Security and Operations
Edge protection, hardening, multi-tenant email, 2FA and public boundaries before inviting users.
Articles
-
Between June 19 and June 20, Nima Project stopped treating public web surfaces and measurement as the last step and started making them an explicit product contract.
-
2FA before any admin mutation 2026-06-01
Why requiring a second factor for every admin write — not just login — is the correct default for a platform with real users and real data, even when you are the only operator.
-
How a seemingly small app became a real production surface — and the launch invariants that mattered more than its size: one canonical domain, no browser secrets, a non-bypassable origin, correct email branding, verified seed data and written event operations.
-
Multi-tenant transactional email · domains, branding and action links without duplicating services 2026-05-30
How to separate brand, sending domain and product redirect using a shared notifications-api, Resend per tenant and action tokens with metadata.
-
Notes from a conversation with a DevOps/SRE friend about using an edge as a security perimeter before a launch — and why the interesting decision was about sequencing and invariants, not about a feature list.