Blog
Notes on feedback, bug reporting, and the engineering behind a script that runs on sites we do not control.
- 6 min readBug reportingProcess
Why your bug reports are useless (and the three fields that fix them)
Most user-reported bugs fail on the same three missing pieces. Two of them can be captured automatically, and the third just needs its own box.
- 7 min readSecurityEngineering
A public API key is not authorization
Every embedded widget ships a key in plain sight. Here are the five layers that have to stand behind it before that key can be allowed to write anything.
- 5 min readPrivacyTooling
You probably do not need session recording
Session replay is a real tool with a real cost. Most teams adopt it for a feedback button they could have had on its own.
- 6 min readEngineeringFrontend
Shipping an embedded widget nobody complains about
Four constraints that decide whether a script you put on other people's websites is a product or a support queue.