Insights into selected projects and roles.

How to build your own MCP server in TypeScript in a single afternoon – with a runnable mini example and the lessons I already did differently on my second server.

How MCP servers turn a chat partner into a colleague with real hands – and why every connected server should be a deliberate decision, not a default.

Why prompt injection can't be solved with filters, what makes the attack so novel – and how to safely run agents in production anyway.

Why vibe coding is great for prototypes but poses a security risk without technical understanding – and why AI should remain a copilot, not an autopilot.

How a seemingly legitimate project request nearly led to a local system compromise – and why developers should apply zero trust to unknown repositories.

One year after my first article about AI, I take stock: where it truly supports me – and where it tends to slow me down.

Learn how to implement rate limiting for a typical login form using Express.js and Nginx to protect your application from brute-force attacks and overload.

Discover the benefits of passwordless authentication, which uses alternative methods like One-Time Passwords (OTPs) and Magic Links to enhance user experience and security. Learn how to implement a passwordless login system with Node.js and Express.

Why AI should not be seen as a job killer, but as a job enhancer. My thoughts and experiences on current developments.

What is Content Security Policy (CSP) and how can it be used to protect web applications?