Book Intro CallBlog
What I've learned building MVPs, fixing slow Next.js apps, and shipping AI features that don't fall apart in production. Written for founders who want the honest version, not the polished agency version.
The Shai-Hulud npm worm is back — using preinstall hooks and the Bun runtime to bypass Node.js security tooling. What SaaS teams need to change this weekend.
Three coordinated npm attacks hit in 48 hours — pgserve, Bitwarden CLI, and Axios. A practical breakdown of what to audit and fix in your SaaS right now.
The April 2026 Vercel incident shows production readiness includes OAuth hygiene, token management, and third-party risk — not just clean deployments.