Blog

Writing

Long-form from our team. Engineering, product, and company posts.

  • Product

    Your Webhooks Shouldn't Trust the URL They Were Given

    A webhook is the one feature where a customer types an address and your servers go and call it. What we built for Kookee's webhooks and its Slack, GitHub and Jira integrations, and eight things a webhook sender has to get right.

  • oauth

    Your MCP Server Shouldn't Make People Paste a Token

    Our MCP server worked well with personal tokens, as long as you lived in a terminal. Claude's chat apps and ChatGPT connect by signing in instead. What we shipped so they can, and the seven decisions that took longer than the code.

  • headless-cms

    Your CMS's React Components Shouldn't Fetch Their Own Data

    Most headless CMS component kits wrap your app in a provider and fetch inside components. With Server Components that hides content from the first HTML, ships JavaScript for static lists and sends articles twice. The six rules we built ours by.

  • Engineering

    React 19 Rewrites Your dangerouslySetInnerHTML on Every Render

    An inline { __html } object makes React 19 replace an element's whole HTML every time its parent re-renders. We found it through a table of contents stuck on the last heading. Why it happens, what it breaks, and the one-line fix.

  • pagination

    Your Blog Pagination Is Probably Hiding Posts From Google

    Load more buttons, pagination kept in state, every page canonical to page one, noindex on page two: four common ways blog pagination keeps older posts from search engines, what to do instead, and a checklist.

  • security

    Your Invite Link Is a Password You Pasted in Slack

    Send someone an invite link and you have handed out a credential that works for anyone who ever sees it. Here is what that link has to carry before it is safe to paste into a channel, and the decisions behind ours.

  • ai-agents

    Your MCP Server Shouldn't Run on a Shared API Key

    When an AI assistant changes your content through an MCP server, the first question is who did it. A shared project key cannot answer that, and it cannot be taken back from one person. Here is what we replaced it with, and the six details that mattered.

  • Engineering

    Why Your Chat Widget Ignores Your Dark Mode Toggle

    Your site has a dark mode toggle. The support widget in the corner does not care. Here is why embedded widgets get theming wrong — the OS media query, the shadow root, the remount — and what a widget needs to offer so yours does not.