Claude Code gives every session a scratch folder under /private/tmp, and it is easy to think that this folder is where all of its leftovers live. It is the smallest part: more temporary files sit next to it, and the long-term record of every session stays in ~/.claude for a month by default.
One newsletter email carries several sender addresses, and each of them belongs to a domain. This post follows one email from your app to the reader's inbox and shows which Domain Name System (DNS) records prove that each of those domains is yours.
Every Mac comes with a firewall, and it is switched off. This post explains what that firewall does, why turning it on is a small but free win, when a second firewall for outgoing traffic is worth installing, and why on a work Mac the decision is not yours.
When many Claude agents work together, a single agent that is tricked by hidden instructions can pass those instructions on to all the others. This post explains what a sandbox protects in a group of agents, which kinds of isolation exist from a simple command filter to a separate virtual machine, how to configure them in Claude Code, and which setups work well in practice.
For fifteen years the .env file has been the most convenient lie in web development: a plaintext file full of production-grade credentials, kept safe by the single assumption that only you would ever read your own disk. That assumption is now false, and the fix is less dramatic than it sounds.
Every "always allow" click quietly trades a little control for a little convenience — and after a few months of daily agent use, those clicks add up to a security posture nobody designed. Here's how to audit what your coding agent can already do without asking, which grants deserve scrutiny, and how to put deliberate guardrails back.
Most people's digital security is a single point of failure with extra steps. Locking it down — password manager, two-factor authentication, recovery codes, tested backups — is a weekend project, not a lifestyle.
You've seen this screen a thousand times: a dark page, the domain name in bold, "Performing security verification", and a lonely checkbox with the Cloudflare logo. It feels like a speed bump, but there's a surprisingly rich pipeline behind it — and, importantly, none of it runs on the website's own servers.
Every framework, HTTP client, and browser hides the protocol behind a few convenient calls — so most developers never see the request that actually goes over the wire. This post pulls back that curtain: the communication model, the methods, the status codes, and the headers you've been using all along without knowing it.
Virtual Private Network (VPN) marketing has done an incredible job convincing people that a single subscription makes them anonymous, secure, and untouchable. "Military-grade encryption." "No logs." "Total privacy." The reality is far messier: a VPN is a useful tool for a narrow set of problems, but as a privacy solution it has structural weaknesses that no amount of marketing can fix.