TWIL August 28th 2026

• I'm sure it feels great to see all the 'vulnerabilities' an LLM found in your codebase, but it does not feel equally great to be the dev who then has to spend hours verifying that they may be 'vulnerabilities' but the worst attack possible is... force logging out a user
  • Also they're there because of intentional design decisions to enable some feature
  • I think if you're gonna LLM-generate a bunch of stuff you need to at least put in some effort to verify it's not all nonsense before dumping hours of work on other people
• 6/7 LLM generated vulnerabilities were "Won't Fix", and the one I addressed was me throwing them a bone to be diplomatic
  • Also multiple tickets didn't even mention which application the vulnerability was for, very high effort
• Passing a regex to CircleCI's matches does not need leading/trailing slashes; it'll consider them part of the regex
• You can replace a form submission -> redirect with a fetch call into redirect, but if it's cross origin you're in for a bad time
  • especially if it can be to one of any (large) number of origins which you don't want to enumerate in your CSP
• It somehow went unnoticed that a non-primary/secondary theme which has an empty base color crashes our user service's frontend for... years
  • I mean I guess it's pretty uncommon to need a theme other than those two, but still crazy it never happened until now

Links

• CSS Class Prefix Selector - Bramus

This will be pretty handy when it finally becomes available & supported enough to use in a decade or so. Is adding another class really that much of a hassle though? Especially with CSS nesting available.