Dev blog
What we are building, and how
Notes from the work: what we shipped, how it is put together, and what broke on the way.
Ask for the permission, not the key: connect services safely
Copying the environment variable to the other server costs one line less. Asking the owning service for a signed link, which opens one screen and expires, removes a place where the key that opens every screen can leak. The criterion and the three rules behind it.
engineeringsecurityintegrationwebHow much silence each ElevenLabs voice model leaves
We measured the same sentence with three voices and three ElevenLabs models. A table of internal silence in seconds for each combination, so you can choose with a number.
videovoiceaiHow to test an HTML sanitizer so the test means something
A sanitizer with green tests may be doing nothing. Three steps to test it so the suite measures what the sanitizer prevents.
securitytestinghtmlOne carousel, five channels: what changes on each network
The same approved carousel bounces for a different reason on Instagram, Facebook, Telegram, email and WhatsApp. The limits that matter, why they should be copied from the publisher with a test watching the copy, and why nothing gets trimmed silently.
socialcontenttestingRetries without duplicates: derive the idempotency key from the content, not the clock
A retry is normal in any fetch; a duplicate post on a brand's feed is not. How to build an Idempotency-Key that makes the second click return what already exists, and why validation must be all-or-nothing when you publish to several channels.
engineeringapisreliabilityCards before video: why you should review an idea as slides first
Every AI video attempt spends voice and render time. Reviewing the idea as cards costs nothing, and only what you approve becomes video. How the flow works and which rules guard it.
videoworkflowaiWhere a generated clip goes in a teaching video, and where it can't
A stock or generated clip looks good and knows nothing. In a video that teaches, it can open the question and never give the answer. Three rules you can write as one function and run at every stage of the edit.
videoeducationaicontentThe AI never writes your payment alias, and nobody confirms a payment you haven't seen
Three things vendear's AI seller cannot do, on purpose, because they touch your money — and what it does instead in each case.
vendearpaymentscriteriaA WhatsApp preview card for a static page, without a browser on the server
Our proposals are published as static folders, and pasting one into WhatsApp showed a bare link. WhatsApp does not render SVG, and we did not want a headless browser in the container just to draw a thumbnail. A native rasterizer with its fonts packed inside now writes a 1200×630 PNG on every publish. The pipeline, the two Next.js settings it needs, and what happens when it fails.
engineeringwebimagesnextjsGive your site an endpoint that says which commit it came from
Thirty lines in a Next.js route, and "which version is live?" is answered with a curl and a git rev-parse. How we built it for vendear, where the commit comes from, and why the answer also says how the deploy was made.
engineeringdeploywebvendearHow to turn a logo into an animated background that never covers the text
Read the drawing rules out of the mark, grow the shape from a seed, and measure where the words sit before you draw a single line. With the contrast numbers we got.
designmotionaccessibilityKeep shared links on the right domain: canonical, og:url and the trailing slash
One variable with an extra slash or a leftover Vercel host, and every shared link goes out on the wrong domain. The six-line function that normalizes it in vendear, where it is used, and why it points to www and not the bare domain.
engineeringseowebvendearHow we decide what to try next in retrieval: a queue of written predictions
Our retrieval roadmap is a queue of hypotheses, each with its prediction and the result that would falsify it written down before measuring. How one number ordered the queue, and how the queue reordered itself when the first bet lost.
engineeringretrievalragevaluationHow we evaluate retrieval: a golden set, a row with no leakage, and a benchmark that refuses to run
Three design decisions in our retrieval benchmark that are not obvious, and that anyone who inherits it needs to understand. Where the test set comes from, which configuration is allowed to decide, and when the benchmark says no.
engineeringretrievalragevaluationA page can be down without returning a single error
Our contact form answered, looked right and sent nothing. Two indexed routes returned 200 and were empty. No uptime monitor catches that, because nothing fails — what is missing is the last mile.
engineeringtestingweb