Flask

A third of my request was the garbage collector

A slow grid in a Flask app I maintain had an obvious suspect. The biggest cost was Python re-checking 134,000 objects that would never be freed.

Friday, October 9, 2026 | 7 min read Read

Enforcing a Content-Security-Policy without nonces

My app's pages each carried thousands of lines of inline JavaScript, which is exactly what a strict Content-Security-Policy forbids. Getting to an enforcing policy took one line of JSON per page and no nonce machinery at all.

Thursday, September 10, 2026 | 3 min read Read

The badge that said 21 for a count of 1

I added a small shield badge showing how many months someone had won a challenge. On my own profile, with one win, it said 21. The sample render I had checked it against said 1.

Monday, September 7, 2026 | 2 min read Read

The stale Excel export was Cloudflare, not Excel

I re-downloaded a spreadsheet export and got the version from before my last edit. Another machine got the current one. Nothing in my app was wrong, and nothing in Excel either.

Thursday, September 3, 2026 | 3 min read Read

Case study: the Paul Newman Cup

A full walk-through of a small production Flask app: the operational problem, the architecture, the identity-versus-permission model, the database and deployment decisions, the failure scenarios, and what shipping it taught me.

Friday, July 24, 2026 | 11 min read Read

The SQLite trap caught me the same day I wrote about it

I published a post warning that SQLite on an ephemeral filesystem silently loses your database. Hours later, my own app turned out to have been doing exactly that on every deploy.

Thursday, July 23, 2026 | 4 min read Read

Running SQLite in production (yes, really)

I deployed a Flask app to Railway with SQLite as the only database. Here is why that was the right call, and the five things that actually bite when you do it.

Wednesday, July 22, 2026 | 5 min read Read