For developers
Testing email properly, in CI and out of it. 7 articles.
Testing signup emails in CI without a real mailbox
Sleep-and-hope is why your email tests are flaky. Here is the shape that is not.
5 min read →Webhook signatures, done properly
A shared secret in a header is not a signature. Here is what to send, what to check, and the two mistakes almost everyone makes on the receiving end.
5 min read →Rate limiting on the wrong axis is worse than none
Per-IP limits punish shared offices and mobile networks while doing nothing to an attacker who rotates addresses for pennies.
5 min read →Designing a signup form that does not leak who is registered
"That email is already taken" is a feature request and a privacy hole, and you usually have to pick.
5 min read →The test address in your CI belongs to somebody
test@example.com is reserved. test@gmail.com is a real person, and your pipeline has been mailing them for months.
4 min read →When two safety checks hide each other
A debugging story: two independent gates, each refusing for its own reason, and a day spent proving the wrong one was responsible.
5 min read →The feature works. Nobody can tell.
Three times in one product we built a correct mechanism and forgot to tell anyone it had fired.
4 min read →