Context Engineering for AI Agents: A Practical Guide
Prompt engineering got you a good answer. Context engineering keeps an agent useful across fifty steps. Here is how to decide what earns a place in the window.
INDEPENDENT NOTES / VOL. 01AI · SECURITY · WEB · DEVOPS
Notes from the
making of things.
Practical guides on AI agents, security, web development and the fixes developers search for most.
30 STORIES ✳ AN OPEN NOTEBOOKLATEST NOTE / 01
AI ENGINEERING · 3 MIN READContext Engineering for AI Agents: A Practical Guide
Prompt engineering got you a good answer. Context engineering keeps an agent useful across fifty steps. Here is how to decide what earns a place in the window.
Read the storyINDEX / 01—30
30 STORIES FOUNDExplore the notes.
How to Build an MCP Server (and Keep It Secure)
The Model Context Protocol makes it easy to give AI agents tools. It also makes it easy to give them too much. A practical walkthrough with the security decisions that matter.
AI Coding Agents: How to Actually Get Good Results
Terminal agents like Claude Code, Codex and Gemini CLI are now everyday tools. The difference between frustrating and excellent results is mostly in how you set up the work.
LLM Evals for Production: How to Test AI Features
You would not ship an API without tests. AI features need them too, just a different kind. A practical approach to building an eval suite that catches regressions.
RAG vs Long Context: When to Use Each
Context windows now hold entire codebases, so is retrieval-augmented generation still needed? Usually yes, but not always. A decision guide with the trade-offs.
AI Agent Observability: Tracing Tool Calls and Decisions
When an agent fails, the final answer rarely tells you why. Tracing every model call, tool call and decision is how you debug agents in production.
Multi-Agent Systems: When One Agent Is Enough
Multi-agent architectures are everywhere in 2026 demos. In production, more agents often means more cost and more failure points. A guide to choosing the simplest design that works.
How to Review AI-Generated Code: A Checklist for Pull Requests
Developers say their biggest frustration with AI is code that is almost right. A focused review checklist catches the mistakes AI tools make most often.
Prompt Injection Explained: How to Defend AI Agents
Prompt injection is still the leading cause of AI agent security failures. What it is, why it cannot be fully patched and the layered defences that actually reduce risk.
npm Supply Chain Attacks: How to Protect Your Projects from Worms Like Shai-Hulud
Self-propagating malware has hit hundreds of npm packages with billions of monthly downloads. Here is how these attacks work and the concrete steps that protect your projects.
Leaked API Keys in Git: How to Find, Rotate and Prevent Them
Committed a secret by accident? Deleting the file is not enough. A step-by-step fix, plus the guardrails that stop it happening again.
Vibe Coding Security Checklist: Ship AI-Built Apps Safely
Scans of AI-built production apps keep finding the same gaps: exposed secrets, missing authorisation and no security headers. A checklist to run before you launch.
Passkeys for Developers: Implementing WebAuthn Step by Step
Passkeys replace passwords with phishing-resistant cryptography built into phones and laptops. How they work and how to add them to your app without breaking existing logins.
OWASP Top 10 for LLM Applications, Explained for Developers
The OWASP list of the most critical risks in LLM applications, translated into plain language with a concrete mitigation for each one.
How to Detect Phishing Websites: The Signals That Actually Work
Phishing pages now look perfect and often use HTTPS. Reliable detection combines several signals: the URL, the page content, the language and what the page looks like.
How to Fix React Hydration Errors in Next.js (React 19)
Hydration failed because the server rendered HTML didn't match the client? Here are the real causes, how to read React 19's diff and the right fix for each one.
TypeScript 7 Explained: The Go-Native Compiler and How to Upgrade
TypeScript 7 ports the compiler to Go for roughly 10x faster type checking, with no new syntax. What changed, what to watch out for and a safe upgrade path.
How to Improve INP: Fixing Slow Interactions for Core Web Vitals
Interaction to Next Paint measures how quickly your page responds to clicks, taps and key presses. How to find slow interactions and the fixes that make the biggest difference.
CORS Errors Explained: How to Fix 'No Access-Control-Allow-Origin Header'
The most searched web error has a simple cause: the browser is protecting users, and your server has not opted in. How CORS works, how to read the error and how to fix it properly.
React Server Components vs Client Components: A Clear Mental Model
When should a component run on the server, and when does it need 'use client'? A simple mental model, the common mistakes and the patterns that keep bundles small.
Local-First Software: A Practical Introduction to CRDTs and Sync
Local-first apps work offline, feel instant and still sync across devices. How they work, what CRDTs actually do and when the approach is worth it.
Kubernetes CrashLoopBackOff: Causes and How to Fix It
CrashLoopBackOff means your container keeps starting and dying. A systematic way to find out why, with the commands and the most common fixes.
How to Reduce Docker Image Size: Smaller, Faster, Safer Builds
A 1.5 GB image slows every deploy and ships hundreds of packages attackers could use. Multi-stage builds, the right base image and a few habits can cut it by 90%.
Fix 'Port Already in Use' (EADDRINUSE) on Windows, macOS and Linux
Error: listen EADDRINUSE: address already in use :::3000. How to find which process is holding the port, stop it safely and stop it happening again.
How to Speed Up GitHub Actions: Caching, Parallelism and Smarter Triggers
Slow CI costs focus and money. Practical changes that routinely cut GitHub Actions pipelines from 15 minutes to under 5.
How to Undo Almost Anything in Git: Reset, Revert, Restore and Reflog
Committed to the wrong branch? Need to undo a push? Lost commits after a reset? A practical guide to fixing the most common git mistakes safely.
uv: The Fast Python Package Manager and How to Migrate from pip
uv replaces pip, virtualenv, pip-tools and pyenv with one fast tool. What it does, the commands you need and a step-by-step migration for existing projects.
Python Without the GIL: What Free-Threading Means for Your Code
Python 3.14 officially supports a free-threaded build without the Global Interpreter Lock. When it speeds things up, when it does not and how to try it safely.
Technical Debt in the AI Era: How to Measure and Manage It
AI tools let teams write code faster than they can understand it. Research links AI adoption to rising technical debt. How to keep speed without drowning in maintenance.
How to Write a Technical Design Doc (With a Template)
A good design doc saves weeks of rework and is now great context for AI agents too. What to include, what to leave out and a template you can copy.
NO NOTES FOUND / 00
Try a different trail.
Change a topic or search term to explore more stories.