Tanya Janca's DevSecStation episode on secure defaults matches why I built DaloyJS the way I did: security on by default, insecure paths explicit and effortful. Login with JWT is not enough, and telli...

Ponemon interviewed 3,500 people across 602 breached organizations. The global average hit $4.99M, AI-driven attacks are up 56%, and 92% of AI-related breaches lacked basic access controls. Here is th...

The API is frozen and semver starts now. The interesting part of getting here: nine release candidates of live pentesting, where the findings were almost never inside a middleware. They were between t...

The beta said 'nothing changed, on purpose.' The release candidate says 'the door is now locked.' Here is what the RC means, what actually landed across the beta train (spoiler: MCP), and the short ho...

Aikido and Sapio Research surveyed 450 developers, CISOs, and AppSec engineers across Europe and the US. The headline: AI now writes a quarter of production code, 1 in 5 teams had a serious incident b...

After a long 0.x preview line, DaloyJS enters its 1.0.0 beta. The funny part: the most important line in this changelog is that nothing changed. Here is what the beta means, how to install it, and wha...

Part 4: The Full Picture

Part 3: The Developer Experience of DaloyJS

Part 2: How DaloyJS Protects You from Supply-Chain Attacks

Part 1: Built-in Security That Actually Ships

Throw typed errors in DaloyJS and have them serialized as RFC 9457 problem+json responses by default. Customize, extend, and document errors in OpenAPI.

DaloyJS is a secure-by-default TypeScript/JavaScript web framework with portable runtime guardrails and package provenance you can verify on any CI host. It combines FastAPI-grade docs, Hono-style por...

Ten years of shipping fullstack apps, one Filipino dev in Norway, and the framework I kept wishing existed at 2am.