Blog

The British Airways skimmer sat in a first-party file, so no host allowlist, no 'self' and no nonce would have stopped it — here is one CSP header tightened four times, broken after each round against the CSP Level 3 matching algorithms, until only the directive nobody writes first is left holding.

Prisma 7 eliminated the Rust binary and closed the performance gap. So why are teams still choosing Drizzle? The real answer is about SQL transparency, bundle size, and who owns complexity.

One file to guard every route — plus the Next.js 16 rename that moves it off the Edge runtime, the request-vs-response header trap that leaks user IDs to the browser, and the CVE that explains why this can never be your only auth layer.

Parallel routes let a single layout render multiple independent pages at once. Combine them with intercepting routes and you get URL-aware modals with zero hacks.

Server Actions collapse form handling into a single server function—no API route, no manual fetch, no useState for loading. Here's the pattern that replaces 80% of your mutation boilerplate.

Four caching layers, three revalidation APIs, and the Next.js 16 rename that turns everything you learned in 15 into the "previous model". Here's the complete mental model for data fetching in the App Router.

If you're still writing pages/api/... files in a new Next.js project, stop. Route Handlers are the App Router's replacement, and they're meaningfully better — typed, streaming-capable, and built on the same Web platform APIs that Cloudflare.

Astro's JavaScript floor is zero; Next.js's is a framework baseline. That one architectural difference — hydration opt-in vs opt-out — decides most of this comparison, and it matters much less than it sounds once your users are logged in.

One 'use client' at the top of your layout wipes out every performance benefit RSC offers. Learn how to push the boundary to leaf components and keep your server tree intact.