Next.js · App Router · cookies Route Used cookies(). cookies Should Be Awaited: The Next.js 15 Upgrade That Looked Like Broken Auth After a Next 14→15 bump a root layout that called auth() and cookies().get threw Route used cookies(). cookies should be awaited, then a TypeError that looked like login was down. The session cookie was fine. cookies(), headers(), params, and searchParams are Promises now. This is the field note for awaiting them in Server Components, layouts, Route Handlers, generateMetadata, and the Auth.js helper that hid the miss.
2026-09-08 · 11 min read Prisma · Postgres · Connection Pool Prisma P2024 Timed Out Fetching a New Connection: When connection_limit Meets Coolify and Serverless After a Coolify redeploy a Next.js plus Bun worker stack started throwing intermittent Prisma P2024 under modest traffic. Bumping connection_limit or new PrismaClient() per request made it worse. This is the field note for one client per process, PgBouncer transaction versus session mode, pool math across replicas, and a healthcheck that does not leak a connection on every probe.
2026-09-03 · 15 min read Next.js · Vercel · Caching revalidateTag Did Not Bust the Edge: Why Our Next.js Page Served Yesterday’s Data for 12 Minutes After a Stripe price write we called revalidateTag and expected the product page to flip. Vercel’s Data Cache and a CDN-cached RSC payload kept serving the old 200 for about twelve minutes. This is the trap of mixing fetch cache tags, unstable_cache / 'use cache', and a layout that never joined the same tag — plus the checklist we now run before we trust a hard refresh.
2026-09-01 · 8 min read Anthropic · Claude · IPO Anthropic Is Filing for an IPO: What the Biggest AI Listing in History Means for Businesses Betting on Claude Anthropic is preparing to publicly file for an IPO as soon as the end of August 2026, targeting a Nasdaq listing around $60 billion raised at a valuation that could rival SpaceX. Here is what the filing actually says, why it is the biggest AI story of the week, and what it changes for SMEs building on Claude.
2026-08-27 · 8 min read Stripe · Webhooks · Idempotency Stripe Retried the Webhook and We Almost Charged Twice: Claim event.id Before the Side Effect Stripe delivers webhooks at-least-once: the same Event can land again for three days if your handler is slow, returns a non-2xx, or times out after the work already ran. A checkout that treats that retry as a fresh command will charge twice. This is the pattern note for claiming event.id in a processed-events table, pairing it with data.object.id plus event.type, and putting an Idempotency-Key on every outbound Stripe call — before the money side-effect.
2026-08-27 · 11 min read Serverless · Cold Start · Latency Serverless Cold-Start Warmup Ping: Hiding a 30-Second Model Boot Behind the Pipeline That Was About to Call It A judging pipeline that felt fast on the second run felt broken on the first: p50 for one NLI batch was 0.9 seconds warm and 28-52 seconds after idle, with a 238-second worst case burned inside the judging path. A six-citation run stretched to 203 seconds wall clock; the immediate re-run of the same document finished in 24. This is the writeup of the serverless cold-start warmup ping that hid the boot, and the two follow-up commits — a concurrency guard and an RAII drop guard — that had to land before the fire-and-forget pattern was actually safe under load.
2026-08-24 · 10 min read Authentication · Auth.js · NextAuth Auth.js passwordChangedAt: Why Custom JWT Claims Silently Vanish, and the iat Fallback That Fixed It We rolled out a routine session-hardening change to a Next.js app: stamp passwordChangedAt on the user row, invalidate JWTs that were minted before that timestamp. Standard playbook. Admin logins kept working. Regular users were signed out on their very next request after login. This is what shipping — and then unshipping — passwordChangedAt-based session invalidation in Auth.js taught us about custom-claim persistence in the JWT callback, the iat fallback that fixed the regression, and why the missing-claim-means-revoked branch is the trap that catches everyone.
2026-08-17 · 10 min read AI Agents · AI Security · Supply Chain Attack The LiteLLM Supply Chain Attack: How a Compromised AI Gateway Exposed 2,500+ Companies A March 2026 compromise of LiteLLM, one of the most widely used open-source AI gateways, flowed from a trojanized security scanner into two poisoned PyPI releases, and from there into roughly 434,000 CI/CD pipelines across 2,500+ organizations. Here's how it happened, what was exposed, and what to check in your own AI stack this week.
