My Blog

The Hidden Risk in Your CI Pipeline: Why `pull_request_target` Is a Security Liability

pull_request_target gives CI workflows full secret access. One open PR is enough to steal credentials or poison your build cache. Here is how to fix it.

Posted on 5/12/26, 11:00 AM

Why I'm Glad I Upgraded to pnpm 11 Before the TanStack Attack

I use pnpm for disk space and monorepo support. Turns out upgrading to v11 also made me immune to the May 2026 TanStack supply chain attack - here is what its defaults actually do and why they matter.

Posted on 5/12/26, 8:00 AM

Modern Design Systems for Solopreneurs: Tailwind v4 & DaisyUI v5

Boost your development velocity with a CSS-native design system. Learn how Tailwind v4 and daisyUI v5 replace complex JS configurations with a streamlined, semantic workflow that scales perfectly for solo builders and independent developers.

Posted on 4/29/26, 12:00 AM

Building a Reliable CDN for our Library with Cloudflare R2 and Workers

Posted on 3/3/26, 12:00 AM

Korea Travel Guide — Seoul & Busan

My experiences and recommendations for travelling to Korea

Posted on 2/1/26, 12:00 AM