2026
Claude --dangerously-skip-permissions: What It Does and How to Set Up Permissions SafelySep 08 · 15 minWhat claude --dangerously-skip-permissions actually does, when it is safe to use, and the access ladder and settings.json I would use to keep coding agents useful without handing them your whole machine.Vercel BotID: How the Invisible CAPTCHA Works and Where It Earns Its PlaceMay 18 · 17 minVercel BotID went GA in mid-2025 and quietly replaced the visible CAPTCHA on a lot of indie SaaS sites in 2026. The promise is real: invisible bot detection that catches headless Playwright sessions without making your real users squint at fire hydrants. The price is real too. Here is what BotID actually does under the hood, the Basic versus Deep Analysis tradeoff, the route patterns I protect with it, and the day a single AI scraper convinced me to wire it in front of an endpoint I thought was already safe.Passkeys Implementation in Production: What I Wish I Knew Before Replacing PasswordsMay 08 · 16 minPasskeys look simple in the WebAuthn demo. They get strange the moment you handle a user with two laptops, a stolen phone, a Bitwarden subscription, and a corporate device that blocks iCloud Keychain. Here is what shipping passkeys to real users actually looks like in 2026.AI Agent Sandboxes: E2B vs Vercel Sandbox vs Modal vs Daytona (2026)May 01 · 14 minLetting an LLM write code is the easy part. Letting it run that code on a machine that touches your data is the part that should keep you up at night. Here is how the production sandboxes compare in 2026, and what actually matters when you pick one.Securing AI Agents in Production: What Nobody Tells You Before Something BreaksApr 28 · 12 minA Cursor AI agent deleted a production database in nine seconds. Not because the AI was malicious, but because nobody thought carefully about what it was allowed to touch. Here is a practical security framework for running AI agents in production without handing them the keys to everything.Prompt Injection Is the New SQL Injection: Defending AI Apps in 2026Apr 15 · 18 minPrompt injection is the single most underrated security risk in AI applications today. It is easy to pull off, hard to fully fix, and most developers shipping AI features have no defenses in place at all. Here is a practical guide to understanding the threat and actually doing something about it.