How GenAI actually works, from one small JavaScript file
I built up one small token.js file to see what an LLM really does: tokens, no memory, system prompts, and thinking in steps.
Hoisted
Notes from a full stack engineer in London: React and Next.js upgrades, Node, coding with AI agents, and the security advisories that eat my weekends.
Latest articles
A code block in react-email was rendering HTML instead of showing it
Code samples in react-email's Markdown component came out as real HTML. What caused it, the small fix, and what the fix doesn't do.
The banks can't tell your AI agent from you
US banks are finding AI agents logged into customer accounts with shared passwords. The real problem is that nothing in the login says who is acting.
Patching Node for the October 2026 security release
Node's 21 October release fixes ten CVEs across 22, 24 and 26, four rated high, and the Brotli decoder one is the one I'd patch first.
PHP2Shell, from someone who mostly writes JavaScript
Two critical PHP bugs were patched yesterday after a messy disclosure, and even if you never touch PHP, JavaScript developers should look.
My rental alert's big feature already existed, so I rebuilt it
It started as 'Rightmove, but faster' until I found Rightmove already sends instant alerts. Now it searches three sites and shows each home once.
Next.js 16.4 and React 19.3 across my side projects
Cache Components are the default in Next.js 16.4 and ViewTransition is stable in React 19.3, so I upgraded the apps I run at home.
Building a news radar and a job hunter in n8n
An hourly AI and React news digest on Telegram, a job hunter that never emails anyone without my yes, and the n8n quirks that cost me time.
My self-hosted scraper was an open door into my home network
Self-hosted Firecrawl has no auth and will fetch private IPs. I found that out just in time, so now it sits behind a small nginx gateway.
