Blog

Writing

Long-form from our team. Engineering, product, and company posts.

  • Product

    Your Webhooks Shouldn't Trust the URL They Were Given

    A webhook is the one feature where a customer types an address and your servers go and call it. What we built for Kookee's webhooks and its Slack, GitHub and Jira integrations, and eight things a webhook sender has to get right.

  • oauth

    Your MCP Server Shouldn't Make People Paste a Token

    Our MCP server worked well with personal tokens, as long as you lived in a terminal. Claude's chat apps and ChatGPT connect by signing in instead. What we shipped so they can, and the seven decisions that took longer than the code.

  • headless-cms

    Your CMS's React Components Shouldn't Fetch Their Own Data

    Most headless CMS component kits wrap your app in a provider and fetch inside components. With Server Components that hides content from the first HTML, ships JavaScript for static lists and sends articles twice. The six rules we built ours by.

  • Engineering

    React 19 Rewrites Your dangerouslySetInnerHTML on Every Render

    An inline { __html } object makes React 19 replace an element's whole HTML every time its parent re-renders. We found it through a table of contents stuck on the last heading. Why it happens, what it breaks, and the one-line fix.

  • pagination

    Your Blog Pagination Is Probably Hiding Posts From Google

    Load more buttons, pagination kept in state, every page canonical to page one, noindex on page two: four common ways blog pagination keeps older posts from search engines, what to do instead, and a checklist.

  • security

    Your Invite Link Is a Password You Pasted in Slack

    Send someone an invite link and you have handed out a credential that works for anyone who ever sees it. Here is what that link has to carry before it is safe to paste into a channel, and the decisions behind ours.

  • ai-agents

    Your MCP Server Shouldn't Run on a Shared API Key

    When an AI assistant changes your content through an MCP server, the first question is who did it. A shared project key cannot answer that, and it cannot be taken back from one person. Here is what we replaced it with, and the six details that mattered.

  • Engineering

    Why Your Chat Widget Ignores Your Dark Mode Toggle

    Your site has a dark mode toggle. The support widget in the corner does not care. Here is why embedded widgets get theming wrong — the OS media query, the shadow root, the remount — and what a widget needs to offer so yours does not.

  • Engineering

    Your AI assistant does not need a copy of your database

    Every AI support vendor asks you to upload your data. The alternative: give the assistant a function, let it run in the visitor's browser, and keep your data where it already is.

  • Engineering

    Feature flags without a deploy

    A banner, a discount rule, a kill switch. None of it deserves a release cycle. What the Config module is good at — and where it stops.

  • Engineering

    Ship a blog in one prompt

    We used to publish the whole SDK reference as one text file for assistants to fetch. Two better sources of truth replaced it: the types on disk, and a live connection to your actual content.