How I Build Things

Least privilege

A credential carries only the authority its actual usage requires, never the broader default it's handed.

Minimal dependencies

Every dependency gets pinned exactly and held still — vendored JS, exact Python versions, SHA-pinned GitHub Actions.

No egress by default

Deny network access by default, enforced by whatever mechanism the component actually provides — not left to convention.

Privacy-first, local-first

A user's data never reaches a third party — either it never leaves their device, or it goes only to a backend I run myself.

HTML tool pattern

Small, self-contained browser utilities — single-file static HTML, no build step, no backend.

Private server-side app pattern

Apps that need a real backend, kept private — reachable only by me, never the public internet.