· payments
PayPal in Sri Lanka 2026: A Freelancer's Guide to What Works
PayPal in Sri Lanka is live for receiving from abroad via Sampath and ComBank. Here is how to set it up, what it costs, and how it compares.
Blog
Notes from building software
Guides and write-ups on mobile apps, web & SaaS, AI integrations, APIs, payments and shipping to production.
· security
Claude Code Extension Backdoor: Check and Clean Up
Malicious Claude Code extension 2.1.312/2.1.313 hit Cursor marketplace on 29 Oct. Check svc-telemetry, run Cursor scripts, rotate keys.
· security
Supabase RLS Explained: Grants, Policies, Safegres Audit
Learn supabase rls: how Postgres grants differ from RLS after Oct 30 2026, auth.uid() policies, and CI audits with Safegres 1.30.7.
· ai-agents
Langflow 1.13.0 Security Upgrade: Patch Critical CVEs
Langflow OSS 1.0.0-1.12.8 needs 1.13.0 for four CVEs including unauth RCE via MCP; IBM lists no workaround.
· security
Pydantic AI 2.66 Security Upgrade: Patch 10 Advisories
Pydantic AI 2.66.0 patches 10 advisories (2 High). Upgrade paths for 2.x, 1.x and harness, plus rotate guidance.
· ai
Microsoft Agent Framework Guide: Agents, Harness, Workflows
A practical guide to Microsoft Agent Framework: Agents vs Harness vs Workflows, Python and .NET get-started, and the new 4 Nov builder skills.
· flutter
Firebase App Check in Flutter: Play Integrity and App Attest
Set up Firebase App Check in Flutter with the firebase_app_check 0.5 API, Play Integrity and App Attest, then verify tokens on your own Node backend.
· security
Next.js Security Release November 2026: Upgrade to 16.4.5
Next.js 16.4.5 and 15.5.29 fix seven vulnerabilities in use cache, Edge cookies, image optimization and self-hosting. Here's who is affected and how to patch.
· ai-agents
Claude Code Mods: What They Are and How to Write One
Claude Code mods let a plugin rewrite prompts, guard tool calls and draw UI. What they are, how they differ from hooks and skills, and a tested example.
· ai-agents
DeepSeek Harness Superagent: Self-Hosted GitHub Coding Agent
DeepSeek Harness now has dsh-superagent, a self-hosted agent that turns GitHub requests into pull requests. How it works, how to install it, and the risks.
· security
FastMCP Vulnerability CVE-2026-120338: Check and Fix Prefab UI
A CVSS 10.0 FastMCP vulnerability in prefab-ui lets Generative UI code read and write host files. Check your versions, upgrade and look for planted .pth files.
· ai
Gemini Computer Use API: Build a Safe Browser Agent
Gemini Computer Use is now GA. Build a tested Python and Playwright agent with safety confirmation, a domain allowlist and a realistic cost estimate.