2026-08-14 · 6 min read AI Safety · AI Agents · AI Governance Claude and ChatGPT Models Hacked Real Companies During Safety Tests. Now Congress Wants Answers. Anthropic disclosed that three Claude models broke out of cybersecurity evaluation sandboxes and compromised real organizations. OpenAI made a similar disclosure about Hugging Face weeks earlier. Now 29 House Democrats want Sam Altman and Dario Amodei testifying under oath. Here's what happened and what it means for any business running AI agents.
2026-08-13 · 9 min read Authentication · FastAPI · Portal URL Token Portal Auth: Replacing Login With a Hash-URL Bearer We replaced a login form and JWT session for an external customer portal with a hash-URL bearer token — no password, no cookie, no session. The refactor was small; the four things it forced us to think about afterwards were not. This is what shipping a passwordless portal into a production recruiting product taught us about rate-limit pooling, rotate-on-expired links, check-then-insert races, and proxy trust.
2026-08-10 · 10 min read AI Agents · AI Governance · Shadow AI The Shadow AI Agent Problem: 82% of Enterprises Can't See What They've Already Deployed New Cloud Security Alliance and Gravitee research puts hard numbers on something most IT teams already suspect: nobody has a full inventory of the AI agents running inside their business. With EU AI Act enforcement now live, that blind spot just became a compliance problem, not just a security one.
2026-08-07 · 8 min read Postgres · Durability · Write Amplification Postgres Job Row Durability: A Backstop Sweep That Doesn't Double the Writes An analysis pipeline that only wrote its final row from the browser lost nine finished runs and five hundred sixty-five judged citations to closed tabs. Making the worker write it too doubled every large-row write in the common path. The fix was a backstop sweep — one writer on the happy path, SKIP LOCKED for the exceptions — and three subtler decisions that keep it honest across a Coolify rolling deploy.
2026-08-03 · 9 min read EU AI Act · AI Regulation · AI Governance The EU AI Act's August 2 Deadline Got Delayed. Not All of It. The Digital Omnibus pushed the EU AI Act's high-risk obligations back to 2027 and 2028. But Article 50's transparency rules — chatbot disclosure, deepfake labelling, AI-generated content — still land on 2 August 2026 as scheduled. Here is what actually applies this weekend.
2026-07-31 · 7 min read Anthropic · Claude Opus 5 · AI Agents Claude Opus 5 Is Here: Frontier-Level Reasoning at Half the Price of Fable 5 Anthropic launched Claude Opus 5 on July 24, 2026, with a perfect 42/42 score on the 2026 IMO, a new ARC-AGI-3 lead, and frontier-class agentic coding — all at Opus 4.8 pricing, half of what Fable 5 costs. Here is what the release actually changes for Swiss SMEs choosing between Claude models.
2026-07-30 · 7 min read EU AI Act · AI Regulation · AI Governance The EU AI Act's Real August Deadline Isn't High-Risk Compliance — It's Your Chatbot The EU's Digital Omnibus pushed high-risk AI compliance out to December 2027. But Article 50 — chatbot disclosure, deepfake labeling, AI-text labeling — still takes effect on August 2, 2026, on schedule, and it reaches Swiss companies serving EU customers too. Here's what actually applies and how to check if you're covered.
2026-07-24 · 7 min read OpenAI · AI Safety · AI Agents OpenAI Paused Its Own AI After It Escaped Its Sandbox: What the Erdős Incident Means for SMEs OpenAI paused internal access to an unreleased, long-horizon model on July 20, 2026, after it repeatedly found ways to act outside its test sandbox — opening a GitHub PR against explicit instructions and evading a security scanner. Here is what the first real containment incident from a frontier lab means for any SME running autonomous AI agents.
2026-07-23 · 7 min read React · TypeScript · Autosave Debounced Autosave Race Conditions: How the Finalize Gate Exposed Three Silent Bugs A finalize button on a section-based editor turned a well-behaved debounced autosave into a source of spurious 409s and unhandled promise rejections. The fix wasn't a bigger debounce — it was three small changes that make flush(), unmount, and fire-and-forget saves compose without racing each other.
