Field Notes
- Sheet
- N-000
- Set
- Notes
- Status
- Issued
Notes from production engineering.
Write-ups from real work on real systems: what broke, how it was found, and what fixed it. The detail we would want if we were reading someone else's notes.
N-000NotesIssued
Field Notes index
-
The reviewer was wrong about the client IP
An independent AI review, a merged fix, passing tests, and a rate limiter that got weaker. A live probe with forged headers caught what review could not.
-
Row-level security is the first thing we check
Why a Supabase app built with an AI builder can expose its database to a public key, what CVE-2025-48757 showed, and two queries that find it.
-
How we counted 20,900 tests
The commands behind the track record on our home page, where the count is imperfect, and what a big test number does and does not prove.
-
Seven diagrams in parallel, and the two defects only a person caught
How our AI engineering system redrew every diagram on this site for phones in parallel, and the two defects only a person looking at screenshots caught.
-
Our animated drawings burned a CPU core doing nothing
Fourteen animated figures took 25 to 37% of a core, even off screen. How we measured it, the control that found the cause, and the player that took it to zero.
-
The page that shipped uncompressed
Our home page went out as 122 KB of uncompressed HTML from launch until we measured the bytes on the wire. The fix, the tests, and the check that now runs after every deploy.
Want this kind of engineering on your system?
Tell us what you're building. We'll tell you honestly what we'd check first.
Next sheet · N‑101