COSESAI

The Bundle Your AES Key Should Have Shipped In: Why AES-256-GCM Is Not a Magic Word

By xiezixing 2026年6月18日

AES-256-GCM is the easy part. The bundle format around it — IV, auth tag, key derivation, version field — is where 90% of real-world encryption failures live. Here is what a good bundle looks like and why the JSON wrapper is the actual feature.

未分类

The Regex That Sat Quietly in Production for Six Years: A ReDoS Story Nobody Caught in Code Review

By xiezixing 2026年6月17日

The Regex That Sat Quietly in Production for Six Years: A ReDoS Story Nobody Caught…

未分类

The Payload Your Sanitizer Let Through: Why Boring XSS Still Ships

By xiezixing 2026年6月17日

The email arrives at 6:14 a.m. A researcher has a stored XSS in your support…

未分类

The Markdown Table Your Diff Will Not Hate

By xiezixing 2026年6月17日

Every documentation writer has the same scar tissue: a 6-column Markdown table that needed to…

未分类

The PDF the Accessibility Audit Actually Delivers: Why Severity-Grouped Reports Beat Tool Lists Every Time

By xiezixing 2026年6月17日

The PDF the Accessibility Audit Actually Delivers: Why Severity-Grouped Reports Beat Tool Lists Every Time…

未分类

The Webhook That Never Arrived: A Capture-First Pattern for Debugging Asynchronous Calls

By xiezixing 2026年6月17日

It was 11:47 PM on a Tuesday when a customer support email landed in the…

未分类

The OpenAPI Diff Your CI Does Not Run: Why Two Specs Can Look Compatible and Still Break Every Client

By xiezixing 2026年6月16日

The breaking change you ship to production is almost never the one a human reviews.…

未分类

Your Page Has an h1 Problem, and the Browser Will Not Tell You

By xiezixing 2026年6月16日

If you ship a page to the web today, there is a roughly 70 percent…

未分类

The Three Environment Files That Hide the Outage You’re About to Ship

By xiezixing 2026年6月16日

The Three Environment Files That Hide the Outage You’re About to Ship Your staging .env…

The Bundle Your AES Key Should Have Shipped In: Why AES-256-GCM Is Not a Magic Word

The Regex That Sat Quietly in Production for Six Years: A ReDoS Story Nobody Caught in Code Review

The Payload Your Sanitizer Let Through: Why Boring XSS Still Ships

The Markdown Table Your Diff Will Not Hate

The PDF the Accessibility Audit Actually Delivers: Why Severity-Grouped Reports Beat Tool Lists Every Time

The Webhook That Never Arrived: A Capture-First Pattern for Debugging Asynchronous Calls

The OpenAPI Diff Your CI Does Not Run: Why Two Specs Can Look Compatible and Still Break Every Client

Your Page Has an h1 Problem, and the Browser Will Not Tell You

The Three Environment Files That Hide the Outage You’re About to Ship

WebAuthn Passkey Assertion Debugging: Signatures Pass, Binding Checks Fail

RDB SSTable LevelDB RocksDB Memcached Binary KV-Store Encoding Lineage Field Guide: When Six Formats Share One Byte Stream

Boolean Algebra Simplifier Field Guide: When Four Literals Collapse to One Gate and a Karnaugh Map Proves It

Z85 and RFC 1924 Base85 Field Guide: When Four Bytes, Five Characters, and Two Alphabets Decide Whether Your Payload Survives the Wire