Blog

Deep-dive guides on AI agents, agent orchestration, MCP, and developer tooling.

4 posts found

Security

JWK Rotation in Production: What Actually Breaks When You Rotate a Signing Key

Rotating a JWT signing key is a distributed cache-invalidation problem wearing a cryptography costume — here is the four-stage timeline, the kid collision that breaks it silently, and why your overlap window is set by your slowest verifier cache, not your token TTL.

August 4, 2026 · 7 min read
Security

Why Your Email Regex Is a Denial-of-Service Waiting to Happen

Catastrophic backtracking turned a routine validation regex into Cloudflare's 2019 global outage. Here is the exact pattern shape that causes it, why email regexes are especially prone to it, and which engines make the bug impossible.

July 30, 2026 · 6 min read
Security

JWT vs Session Cookies: The Trade Isn't Statelessness, It's Revocation

"JWTs are stateless, so they scale better" is the sentence that leads teams straight into the logout-doesn't-work bug. Here's the real trade-off, the revocation problem it creates, and when each auth model is actually the right call.

July 22, 2026 · 7 min read
Security

bcrypt vs scrypt vs Argon2: How Password Hashing Actually Differs

MD5 and SHA-256 are fast, and fast is exactly the wrong property for password storage. Here is how bcrypt, scrypt, and Argon2 slow attackers down differently — and how to actually pick between them.

July 10, 2026 · 8 min read