Tulipes (tulipesjs): the TypeScript framework for Express 5 that refuses to boot a broken API
tulipesjs is a TypeScript framework for Express 5 on Node.js that validates env vars, modules, permissions and routes at boot, before the first request.
k13 · a technical notebook by Kemo
Notes on software, infrastructure, security and AI.
Practical write-ups for working engineers: what changed, what breaks, and what to check before you ship. About one a week.
Latest
All articlesPostgreSQL 19 release date moves to 19 November: what was cut, what shipped, and how to test the RC
PostgreSQL 19 is now due on 19 November. What was reverted, what shipped, the defaults that change, and how to test your cluster against RC 1.
DeepSeek Super-agent (dsh-superagent): how the Router–Worker coding agent works, and how to run it safely
How DeepSeek's open-source Super-agent routes GitHub requests to parallel coding workers, how to install it, and why it needs its own Unix account.
ChatGPT share-link account takeover: the postMessage bug, and how to secure your own listeners
How a ChatGPT share link ran code as chatgpt.com through MathLive's postMessage listener, and the listener, iframe and CSP fixes for your own app.
Browse by topic
6 topics,118 tags. Every article sits in one topic.
- 10 articlesNode.jsRuntime behaviour, queues, streams and the parts of the platform that bite in production.
- 13 articlesAI agentsBuilding agents that call tools, fail well and stay inside a budget.
- 18 articlesSystem architectureData models, migrations and the decisions that are expensive to reverse.
- 9 articlesDeveloper toolingContainers, CI and the small tools that make a team faster.
- 2 articlesMongoDBData modelling, queries and failure modes in MongoDB.
- 1 articleDockerContainer images, builds, and running services in production.
More articles
Northflank breach: what to rotate first, and how to check whether your AI keys were abused
Northflank says assume every environment variable was decrypted. What to rotate first, how to spot abused AI keys in CloudTrail, and how to scope the next one.
Binance $6.3B hack explained: how EIP-7702 delegation emptied a hot wallet, and how to guard your signer
How 50 pre-signed EIP-7702 authorizations emptied a Binance hot wallet, what Binance has said, and the signer checks that would have refused them.
OpenCode 2.0 upgrade: what breaks in plugins, permissions and config, and how the new shared service works
What OpenCode 2.0 changes underneath, what breaks on upgrade, and how to rewrite permissions so the agent gets no new powers.
Claude Code extension 2.1.313 backdoor: how the SSH trojan works, and how to check and clean your machine
Claude Code extension 2.1.313 planted an SSH key and a reverse tunnel on developer machines. How it works, who was exposed, and how to check and clean up.
KV cache leak on Cloudflare Workers AI: how an SGLang bug served other users' data, and how to check your stack
How a KV pool smaller than GLM-5.3's context and an SGLang bug leaked users' data on Workers AI, and how to harden PD serving.
Type Server Protocol (TSP): how Pylance can now use Pyrefly instead of Pyright, with a working client
What Microsoft's Type Server Protocol is, a working TSP client, and how to make Pylance use Pyrefly instead of Pyright in VS Code.
Showing 10 of 53 articles
Browse all articlesGet new articles in your reader
About one a week. Paste the feed into any RSS reader: Feedly, NetNewsWire, Inoreader or your own.