KMKrishnam Murarkainedilec-engineering.hashnode.dev·4h ago · 4 min readDeprovisioning Is Not a Message You Send, It Is a State You VerifyAn offboarding runs, the identity provider reports success, the connector logs a 2xx for every application in scope, and the ticket closes. What that sequence establishes is that each provider accepte00
Aaivr-bloginaivr.hashnode.dev·5h ago · 12 min readFinding 0days with AI: Part IIIn the first blog post, we covered the process from start to finish, focusing mostly on writing good prompts, tooling and techniques. It's recommended you read it first before continuing with this one00
MAMichael Amelininmichael4kind.hashnode.dev·13h ago · 8 min readHow a Mac App Locker Actually Works (and Why the Obvious Approach Fails)macOS still has no public API for "lock this one app behind biometrics." You can lock the whole machine. You can put a whole user account behind Touch ID. You cannot say "let everything else run, but 00
CPChris Portschellerinwebdecoy.hashnode.dev·16h ago · 11 min readInside a WordPress Bot Detection EngineThe WebDecoy WordPress plugin ships with zero configuration required. But underneath the "install, activate, done" experience is a multi-layer detection engine that scores every request across server-00
CPChris Portschellerinwebdecoy.hashnode.dev·20h ago · 13 min readNext.js Bot Detection: Block AI Crawlers at the EdgeYour Vercel usage graph is climbing and your logs are full of names you did not invite: GPTBot, ClaudeBot, PerplexityBot, Bytespider. They hammer your App Router pages and quietly run up your bandwidt00
YHYves Habchyinyveshabchy.hashnode.dev·17h ago · 2 min readRenovating a vibe-coded app: readable code, no reasoning behind itA client had been building an education platform in Lovable for months. Too many issues piled up, so they brought in devs. I got assigned to it. The job was to turn a vibecoded app into something prod11M
UUUduak Ukponginuduakukpong.hashnode.dev·18h ago · 11 min readBuild a Postgres Audit Log Your Application Code Cannot BypassMost audit logs get written by application code. A service function calls the database, then calls a logging function right after, two separate steps, two separate places to remember. Forget the secon00
CPChris Portschellerinwebdecoy.hashnode.dev·20h ago · 13 min readBot Detection False Positives: How to Actually Test AccuracyThe fastest way to lose confidence in bot protection is not to miss a bot. It is to block a real customer. A missed scraper costs bandwidth or content. A blocked customer costs a sale, a support escal00
CPChris Portschellerinwebdecoy.hashnode.dev·20h ago · 12 min readAI Agent Authentication in 2026: Web Bot Auth, ARD & OAuthAI agent authentication is not one protocol. It is a stack. An agent may need to discover a tool, prove which workload is running, authenticate an HTTP request, show that a user delegated authority, a00
CPChris Portschellerinwebdecoy.hashnode.dev·20h ago · 11 min readBrowser Fingerprinting in 2026: What Still Works, What Doesn'tBrowser fingerprinting still works in 2026, but the useful techniques have shifted underneath everyone. Chrome's Privacy Sandbox has frozen or removed half the signals fingerprinting libraries depende00
