Notes from building and securing things on the web.

A booking-first barbershop site where you can embed your own Calendly

A demo barbershop site built around one CTA, with a two-mode booking section — an interactive scheduler, and a live Calendly embed that accepts any visitor's own booking link.

A med spa landing page that annotates its own conversion choices

A demo landing page for a fictional laser hair removal spa that publishes its prices, compares itself honestly against waxing, and includes an owner tour explaining why each section exists.

Proof first, phone always: a landscaping site built for how trades get hired

A demo marketing site for a fictional landscaping business — before/after gallery as the proof, and a sticky mobile bar that keeps call and quote one thumb away.

Building the 'before' on purpose: a website refresh you can flip through

A demo where the same fictional plumbing company gets two complete sites — a deliberately dated 2010-era build and its modern rebuild — with hash routes so either is directly linkable.

A CRM the size of the problem: localStorage, 8 stages, and a pasteable Apps Script

A freelance lead tracker that skips the backend entirely — localStorage for persistence, and Google Sheets sync through an Apps Script the app generates for you to paste.

A diner menu that survives the QR scan, plus a table card from a print stylesheet

A demo diner site where the mobile menu is the product — and the 4×6 QR table card is just a page of the site with a print stylesheet, no designer required.

Replacing the photographer contact form with a funnel that quotes itself

A demo photography portfolio where the contact page is a four-step inquiry funnel — shoot type, date, location, contact — validated per step so every inquiry arrives quotable.

Making invisible automation watchable: a review-request flow in a phone mockup

Automation demos fail because nothing visible happens. This one puts an interactive phone mockup next to the trigger form — and runs on a stateless Worker that keeps request state inside the request id.

What 'Progressive Enhancement' Actually Buys a Client

Progressive enhancement sounds like a developer buzzword. In practice, it's the difference between your site showing a broken page and your site quietly working anyway.

A Non-Developer's Guide to Knowing If Your Website Is Secure

You don't need to read code to sanity-check your own site's security. Here's a plain-language checklist covering the things that actually matter for a small business site.

How Much Does a Small Business Website Actually Cost to Run?

Most small business sites don't need a monthly hosting bill at all. Here's what actually costs money once your site gets real traffic, and what stays free.

Do You Need a CMS, or Just an Admin Panel?

A practical guide to picking between an off-the-shelf CMS and a custom admin panel — what each one actually costs you in money, flexibility, and maintenance.

Why Your Website Slows Down (or Breaks) During a Traffic Spike

A sudden rush of visitors is usually a good problem to have — unless your site's API calls weren't built to survive it. Here's what actually breaks, and how caching fixes it.

You Don't Always Need a Backend, a Database, or a Login

Not every web tool needs a server, a database, and user accounts. Sometimes the simplest, cheapest, and most secure option is the one with no backend at all.

Why I Test the Attack Before I Write the Fix

A security fix isn't done when the code looks right. It's done when a test proves the exploit no longer works — and would fail again if the fix were ever reverted.

A full dealership stack that costs $0/month to run on Cloudflare

A storefront, staff back office, and AI-assisted tools for a car dealership — running on Cloudflare's free tier and hardened for public traffic. What that setup actually takes.

Why the 90-Day Password Rotation Policy Needs to Die

Forcing users to change passwords every quarter feels responsible. In practice it manufactures weaker, more predictable passwords — and the standards bodies have said so for years.

TIL: jq can walk arbitrarily nested JSON with `..`

Recursive descent in jq (`..`) finds a key no matter how deep it is buried — perfect for spelunking a cloud API response you did not write.

Dev Log — Q2 2026: auth, scanning, and less YAML

A running changelog of the security and tooling work that shipped this quarter across the projects here.

A photography portfolio that never shows a blank page, even if the backend is down

A vanilla-JS gallery on Vercel, a Cloudflare Worker API over Turso and R2, and a data layer that degrades to bundled sample data instead of a blank page when the API is unreachable.

Building an admin CMS where every staff action is auditable

A React and Supabase site for a record label, with an eight-panel admin CMS where every create, update, and delete writes to an audit trail and images route through a caching Worker.

One content source, two sites: how mroot.co works

The portfolio you're reading. A Vite plugin turns Markdown into a typed data module, and both the regular site and the IDE mode render from it — no duplicated content.

How to Fix a SQL Injection Vulnerability Without Breaking Production

A search endpoint on Atlas Market built its query with string interpolation. Here's how I proved the vulnerability with a failing test, fixed it with parameterized queries, and shipped without breaking a single caller.

Building a two-sided marketplace with an order state machine

A Next.js marketplace with a Hono API mounted at the catch-all route, an order lifecycle that runs as a state machine, and realtime messaging that can't roll back a transaction.

Docker Container Hardening Guide: From Bloat to Distroless

A standard Node Dockerfile ships a full OS, a package manager, and a shell — all of it attack surface. Here's how to strip it down to a distroless image with multi-stage builds, and what it actually buys you in image size and CVEs.