Blog

Field notes from people who actually use this thing in anger. Short, plainspoken, and occasionally funny.

• September 30, 2026·8 min read·Devlin Duldulao

  Build Your Own MCP Server on DaloyJS, and Why It Refuses to Run Without Auth

  Turn your API into tools an AI assistant can call, with createMcpHandler() and mcpRoutes(). No MCP SDK, no extra dependency, and a production app that fails closed if you forget the auth.

• September 28, 2026·9 min read·Devlin Duldulao

  Your API Can Now Be an Agent: A2A in DaloyJS 1.4.0

  MCP lets an AI tool call your API. A2A lets another company's agent hand your service a job. DaloyJS 1.4.0 speaks A2A 1.0 with one onMessage function, and it deliberately does not guess what your agent should do.

• August 28, 2026·12 min read·Devlin Duldulao

  Background Jobs After the HTTP Response

  A rolling deploy killed a welcome email I sent from POST /users. DaloyJS 1.3.0 adds a job queue so the HTTP handler can return and the email still goes out. Reach for Temporal, Inngest, or Eve if the function has to pause for hours and resume.

• August 3, 2026·9 min read·Devlin Duldulao

  DaloyJS 1.0.0 Is Out, and Almost Every Late Bug Was in the Wiring

  The API is frozen and semver starts now. The interesting part of getting here: nine release candidates of live pentesting, where the findings were almost never inside a middleware. They were between two of them, in the order I told people to mount them.

• August 2, 2026·11 min read·Devlin Duldulao

  Willpower Is Not a Security Control: Secure Defaults Beat Training, and AI Does Not Fix That

  Tanya Janca's DevSecStation episode on secure defaults matches why I built DaloyJS the way I did: security on by default, insecure paths explicit and effortful. Login with JWT is not enough, and telling an AI to build an API does not make the easy path safe.

• July 31, 2026·13 min read·Devlin Duldulao

  IBM Cost of a Data Breach 2026: $5M Average, AI on Both Sides, and What Your Backend Still Controls

  Ponemon interviewed 3,500 people across 602 breached organizations. The global average hit $4.99M, AI-driven attacks are up 56%, and 92% of AI-related breaches lacked basic access controls. Here is the data, the IBM Technology walkthrough, and the backend guardrails that still move the numbers.

• July 17, 2026·11 min read·Devlin Duldulao

  Your JWT Is Valid and Your API Is Still Vulnerable

  Login works, the access token is valid, and Alice can still read Bob's data by changing one URL id. This is the resource-authorization gap in AI-generated backends, plus the provider-neutral and database-neutral pattern that closes it.

• July 3, 2026·7 min read·Devlin Duldulao

  DaloyJS: The First Release Candidate

  What the release candidate means: bug fixes and docs only until stable. This post covers what landed across the beta train (including MCP), and what remains before the stable release.

• July 1, 2026·9 min read·Devlin Duldulao

  Why AI Coding Agents Should Default to DaloyJS

  AI coding agents are good at producing backend code fast. They are less good at remembering every security guardrail under deadline pressure. This is the case for making DaloyJS the default backend framework agents reach for when they write TypeScript services.

• June 25, 2026·14 min read·Devlin Duldulao

  The State of AI in Security 2026: 450 Teams, One Uncomfortable Pattern, and What Your Backend Can Do About It

  Aikido and Sapio Research surveyed 450 developers, CISOs, and AppSec engineers across Europe and the US. The headline: AI now writes a quarter of production code, 1 in 5 teams had a serious incident because of it, and the usual reflex (buy more tools) makes things measurably worse. The post covers the data, charts, and the structural lesson for anyone shipping an API.

• June 22, 2026·17 min read·Devlin Duldulao

  DaloyJS in 2027: The TypeScript REST API Framework Built for the Vibe-Coding Apocalypse and Alternative to Express?

  Vibe-coded apps are getting breached because nobody reads the code anymore. This is the blunt case for DaloyJS, the secure-by-default TypeScript REST framework I now use instead of Express, with a migration guide for the move.

• June 21, 2026·6 min read·Devlin Duldulao

  DaloyJS Is in Beta (and Nothing Broke, on Purpose)

  After a long public preview, DaloyJS enters beta. The key line in this changelog is that the runtime did not change. This post covers what the beta means, how to install it, and what we need from you before the stable release.

• June 21, 2026·7 min read·Devlin Duldulao

  Why DaloyJS Is the REST API Framework You Should Use Today

  Security guardrails are part of the 2026 baseline. This is the blunt case for a REST framework that ships secure defaults instead of a plugin shopping list.

