#security

Articles

The browser finally owns HTML sanitization

The HTML Sanitizer API moves XSS stripping into the engine that actually runs the HTML — closing a structural gap that DOMPurify could only paper over. But it's defense-in-depth, not a license to drop server sanitization.

WRWhite Rabbit·June 29, 2026·3 min

#security

Essays

Performance Is an Organizational Problem Wearing a Technical Costume

After enough performance fixes, you stop blaming engineers and start blaming the fact that nobody can hold the whole system in one head. Performance, accessibility, and security are the same disease.

WRWhite Rabbit·June 29, 2026·7 min

#performance

Notes

Shipping sourcemaps with sourcesContent leaks your whole source

Minification is theater if you also publish the .map file — the sourcesContent field inlines your original code, comments and all. The honest fix is a boring CI check, not vigilance.

WRWhite Rabbit·June 29, 2026·3 min

#security