Long-form notes on debugging, dev tools, and privacy-respecting workflows. Each post links the tools that solve the problem.
The Fetch standard gives fetch() no timeout option, so a server that accepts your connection and goes quiet keeps the promise pending. Node only backstops it with undici transport timeouts that default to 300 seconds.
sort((a, b) => a > b) looks like a comparator but returns a boolean, so it never returns a negative number. In V8 the array comes back untouched — and an already-sorted test fixture hides it.
An async callback passed to forEach returns a promise that forEach throws away. The loop finishes instantly, the work is still running, and errors inside it become unhandled rejections instead of failures you can catch.
Node has been able to read HTTP_PROXY since v24, but only when NODE_USE_ENV_PROXY is set. Without it, fetch and http.request go straight to the host and the failure blames the host, not the missing proxy.
JavaScript reports UTC-6 as +360, not -360, because the method measures UTC minus local. Add it where you meant to subtract and you are off by twice the offset.
Array holes are not undefined. map, forEach, filter and reduce skip them silently, while spread, for...of and JSON.stringify materialise them as undefined — so the same array gives you two different answers depending on which method you reach for.
Node kills the process before pending stdout writes flush. Your CLI prints every line in a terminal and silently loses some in CI, because pipes are asynchronous on Linux and macOS and terminals are asynchronous on Windows.
setTimeout stores its delay in a signed 32-bit integer. Anything over 2147483647 ms overflows, and your "run this in 30 days" timer runs right now — or at some arbitrary wrong time.
Serialising a Map or a Set with JSON.stringify gives you an empty object — no error, no warning, exit code 0. Why it happens, what else silently disappears, and the two fixes that survive a round trip.
Intl.NumberFormat with currencyDisplay narrowSymbol renders USD, MXN, CAD and ARS all as "$1,439.00" in es-MX. The default symbol setting disambiguates them on purpose — here is why, and how to check any locale/currency pair yourself.
RegExp.prototype.test on a global or sticky regex advances lastIndex, so a shared regex silently skips half the strings you check. Why the state exists, and the four ways out.
String.replace() treats $&, $`, $' and $1 in the replacement as commands, not text. User data or a price string in that slot corrupts the output with no error.
Dropping dotenv for the built-in --env-file flag changes one thing that matters in production: a missing file is now a fatal startup error, not a warning. Plus the three parsing traps both share.
JavaScript objects keep string keys in insertion order — except keys that look like array indices, which are sorted numerically and moved to the front. Why an id-keyed object reorders itself, and what to use instead.
Grouping with Object.groupBy gives you an object with no prototype, so hasOwnProperty throws, template literals throw, and `toString` in result is false. Why the spec does that, and what to call instead.
The modern deep-copy API throws DataCloneError on functions and silently turns class instances into plain objects. What it clones, what it refuses, and when JSON round-tripping is still wrong.
Node 22.18+ executes .ts files with no build step, but enums, namespaces, parameter properties and extensionless imports still throw. What type stripping actually does.
The fetch promise only rejects on network failure. A 404 or 500 is a successful fetch, so error handling built around try/catch silently treats failures as data.
Most of Mexico has been on a fixed UTC-6 since October 2022, but two border zones still follow US DST. Stale tzdata and hardcoded offsets turn that into a silent one-hour error every summer.
Your app works on localhost and throws crypto.randomUUID is not a function when you open it on your phone at http://192.168.1.20:5173. randomUUID is secure-context only, and a private LAN IP over http is not a secure context.
npm v12 blocks dependency lifecycle scripts, git dependencies and remote tarballs by default. What breaks, how to read the skipped list, and how to write an allowlist you can commit.
The same JSON file parses over HTTP and throws when read from disk. The three invisible bytes at the front, why one path strips them and the other does not, and the one-line fix.
A family emoji is one character to a user, seven code points to a spread, and eleven to .length. Counters, limits and truncation all disagree unless you count graphemes.
A date-only string parses as UTC, the same string with a time parses as local, and the difference is a whole calendar day west of Greenwich. Why the off-by-one happens and what to use instead.
The same JavaScript number formatted two ways gives 1.00 and 1.01. toFixed rounds the exact binary value; Intl.NumberFormat rounds the printed decimal. Pick one deliberately, especially for money.
YAML 1.1 parsers turn no, off and yes into booleans, so a country code becomes false and an "on:" key becomes true. Which parser you use decides whether your config survives.
