Writing

Notes on Bubble.io, AI, and shipping things.

67 posts on Bubble.io, AI, n8n, and shipping production apps that hold up.

Chrome extension version-bump discipline: pre-commit + GitHub Actions: cover image

Latest

· 6 min read · chrome-extension , github-actions , pre-commit-hooks

Chrome extension version-bump discipline: pre-commit + GitHub Actions

The Chrome Web Store rejects re-uploads with the same manifest version. Catch the missed bump locally in a pre-commit hook; gate it again in CI.

Read as a series

Topical clusters meant to be read in order, or jumped into anywhere.

Chrome Extension Lifecycle 3 posts
Read the series
Claude Code Engineering 9 posts
Read the series
Supabase Production Hardening 6 posts
Read the series
Data Pipeline Reliability 4 posts
Read the series

Recent writing

View all 67 →

·7 min read · chrome-extension , manifest-v3 , supabase

How to build a Chrome extension popup with Supabase Auth (step by step)

Wire Supabase Auth into an MV3 popup: bundle the UMD, persist sessions in chrome.storage, recover state on reopen. Working code included.

How to build a Chrome extension popup with Supabase Auth (step by step): cover image

·10 min read · chrome-extension , manifest-v3 , chrome-web-store

Shipping a Manifest V3 Chrome extension: the gates nobody mentions

Trader verification, publisher identity, the URL slug gotcha, version-bump CI: the async gates that turn a one-day project into a three-week project.

Shipping a Manifest V3 Chrome extension: the gates nobody mentions: cover image

·7 min read · methodology , refactoring , lovable

Phased migrations with per-phase verification gates

Big-bang refactors of 6+ files break things you cannot predict. Phased migration with explicit gates catches regressions before they compound.

Phased migrations with per-phase verification gates: cover image

·8 min read · claude-code , claude-md , lovable

How I document AI-built projects: a CLAUDE.md, ISSUES.md, and prompts/ workflow

Four files that fix the missing context in AI-built codebases: CLAUDE.md, ISSUES.md, a prompts/ folder, and a two-AI handoff workflow.

How I document AI-built projects: a CLAUDE.md, ISSUES.md, and prompts/ workflow: cover image

·7 min read · react-hook-form , zod , react

How to migrate a useState form to React Hook Form and Zod (the real walkthrough)

Step-by-step migration from useState to React Hook Form, Zod, and shadcn Form. Code diffs, validation mode choice, and four gotchas covered.

How to migrate a useState form to React Hook Form and Zod (the real walkthrough): cover image

·7 min read · supabase , supabase-auth , supabase-publishable-key

Migrating to Supabase publishable keys broke my Chrome extension. Here is the fix.

Supabase publishable keys return 401 from hand-rolled fetch. Migration to @supabase/supabase-js with a chrome.storage.local session adapter.

Migrating to Supabase publishable keys broke my Chrome extension. Here is the fix.: cover image

·9 min read · lovable , lovable-security , supabase

How to audit a Lovable app after the BOLA disclosure: a 6-hour rotation playbook

Audit checklist I ran on a client's Lovable app after the April 2026 BOLA disclosure, plus the key rotation and Chrome extension SDK migration.

How to audit a Lovable app after the BOLA disclosure: a 6-hour rotation playbook: cover image

·7 min read · supabase , supabase-realtime , security

Realtime broadcast scope is a security boundary, not a routing convenience

Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag plus RLS is the fix.

Realtime broadcast scope is a security boundary, not a routing convenience: cover image

·6 min read · security , supabase , auth-jwt

User enumeration via password reset: the bug in default forgot-password flows

Most forgot-password endpoints leak whether an email exists. Fix: return the same response always, regardless of account status.

User enumeration via password reset: the bug in default forgot-password flows: cover image

·7 min read · security , supabase , edge-functions

Origin validation in edge functions: the open redirect you ship by default

Edge functions that trust the Origin or Referer header for redirect URLs are open-redirect vulnerable. One allowlist helper closes the gap.

Origin validation in edge functions: the open redirect you ship by default: cover image
Browse all 67 posts in the archive

All topics