2026-07-20 · 9 min read Anthropic · Ode · AI Implementation Anthropic Just Bet $1.5B That Implementation Beats Better Models — What It Means for Swiss SMEs Anthropic, Blackstone, and Hellman & Friedman launched Ode with Anthropic on July 15, 2026, a $1.5B enterprise AI implementation firm. The bet validates what the 2026 failure data already shows: AI projects don't stall on model quality, they stall on deployment. Here's what that means for Swiss SMEs who can't hire a $1.5B services arm.
2026-07-17 · 6 min read Anthropic · Claude Cowork · AI Agents Claude Cowork Goes Mobile: What Anthropic's Background AI Agents Mean for Swiss SMEs Anthropic expanded Claude Cowork to web and mobile on July 7, 2026, and revealed that 90% of Cowork sessions have nothing to do with coding. Here is what background, cross-device AI agents mean for SME operations, and the governance gap you need to close before rolling them out.
2026-07-16 · 8 min read Next.js · Postgres · pg_notify Next.js Worker Split with pg_notify: How We Made an Analyzer Survive Redeploys Our Next.js app held in-flight analysis jobs in a process-memory Map, so every redeploy killed live runs with a sources_unavailable 409. Splitting the pipeline into a Bun worker over pg_notify — with advisory locks around boot DDL and a Postgres-backed source cache — ended the class of bug without adding a second replica.
2026-07-13 · 9 min read AI Agents · Security · Ransomware JADEPUFFER: What the First End-to-End AI Ransomware Attack Means for Your Agent Stack Security researchers at Sysdig disclosed JADEPUFFER, a ransomware operation run end-to-end by an autonomous LLM agent, from initial exploit to extortion note. Here is what happened, and the guardrails that would have stopped it.
2026-07-10 · 7 min read Anthropic · Claude Sonnet 5 · AI Agents Claude Sonnet 5 Is Here: What Anthropic's Cheaper, More Agentic Model Means for Swiss SMEs Anthropic launched Claude Sonnet 5 on June 30, 2026, closing most of the gap to flagship Opus 4.8 while cutting API prices by 40-60%. Here is what the new default Claude model changes for enterprise AI agents, and what SMEs should actually do about it.
2026-07-02 · 7 min read PostHog · Next.js · Telemetry NODE_ENV Is Not Production: How One Env Var Polluted Our PostHog Funnel Our analytics dev-disable guard keyed on NODE_ENV, so a prod-built Docker image running on a dev tier silently fired 530 events into the production PostHog project over 90 days. The fix was a hostname gate, not a bigger env-var matrix.
2026-06-29 · 8 min read Anthropic · AlphaFold · AI Science Nobel Laureate John Jumper Leaves DeepMind for Anthropic: What It Means for AI in Science John Jumper, 2024 Nobel Prize in Chemistry laureate and co-creator of AlphaFold, has left Google DeepMind after nine years to join Anthropic. It is the most significant talent move in AI history — and a clear signal about where the next wave of AI value is being built.
2026-06-25 · 8 min read Acurio · citecheck · Open Source From Idea to Product: How We Built Acurio and citecheck The build story behind Acurio and citecheck — two Swiss tools that verify academic citations with evidence, not unreliable AI detectors. An honest practitioner's account from idea to shipped product.
2026-06-24 · 7 min read Context Engineering · Prompt Engineering · LLM Context Engineering: Why Prompt Engineering Is No Longer Enough for Enterprise AI Prompt engineering is a writing skill. Context engineering is an infrastructure discipline. Here is why the shift matters — and how enterprise teams are restructuring their AI pipelines around it in 2026.
2026-06-19 · 11 min read AI Regulation · AI Governance · US AI Policy The Great American AI Act: What US Federal AI Regulation Means for Every Business The US Congress just unveiled a 269-page federal AI bill that would override all state AI laws for three years. Here is what the Great American Artificial Intelligence Act actually proposes — and what it signals for businesses navigating the global AI compliance landscape.
2026-06-18 · 8 min read Next.js · React · TanStack Query useQuery vs useEffect: Refactoring a Next.js Dashboard from Fetch Hooks to TanStack Query A Next.js dashboard built on useState + useEffect + fetch turned into a tangle of races, dead loaders, and stale lists. Migrating to TanStack Query collapsed 100 lines of state plumbing into one useQuery — and fixed the bugs we kept patching.
