Outside the Box Model
I make browsers do things they weren't designed to do.
New
Introducing ugrant: an OAuth token broker for CLI apps
Portable delegated auth for small Unix tools, agents, and independently running prompts.
How We Built the First Magic Link for Bug Reports ↗
Deep-dive on the Recording Links architecture — iframe state partitioning, service workers, and cross-origin communication at scale.
LinkSnatch: Prenegotiated embed tokens are unsafe at admin scope
How and why Stripe-style iframe security breaks down for admin embeds. Live demos within.
My Opinionated React Stack for 2026
Bun, TanStack Start, Panda CSS, BaseUI, Cloudflare Workers — and why every z-index in the repo is -1, 0, or 1.