Notes from the platform.
Engineering deep-dives, security research, and product updates.
How we keep our Supabase RLS policies honest
Row-level security policies are easy to write and easy to get subtly wrong. Here is the test harness we built to prove every policy does what the README claims — and catches the silent regressions before they ship.
Measuring developer time saved — the honest way
Every security tool claims to "save engineering hours". Most of that math is fiction. Here is the methodology we use internally, the numbers we trust, and the ones we have learned to throw away.
Why we pin every GitHub Action by SHA
Tag-based action references are a supply-chain footgun. We pin every third-party action to a full commit SHA and let Renovate keep them current. Here is the policy, the rationale, and the migration script we used to convert 140+ workflows.
What ‘vibe coding’ means for API platforms and the future of DevRel
The rise of natural language as code is redefining how developers interact with infrastructure. Explore why API platforms must evolve from manual documentation to agent-friendly interfaces to survive the shift toward vibe coding.