How I Build Things
And why
Principles
Least privilege
A credential carries only the authority its actual usage requires, never the broader default it's handed.
Minimal dependencies
Every dependency gets pinned exactly and held still — vendored JS, exact Python versions, SHA-pinned GitHub Actions.
No egress by default
Deny network access by default, enforced by whatever mechanism the component actually provides — not left to convention.
Privacy-first, local-first
A user's data never reaches a third party — either it never leaves their device, or it goes only to a backend I run myself.
Patterns
HTML tool pattern
Small, self-contained browser utilities — single-file static HTML, no build step, no backend.
Knowledge base pattern
Prose content records — principles, decision records — authored in markdown, built to static HTML by a small, exactly-pinned script.
Private server-side app pattern
Apps that need a real backend, kept private — reachable only by me, never the public internet.