What least privilege actually means for an autonomous AI coding agent that runs shell commands: sandbox primitives (bubblewrap/Seatbelt/gVisor/Firecracker), capability dropping, ephemeral scoped credentials, and named 20...
Which GoF behavioral patterns are now language-feature workarounds (Norvig's 16/23 analysis), named per-pattern verdicts for Strategy, Command, Visitor, State, Observer, Mediator, Chain of Responsibility, Template Method...
Pipeline security misconfigurations documented in real 2025-2026 breach postmortems - tj-actions/changed-files, Pwn Request pull_request_target attacks, GitHub Actions cache poisoning, npm worm supply-chain incidents - p...
Named case studies and concrete thresholds for applying (or not applying) Robert C. Martin's Clean Architecture - where the Dependency Rule pays off, where it's cargo-culted, and what practitioners who ship it at scale a...
Documented, named critiques of Robert C. Martin's Clean Code lineage - the Muratori/Martin performance debate, the Ousterhout/Martin design debate on function length, comments, and TDD - with decision rules for when each...
Language-agnostic reference for building DOM-like component trees in TUIs: event bubbling from leaf to root, z-index compositing with dirty tracking, active/focus routing, hit-testing with clipping, animation delegation,...
Modern, cross-language treatment of the classic creational Gang of Four patterns, including idiomatic replacements in Python, TypeScript, Go, and Rust, and an honest assessment of why Singleton is discouraged in testable...
Rules shared by every DevPlace endpoint: base URL, form vs JSON request bodies, HTML/JSON content negotiation, the action response envelope, cursor pagination, rate limits and the status-code and error-shape contract.
The four interchangeable ways to authenticate any DevPlace request - session cookie, X-API-KEY header, Bearer token and HTTP Basic - plus the signup, login, logout and password-reset endpoints that issue and clear the se...
The OpenAI-compatible proxy at /openai/v1: chat completions and streaming, the generic molodetz model names, embeddings, vision augmentation that rewrites images to text, forced-model behaviour, and per-call usage and co...