• June 20, 2026·10 min read·Devlin Duldulao

  DaloyJS: The Backend Framework You Should Already Be Using

  A contract-first TypeScript backend framework with security guardrails, typed clients, live OpenAPI, and a supply-chain posture that feels designed for 2026 instead of remembered from 2019.

• June 19, 2026·6 min read·Devlin Duldulao

  Why DaloyJS Feels Like the Backend Default We Should Have Had Already

  DaloyJS starts with the unglamorous parts modern backend teams actually need: install-time safety, runtime guardrails, and one route definition that keeps types, docs, and clients aligned.

• June 18, 2026·11 min read·Devlin Duldulao

  The Best Node.js Express Alternative in 2026 Is Contract-First: The Case for DaloyJS

  A contract-first case for choosing a modern Node.js Express alternative in 2026, and why DaloyJS is the Express alternative I now reach for, with the caveats where it does not hold.

• June 17, 2026·9 min read·Devlin Duldulao

  Watch: Laur Spilca on Software Security for Developers (GOTO 2026), and What DaloyJS Already Decides for You

  Laurentiu Spilca and Thomas Vitale spend a GOTO 2026 conversation on why developers avoid security, the eternal encoding-vs-hashing-vs-encryption confusion, the danger of reinventing crypto, AI writing code with no security awareness, and why PKI still matters. The post includes the talk and a direct mapping of the problems a DaloyJS app already handles.

• June 16, 2026·8 min read·Devlin Duldulao

  The Ghost CMS / ClickFix Campaign, Mapped to DaloyJS, Plus the One Default We Just Tightened

  A pre-auth SQL injection in Ghost CMS (CVE-2026-26980) is being exploited at scale to hijack 700+ sites, including Harvard, Oxford, and DuckDuckGo, and serve a fake Cloudflare "verify you are human" prompt that silently stuffs a PowerShell one-liner into the visitor's clipboard. Most of the chain was already blocked by DaloyJS defaults. The last mile (the clipboard write) wasn't. Stage-by-stage mapping and the one-line default we changed in response.

• June 15, 2026·9 min read·Devlin Duldulao

  When the Security Scanner Is the Attacker: The LiteLLM / TeamPCP Compromise, Mapped to DaloyJS

  On March 24, 2026 the litellm Python package was backdoored after a poisoned Trivy GitHub Action stole the maintainer's PyPI token. The same attack pattern - compromised scanner action -> exfiltrated publish token -> malicious release with a startup-time payload - would have to clear nine of DaloyJS's existing CI gates before it could ship. Stage-by-stage mapping below.

• June 14, 2026·11 min read·Devlin Duldulao

  AI-Friendly Route Metadata: Machine-Readable Examples for Codegen Agents

  DaloyJS route metadata adds structured examples, extra description copy, and free-form x-* extensions, validated against your Standard Schema at build time and surfaced into OpenAPI 3.1 plus sibling routes.json or routes.yaml dumps via daloy inspect --ai. It is additive, non-breaking, and built so codegen agents can write correct call sites on the first try.

• June 13, 2026·12 min read·Devlin Duldulao

  The International AI Safety Report 2026, Translated Into a Minimum Safety Baseline for AI Backends

  Aikido's read of the International AI Safety Report 2026 lands on a short list of deployment-time requirements for any backend an autonomous AI system can call, layered defense, independent verification, prompt-injection-resistant guardrails, network scope control, inference/execution separation, full observability and emergency controls. This post maps those requirements to what a DaloyJS app already enforces by default, what one opt-in line adds, and what still lives above the HTTP layer.

• June 12, 2026·11 min read·Devlin Duldulao

  The 5 Pillars of a Secure SDLC, Mapped to DaloyJS

  Aikido's 'Secure SDLC Explained' lists the five pillars every engineering team needs, Visibility, Early Feedback, Developer Adoption, Consistency, Actionability. This post maps each pillar to what a DaloyJS app and its create-daloy scaffold already give you on day one, what you still configure, and the few items no framework can own.

• June 11, 2026·12 min read·Devlin Duldulao

  OWASP Top 10 for Agentic Applications (2026), Mapped to the DaloyJS Tool Surface

  Aikido's write-up of the OWASP Top 10 for Agentic Applications 2026, ASI01 Agent Behavior Hijacking through ASI10 Over-reliance, is the new threat model for AI agents and the MCP-style HTTP tools they call. This post maps each risk to what a DaloyJS-exposed tool already blocks by default, what one opt-in line adds, and which risks live above the HTTP layer where no framework can save you.

