Hero Image
Enforcing a Content-Security-Policy without nonces

My app's pages each carried thousands of lines of inline JavaScript, which is exactly what a strict Content-Security-Policy forbids. Getting to an enforcing policy took one line of JSON per page and no nonce machinery at all.

Thursday, September 10, 2026 | 3 min read Read
Hero Image
The stale Excel export was Cloudflare, not Excel

I re-downloaded a spreadsheet export and got the version from before my last edit. Another machine got the current one. Nothing in my app was wrong, and nothing in Excel either.

Thursday, September 3, 2026 | 3 min read Read
Hero Image
The SQLite trap caught me the same day I wrote about it

I published a post warning that SQLite on an ephemeral filesystem silently loses your database. Hours later, my own app turned out to have been doing exactly that on every deploy.

Thursday, July 23, 2026 | 4 min read Read
Hero Image
Running SQLite in production (yes, really)

I deployed a Flask app to Railway with SQLite as the only database. Here is why that was the right call, and the five things that actually bite when you do it.

Wednesday, July 22, 2026 | 5 min read Read