Notes on privacy-first software.
Essays on local-first architecture, consent, and building tools that keep your data yours.
One-click unsubscribe posts to a URL the sender chose
The redirect hole closed in one commit. The guard that still looked complete lost a DNS race three hours later; the fix that holds pins the IP it validated.
July 1, 2026 EngineeringSequence, don't sprawl
The send gate held before the AI seam existed, the rules engine stayed a pure function through three review gates, and the suite climbed from 78 tests to 350.
July 1, 2026 EngineeringLinting our marketing: 26 phrases fail the build
An adversarial audit logged 143 findings across 13 pages, so npm run build grew a second stage: a linter with 26 banned substrings that prints SLOP and exits 1 if a banned phrase comes back.
July 1, 2026 PrivacyGlass-box AI: consent before action
The consent sheet shows the exact payload, you approve one action at a time, and the audit log keeps the receipts.
June 25, 2026 EngineeringWhy we build local-first
Sync without a server-side source of truth, search that never phones home, and why we accept the extra work.
June 20, 2026In the meantime, explore the suite.
Sign in to manage all three.