes your API down with it

Node's fetch and most HTTP clients wait forever by default. One slow or dead dependency ties up your event loop and connection pool until nothing else can get through.

A security and privacy status dashboard on a screen

security5 min read

The header most AI-generated apps forget: Content-Security-Policy

Sanitizing input stops an attacker from injecting a script tag. It doesn't stop an inline script that got through some other way from running. A Content-Security-Policy header does, and most AI-scaffolded apps never set one.

A person's hand typing on a black computer keyboard

dependency-hygiene4 min read

What a postinstall script can run on your machine before you've reviewed a single line of the package

npm install doesn't just copy files. By default it executes any postinstall script a package defines, with your full user permissions, before you've opened a single file in that dependency.

configuration5 min read

Wildcard IAM policies: how AI-generated Terraform grants more than it meant to

Asking an AI assistant for an IAM policy so a Lambda can read from S3 often gets you Action: s3:* on Resource: *, a policy that works immediately and grants far more than the one bucket the function actually needs.

A rack of electronic server equipment in a dark room

resilience5 min read

Connection pool exhaustion: the resilience bug that only shows up under load

A database client that opens a fresh connection per request works fine in dev with one user clicking around. Under real traffic it silently exhausts the pool, and every request after that hangs until it times out.

data-exposure5 min read

Why a NEXT_PUBLIC_ prefix on the wrong variable ships your API key to every browser

Next.js inlines any environment variable prefixed NEXT_PUBLIC_ directly into the client JavaScript bundle at build time. Getting that prefix on a server-only secret doesn't cause an error, it just ships the secret to every visitor's browser.