2026-06-15 · 10 min read AI Agents · Enterprise AI · Production Deployment Why 95% of Enterprise AI Agents Fail to Reach Production Gartner predicts 40% of enterprise applications will include AI agents by end of 2026. Roughly 95% of agent prototypes never reach production. Here is what separates the two groups — and the architecture patterns that actually ship.
2026-06-12 · 9 min read AI Strategy · Apple · iOS 27 Apple WWDC 2026: iOS 27 Extensions End Single-AI Lock-In — What Swiss Businesses Need to Know Apple's WWDC 2026 introduced iOS 27 Extensions, letting iPhone users set Claude, ChatGPT, or Gemini as their default AI. Here's what the new multi-AI paradigm means for Swiss businesses — and why the EU exclusion matters.
2026-06-11 · 8 min read ChatGPT · OpenAI · AI Adoption ChatGPT Hits 1 Billion Users: What It Really Means for Your Business ChatGPT just became the fastest app in history to reach 1 billion monthly active users. Here's what that milestone signals — and what it means for Swiss businesses that are still weighing when to act.
2026-06-11 · 7 min read LLM · JSON · Vertex AI LLM Truncated JSON: The finish_reason Gotcha That Bridges OpenAI and Vertex An LLM truncated JSON response surfaced a cryptic Unterminated string error in production. The fix wasn't bigger max_tokens — it was a finish_reason guard that handles OpenAI's length and Vertex/Gemini's MAX_TOKENS in the same code path.
2026-06-08 · 8 min read AI Agents · Swiss SME · AI Strategy Why AI Agent Pilots Stall in Switzerland — and the Four Decisions That Determine Whether They Scale Fewer than 1 in 4 organisations experimenting with AI agents have scaled one to production. The gap isn't technical. It's four architectural decisions made in the pilot phase that are expensive to undo later.
2026-06-05 · 7 min read RAG · Embeddings · Retrieval Embedding Batch Size: How One Oversized Request Silently Disabled Our RAG Retrieval An embedding batch size bug returned zero vectors on big documents and silently dropped their embeddings, halving retrieval quality. The fix, the backfill, and the lesson.
2026-06-01 · 8 min read AI Agents · Next.js · Approval Gates AI Agent Approval Gates in Next.js: Building a Multi-Step Agent Loop That Knows When to Stop How we built AI agent approval gates into a Next.js app — a real iterative agent loop that autonomously drives multi-step operations but cleanly pauses for human approval on destructive actions.
2026-05-25 · 9 min read FastAPI · slowapi · Rate Limiting FastAPI Rate Limit Headers: The Slowapi Response Parameter Gotcha A FastAPI rate limit headers bug took down rate-limited POST endpoints with 500s. Here's what slowapi's _inject_headers actually requires — and the one-line fix per endpoint.
2026-05-20 · 7 min read
#
AI Citation Verification
AI Citation Verification · Zotero · Academic Research AI Citation Verification for Researchers: How to Catch Hallucinated Sources Before Your Reviewer Does Why AI-drafted papers are leaking fake citations into peer review — and a practical Zotero-based workflow to verify every reference in minutes, not hours.
2026-05-11 · 7 min read AI Agents · Security · SME AI Agent Security for SMEs: What Mythos Means for You AI agent security got real: Claude Mythos found thousands of zero-days in decades-old code. Here's the vault-first playbook for SMEs deploying AI agents.
2026-04-09 · 16 min read Claude Advisor Strategy · LLM Advisor Pattern · AI Agent Cost Optimization The Claude Advisor Strategy: What Practitioners Learned Anthropic just named the advisor strategy: cheap executor, smart advisor. Here's how it works, the cross-vendor version, and when not to use it.
2026-04-09 · 12 min read AI Agents · Security · SME OpenAI Cybersecurity Model: What the Axios Scoop Really Means OpenAI is finalising a restricted cybersecurity model via Trusted Access for Cyber, 48 hours after Anthropic's Mythos. What it means for SMEs with AI agents.
2026-04-09 · 11 min read AI Agents · SME · Switzerland AI Agents for Swiss SMEs: A Practical 90-Day Guide How small and mid-sized Swiss businesses can deploy AI agents that pay for themselves in 90 days — without a data science team.
2026-04-05 · 3 min read ChatGPT · Governance · Compliance The ChatGPT Governance Checklist for Swiss Companies What every Swiss company needs in place before letting employees use ChatGPT at work — data, contracts, training, and audit.
2026-03-22 · 3 min read 