Constant-time secret comparison for API routes — closes a real side channel in ~15 lines. Extracted & verified — repo landing next.
String comparison leaks how much of a secret an attacker got right. The fix is fifteen boring lines every API route should have.
24 interactive classes on shipping real tools with Claude Code and a terminal — the same process that built this shelf, not a drag-and-drop toy track.
Every class ends with a working artifact you keep. The proof it works? You're looking at it — this whole shelf was built that way.
See the 24 classes