Thoughts on code,
craft & exploration.

Firefox 148 shipped Trusted Types in February 2026, making it Baseline. Here's how to turn every dangerous innerHTML assignment in your app into a TypeError you can actually catch.

Your field data says INP is 400ms. Your local profile says everything is fine. The Long Animation Frames API closes that gap by naming the script, the function, and the character position that stalled the frame.

The document-plus-selfie onboarding flow every fintech copied is quietly failing. Here is how identity verification actually works, why injection attacks broke it, and what the layered replacement looks like.

Whole-note embeds are the easy part. Block references are where transclusion in Obsidian actually pays off, and where one misplaced caret silently breaks everything.

Disabling introspection is not security. Trusted documents let your server execute only the operations your own developers wrote, and you probably already have the tooling for it.

Twelve words on a piece of paper used to be the whole story of crypto self-custody. Passkeys, MPC, and smart accounts have quietly changed what that phrase actually protects.

Dataview code blocks give you tables. Inline queries give you a single live value in the middle of a sentence, which turns out to be the feature you reach for far more often.

The contrast-color() function went Baseline in April 2026 and kills the luminance-math helper every design system eventually writes. Here is how it works, the mid-tone problem nobody warns you about, and how to work around it.

The browser can now strip XSS from an HTML string during parsing. Here's how setHTML works, why its config can only narrow the allowlist, and how to ship it before Safari catches up.