Build web applications you can trust

Hi developer,

Imagine a user visits an attacker-controlled page while signed in to your application. The attacker places your app inside a transparent iframe over a harmless-looking button.

<iframe src="https://your-app.com/account"
        class="invisible-overlay"></iframe>

The user sees the attacker's interface, not the framed page.
The click can trigger a real state-changing action in your app.
Authentication alone does not prove that the user intended the action.

Content-Security-Policy: frame-ancestors 'none';

Hi developer,

In a layered application, controllers should depend on services and services should depend on repositories.

controllers -> services -> repositories

A controller imports an API file directly.
Reviewers miss the dependency in a large pull request.
The exception becomes the next developer's precedent.

describe("Application", () => {
  it("controllers should not depend on APIs", async () => {
    const rule = filesOfProject()
      .matchingPattern(".*controller\\.ts")
      .shouldNot()
      .dependOnFiles()
      .matchingPattern(".*api\\.ts");

    await expect(rule).toPassAsync();
  });
});

Build web applications you can trust.

Can another website frame your app?

Can we test application architecture?

One useful idea. 💡Under five minutes.

Code gets produced faster. Judgment doesn't.

900+ course enrollments

Practical teaching for people who ship real software.

Two useful ideas every week. Less than ten minutes total.

Help debug this website

One useful idea. 💡
Under five minutes.