Our Blog
Explore our blog posts on web design, development, and digital marketing to stay up-to-date with the latest trends and strategies.
Found 83 blog posts
Environment Variables in Next.js: Build-Time Inlining, Real Leak Paths, and Failing the Build with Zod
A NEXT_PUBLIC_ variable is not read at runtime — Next.js inlines it into the bundle at build time. Our field notes on the three ways this bites production apps: stale values that survive redeploys, the real paths a server secret takes to the browser, and a Zod schema that fails the build instead of the first request.
Webhooks in the Next.js App Router: Raw Bodies, Signature Verification, and Returning 200 Fast
A webhook signature is an HMAC over the raw request bytes, so parsing the body before verifying destroys the evidence. Our field notes from wiring payment and Git webhooks into the Next.js App Router: req.text(), constant-time comparison, acknowledging fast, and idempotent processing.
next/image in Next.js 16: What Is Not Automatic About Image Optimization
Using next/image is not the same as having fast images. The component lazy-loads every image it renders unless you pass priority, and a wrong sizes prop makes a 400-pixel card download the 3840-pixel candidate. We collected the parts our team has to configure by hand.
Rate Limiting in the Next.js App Router: What Breaks on Serverless and How We Fix It
An in-memory rate limiter is wrong on serverless because every function instance keeps its own counter. We walk through where the counter belongs, how to derive a trustworthy client identity, and why a Next.js Server Action needs its limit inside the action body.
File Uploads in the Next.js App Router: Our Field Notes on Vercel Blob, Client Uploads, and the Callback That Never Fires on localhost
A Vercel Blob client upload sends bytes straight from the browser to storage and never routes them through a Next.js function, which is why it handles files a route handler cannot. The cost is that the database row is written by a server-to-server callback named onUploadCompleted, and that callback never reaches localhost.
Web Push in the Next.js App Router: How We Ship Service Workers, VAPID, and iOS-Safe Permission Flows
Web Push is a browser API that delivers a server-sent notification to a device while the site is closed. We break down the three parts a Next.js App Router project needs — a service worker at the origin root, a VAPID key pair, and a Node.js-runtime route handler — plus the iOS Home Screen rule that silently blocks everything else.
Content Security Policy in the Next.js App Router: Nonces, strict-dynamic, and the Static-Rendering Trade-Off
At Devya we rolled a nonce-based Content Security Policy across our Next.js App Router applications. A per-request nonce plus 'strict-dynamic' is the only script policy that survives the framework's runtime chunk loading — and it quietly converts static routes into dynamic ones. These are our field notes on the trade-off and how we scoped it.
Passkeys in Production: What We Learned Shipping WebAuthn, Conditional UI, and RP ID Rules
A passkey is a WebAuthn credential permanently bound to one Relying Party ID. Our team traced almost every passkey bug back to three details: the RP ID matching rules, using an email as user.id, and expecting the browser autofill prompt without conditional mediation. These are our field notes from shipping passkeys on Next.js.
Modern CSS Replaced Our Layout JavaScript: Container Queries, :has(), and Subgrid in Production
Container queries, :has(), subgrid, and cascade layers let our team delete most of the layout JavaScript we used to ship — ResizeObserver wrappers, parent-class toggles, and height-measuring passes. Here is what each feature replaces, and the two we still treat as progressive enhancement.
Background Jobs on Vercel in 2026: How We Choose Between waitUntil, Queues, Workflow, and Cron
Serverless did not kill background work — it killed background work that outlives the response without telling the runtime. We break down the four deferred-execution primitives our team uses on Vercel, the failure each one tolerates, and the idempotency contract that at-least-once delivery forces on every consumer.
Running AI-Generated Code Safely: What We Learned Wiring Up Vercel Sandbox
Letting a model write and run its own code is a real product feature now, and it comes with a real threat model. Here's how we isolate that execution with Vercel Sandbox instead of running it inside our own Functions.
Testing Without Jest: How We Use the Native Node.js Test Runner
Node.js ships a built-in test runner that needs no dependencies and no config. How our team uses node:test, node:assert, and built-in mocking, runs TypeScript tests with no build step, and where we still keep Vitest.
Stay Updated
Subscribe to our newsletter for the latest insights on web design, development, and digital marketing.