https://alekpopovic.github.io/feed.xml2026-10-10T00:00:00+00:00https://alekpopovic.github.io/posts/your-access-log-does-not-need-that-token/2026-10-10T00:00:00+00:00

Useful security observations start with a deliberate field list, before credentials and visitor data spread through the pipeline.

Aleksandar Popovichttps://alekpopovic.github.io/posts/watch-the-age-of-the-queue/2026-10-10T00:00:00+00:00

A healthy process and a short queue can still hide stale security decisions. Measure the delay an operator needs to act on.

Aleksandar Popovichttps://alekpopovic.github.io/posts/the-webhook-reply-you-send-too-early/2026-10-10T00:00:00+00:00

Returning success before an event is durable leaves a small failure window with a very expensive consequence.

Aleksandar Popovichttps://alekpopovic.github.io/posts/reserve-capacity-before-starting-work/2026-10-10T00:00:00+00:00

A concurrency quota needs a durable reservation before dispatch, plus a recovery policy for allocations whose outcome is unknown.

Aleksandar Popovichttps://alekpopovic.github.io/posts/ready-needs-to-match-the-generation/2026-10-10T00:00:00+00:00

A deployment gate must distinguish a current validation result from a positive condition left by an earlier specification.

Aleksandar Popovichttps://alekpopovic.github.io/posts/logs-should-tell-you-what-went-missing/2026-10-10T00:00:00+00:00

A reconnecting log stream needs ordering, ownership, and an honest answer when the missing bytes are no longer available.

Aleksandar Popovichttps://alekpopovic.github.io/posts/github-copilot-slash-commands/2026-10-10T00:00:00+00:00

The commands in GitHub’s VS Code cheat sheet, practical prompts for fixing code and writing tests, and how to check commands supplied by extensions.

Aleksandar Popovichttps://alekpopovic.github.io/posts/gemini-cli-slash-commands/2026-10-10T00:00:00+00:00

The documented Gemini CLI command families and their subcommands, with a practical way to inspect project context before changing code.

Aleksandar Popovichttps://alekpopovic.github.io/posts/cursor-slash-commands/2026-10-10T00:00:00+00:00

A complete snapshot of the documented Cursor CLI command families, including aliases, with a small workflow for investigating a UI bug.

Aleksandar Popovichttps://alekpopovic.github.io/posts/codex-slash-commands/2026-10-10T00:00:00+00:00

The documented Codex CLI menu, grouped by task, plus a practical plan, inspect, and review loop for a real code change.

Aleksandar Popovichttps://alekpopovic.github.io/posts/claude-code-slash-commands/2026-10-10T00:00:00+00:00

Navigate Claude Code’s documented commands, aliases, bundled skills, and retired entries without confusing the terminal with Claude web chat.

Aleksandar Popovichttps://alekpopovic.github.io/posts/chatgpt-slash-commands/2026-10-10T00:00:00+00:00

A complete snapshot of the documented desktop command menu, with a clear distinction between ChatGPT web, desktop actions, and custom shortcuts.

Aleksandar Popovichttps://alekpopovic.github.io/posts/cancel-is-a-request-not-an-outcome/2026-10-10T00:00:00+00:00

A useful deployment history records when cancellation was requested and what the running operation actually did.

Aleksandar Popovichttps://alekpopovic.github.io/posts/before-blocking-an-ip-trace-the-proxies/2026-10-10T00:00:00+00:00

An address becomes a useful enforcement identity only after the ingress path and forwarding-header trust are clear.

Aleksandar Popovichttps://alekpopovic.github.io/posts/an-approximate-marker-needs-an-approximate-payload/2026-10-10T00:00:00+00:00

Location privacy belongs in the server's public projection, covering snapshots, live deltas, expiry, and revocation rather than only the marker shown on a map.

Aleksandar Popovichttps://alekpopovic.github.io/posts/an-approval-belongs-to-one-action/2026-10-10T00:00:00+00:00

Bind a human decision to the exact tool call, then preserve that identity through retries and uncertain results.

Aleksandar Popovichttps://alekpopovic.github.io/posts/ai-changes-need-a-verification-loop/2026-10-10T00:00:00+00:00

Turn a broad AI request into a small, observable change: define the behavior, inspect the diff, test the boundary, and record the evidence.

Aleksandar Popovichttps://alekpopovic.github.io/posts/accepted-should-mean-committed/2026-10-10T00:00:00+00:00

An ingestion response is a promise about durable observations, including the awkward case where the commit succeeds and the reply disappears.

Aleksandar Popovichttps://alekpopovic.github.io/posts/a-validation-result-can-reveal-a-secret/2026-10-10T00:00:00+00:00

Removing secret values from logs does not stop an untrusted rule author from learning through repeated pass/fail answers.

Aleksandar Popovichttps://alekpopovic.github.io/posts/a-valid-signature-is-only-the-first-gate/2026-10-10T00:00:00+00:00

Authenticating a policy's bytes does not make every authenticated policy appropriate for the receiving agent.

Aleksandar Popovichttps://alekpopovic.github.io/posts/a-useful-ai-handoff/2026-10-10T00:00:00+00:00

A practical context brief for moving a task between conversations or tools without losing decisions, evidence, and the next useful step.

Aleksandar Popovichttps://alekpopovic.github.io/posts/a-timeout-is-not-a-stopped-deployment/2026-10-10T00:00:00+00:00

A missing heartbeat changes what you know about a runner. It does not tell you what happened on the deployment target.

Aleksandar Popovichttps://alekpopovic.github.io/posts/a-slow-map-should-not-hold-the-stream-hostage/2026-10-10T00:00:00+00:00

Bound each WebSocket client's queue, coalesce replaceable marker updates, and give critical events a recoverable path when a browser cannot keep up.

Aleksandar Popovichttps://alekpopovic.github.io/posts/a-secret-update-is-not-proof-of-rotation/2026-10-10T00:00:00+00:00

Object versions, credential validity and workload adoption describe different events. A restart policy needs to say which one it observes.

Aleksandar Popovichttps://alekpopovic.github.io/posts/a-lost-reply-should-not-erase-a-location/2026-10-10T00:00:00+00:00

A mobile location queue needs stable point identities and explicit acknowledgements, especially when retries regroup the same observations into different batches.

Aleksandar Popovichttps://alekpopovic.github.io/posts/a-foreign-key-can-cross-a-tenant-boundary/2026-10-10T00:00:00+00:00

A valid project ID proves existence. A scoped reference also proves that the project belongs to the right organization.

Aleksandar Popovichttps://alekpopovic.github.io/posts/a-fast-cache-is-not-a-release-artifact/2026-10-10T00:00:00+00:00

Build speed and release identity solve different problems. Keeping them separate makes the pipeline easier to trust.

Aleksandar Popovichttps://alekpopovic.github.io/posts/a-cron-tick-needs-an-identity/2026-10-10T00:00:00+00:00

Schedulers become easier to recover when an intended occurrence is durable data rather than a timer callback.

Aleksandar Popovichttps://alekpopovic.github.io/posts/a-ban-should-expire-during-an-outage/2026-10-10T00:00:00+00:00

The edge needs enough local time and policy state to end a temporary restriction without waiting for the central server.

Aleksandar Popovic