Blog

A link like [click](java	script:alert(1)) sails through a naive javascript: blocklist, because the browser strips the tab before it resolves the scheme and your string comparison doesn't. Here is how TaskKit's hand-written Markdown renderer stays safe: allowlist the four schemes that are safe, normalize the URL to the string the browser will actually see, and escape every text run by default.

Everything after the # in a URL stays in the browser. It is never in the request line, never in the Referer header, never in your access logs. Here is how TaskKit packs a whole document into the fragment so a share link decodes on the recipient's machine and the data never touches a server, plus the one hard ceiling on the trick.

AbortController is cooperative. It can't stop a runaway regex or a multi-megabyte JSON.stringify, and a setTimeout on the main thread can't even fire while one is running. The only true preemption primitive in the browser is Worker.terminate(). Two patterns from TaskKit.

Why a perfectly working React component crashes the build with 'DOMMatrix is not defined' the moment you move from astro dev to a Cloudflare Workers deploy — and the one-line fix.

How TaskKit's markdown editor exports a real PDF — with rendered Mermaid diagrams — entirely in the browser. Plus the four bugs that took longer to find than the fix.