Notes from building in public
Two posts a week on product craft, building with AI, and the stack that runs this site. Honest about what worked and what didn't.
I Audited My Own Pipeline for Prompt Injection Gaps
I wrote about prompt injection, then audited my own AI content pipeline and found two real gaps. Here's exactly what I found, and what I changed to fix them.
Writing a Spec Your AI Agent Can Actually Keep Following
Most specs tell an AI agent what to do once, then get quietly ignored next session. Here's how to write one that verifies itself, from a real drift incident.
How I Built a Claude Agent Content Pipeline (and What Broke)
I built an AI content pipeline with Claude agents defined in a single markdown file, no framework. Here's how it works and the three things that broke first.
Prompt Injection Is Already Hiding in What AI Agents Read
Prompt injection hides in webpages, DNS records, emails, and PDFs that AI agents read. Here's what happened to me, and the defenses that actually help.
Why I SHA-Pin Every GitHub Action (and Automate Updates)
I lock every GitHub Action to its commit SHA instead of a mutable tag, then let Dependabot keep the pins current. Here's why a tag alone isn't enough.
How Context Limits Changed the Way I Build with AI
I was getting inconsistent answers and the AI kept forgetting what we'd built. Here's how I stopped fighting context limits and started designing around them.