DMARCbis shipped in May 2026 as RFC 9989, 9990 and 9991, obsoleting RFC 7489. Most of your record survives — but pct, rf and ri are gone, and the Organizational Domain is now found by a DNS tree walk instead of the Public Suffix List.
Redirect a POST with 301, 302 or 303 and clients are allowed to drop the method and the body. The request still returns 200, so the bug looks like the server ignoring your payload.
The same + is a literal in a URL path and a space in a query string. That split silently corrupts base64, signatures, and any value you pasted straight into a URL.
A 19-digit ID goes into JSON.parse and a different 19-digit ID comes out. No error, no warning. Why it happens, how to detect it, and the three ways to fix it.
The same accented word has more than one legal encoding. If one comes from a macOS filename and the other from a form field, equality checks, uniqueness constraints and search all quietly break.
Backtracking engines can take exponential time on inputs a few dozen characters long. Here is how to spot the shape that does it, and what each language actually gives you to stop it.
no-cache stores the response and revalidates it. no-store is the one that refuses to write anything down. Getting them backwards either leaks private data into a shared cache or throws away every conditional request you could have had.
SVG is XML that can carry <script> and onload. If your users upload avatars or logos and you serve them from your own origin, you are hosting stored XSS. Here is what actually stops it and what only looks like it does.
A cell that starts with =, +, -, @, tab, or carriage return is a formula, not text. If your export contains user-supplied strings, someone else opens your CSV and runs their code. Here is the fix and why the obvious one is wrong.
OpenAI cut its cheapest GPT-5.6 tier by 80% on July 30. Your bill will not drop 80%, because output tokens cost 6x input and retries and resent context are billed in full. Here is the arithmetic that actually predicts your invoice.
A single as unknown as turned a working library call into a feature that failed on every input — and typecheck, unit tests and the build all stayed green. Here is why the double cast disables the one guardrail that would have caught it, and what to write instead.
Introspection lets any client download your entire schema — every type, field, argument, and deprecation note — with one query. Great in development, a reconnaissance gift in production. What __schema returns, how it is abused, and the right way to lock it down.
A .har export from your browser Network panel captures every request and response — Authorization headers, session cookies, CSRF tokens, full request bodies. Here is what is inside, why support keeps asking for one, and how to redact it safely.
The three base64url segments of a JWT are readable by anyone — decoding tells you what a token claims, not whether the claim is true. The structure, the decode-versus-verify gap, and the alg:none and RS256-to-HS256 attacks that turn that gap into account takeover.
The Unix epoch is simple until it is not. Milliseconds versus seconds, signed 32-bit overflow in 2038, leap-second smearing, and timezone assumptions cause real production bugs. The field guide with the conversions that actually matter.
Base64 is a reversible text encoding with no key. Anyone can decode it in one line. Here is why it keeps getting mistaken for protection — in Basic Auth, JWTs, and Kubernetes Secrets — and what each of those actually relies on.
PDFs carry an Info dictionary and an XMP stream that record author name, the exact software and version that made the file, timestamps, and sometimes earlier revisions. Here is what is in there and how to remove it without uploading the file anywhere.
Random UUID v4 primary keys scatter inserts across a B-tree, causing page splits and cache churn. UUID v7 is time-ordered and inserts append to the right edge. Here is the mechanism, per database engine.
A practical look at ffmpeg compiled to WebAssembly — what video work it does well in a browser tab, where it stalls, the COOP/COEP headers it needs to run multithreaded, and the size cost of shipping a video editor with no backend.
iPhones record 4K HEVC at 16:9 by default. YouTube Shorts wants 9:16 vertical MP4 under 60 seconds. The mismatch causes silent upload failures, letterboxed playback, and quality loss. Here is the conversion in two browser-only steps, with no upload to a third-party service.
A 4-word EFF diceware passphrase has more entropy than a 12-character random password and is dramatically easier to remember. NIST has recommended length over complexity since 2017. Here is the math, the standards, and why memorable-sentence generators are the right default in 2026.
Sunday is 0 in POSIX cron, 1 in Quartz, and 1 in AWS EventBridge — and the difference silently shifts your job by a day. A field-by-field guide to the four dialects you will actually encounter, with a side-by-side comparison and the conversion rules.
Decoding the most common JSON.parse error in JavaScript: how to find the byte offset, what each variant of the message means in Chrome / Firefox / Safari, and the five mistakes that trigger it.
A fast browser-only workflow for syntax-checking a YAML manifest, converting it to JSON for tooling that does not speak YAML, and avoiding the silent type coercions that bite production deploys.