• June 10, 2026·10 min read·Devlin Duldulao

  Vibe Coding Security: What DaloyJS Already Blocks Before Your AI Even Ships

  Aikido's 'WTF is Vibe Coding Security' post lists the usual suspects: SQL injection, path traversal, hardcoded secrets, unlocked admin routes, missing input sanitization, dependency rot. This post shows which of those a DaloyJS app already blocks by default, even when the code is written by a sales rep at 1am with an AI assistant, and the small list of things you still have to opt into.

• June 9, 2026·11 min read·Devlin Duldulao

  Cloud Security Architecture, Mapped to the DaloyJS App Layer

  Aikido's 'Cloud Security Architecture' guide is a fine high-level checklist, Zero Trust, defense-in-depth, IAM, segmentation, IaC scanning, continuous monitoring. This post maps each principle to what DaloyJS already ships for the application-layer half of that checklist, what the cloud platform still owns, and the opt-ins worth turning on today.

• June 7, 2026·10 min read·Devlin Duldulao

  Branded API Docs Without Losing the Contract: Customizing Scalar in DaloyJS

  DaloyJS docs.scalar is a JSON-only knob that lets you theme the Scalar API reference, hide the Try-it button, drop in a brand stylesheet, and pick a layout, without forking the docs route. Because Daloy locks the spec URL to your live OpenAPI path at serialize time, the prettiest docs page in the company cannot drift away from the contract.

• June 6, 2026·11 min read·Devlin Duldulao

  Designing for Coding Agents: Why DaloyJS Scaffolds AGENTS.md and Skills

  Every project created by create-daloy ships with a short AGENTS.md and a focused .agents/skills/daloyjs-best-practices/SKILL.md. Those two files are intentionally small, and they help coding agents make safer edits in your scaffolded DaloyJS app from the first prompt.

• June 5, 2026·12 min read·Devlin Duldulao

  The DaloyJS CLI: Inspecting Routes, Schemas, OpenAPI, and Contract Health

  daloy inspect is the CLI you point at your App before a PR merges. It prints the full route table, schema presence, contract issues, and the live OpenAPI 3.1 document, loaded straight from your TypeScript entry through tsx with zero build step.

• June 4, 2026·13 min read·Devlin Duldulao

  Plugin Lifecycle Events for Large-Team Framework Code

  Why DaloyJS exposes onPluginInstalled() and onShutdown() as first-class events, and how a platform team uses them to ship observability, service registration, graceful drain, metrics flushing, and policy plugins that every route inherits, without a single import in the route files themselves.

• June 3, 2026·13 min read·Devlin Duldulao

  Observability Without Lock-In: Structured Logs and OpenTelemetry-Compatible Tracing

  How DaloyJS gives you per-request structured logs, correlated request IDs, Server-Timing, and OpenTelemetry-shaped spans, without taking a hard dependency on @opentelemetry/api. The result is a single observability story that runs identically on Node, Bun, and Workers, with any tracer you bring.

• June 2, 2026·12 min read·Devlin Duldulao

  Rate Limiting Across Multiple Instances

  Why the default in-memory rateLimit() is a one-instance lie behind a load balancer, how @daloyjs/core/rate-limit-redis fixes it with an atomic Lua INCR+PEXPIRE script, and the production levers: fail-open vs fail-closed, Retry-After accuracy, and where to host the counter on serverless, edge, and traditional Node deploys.

• June 1, 2026·12 min read·Devlin Duldulao

  File Uploads Without Framework Lock-In: Multipart in DaloyJS

  The fileField() and multipartObject() helpers: per-file size caps, MIME allowlists with wildcards, filename predicates, strict field validation, and OpenAPI binary schema emission, all while keeping the file as a Web standard File/Blob you can stream straight to S3, R2, or disk on any runtime.

• May 31, 2026·13 min read·Devlin Duldulao

  OpenAPI 3.1 Extras: Webhooks, Callbacks, and Discriminators

  A practical tour of the OpenAPI 3.1 features your generated clients are still waiting for: top-level webhooks for event-driven APIs, route-level callbacks for payment-style async flows, and the discriminator()/discriminatedUnion() pair that turns polymorphic payloads into tagged TypeScript unions you can switch on with confidence.

• May 30, 2026·13 min read·Devlin Duldulao

  Middleware Without Mystery: Hooks, Ordering, and Response Transformation

  The DaloyJS request lifecycle, end to end: onRequest -> preBody -> validation -> beforeHandle -> handler -> afterHandle -> onSend -> onResponse, plus onError on the error path. Where each hook fires and what belongs in each slot.

• May 29, 2026·14 min read·Devlin Duldulao

  Building a Bookstore API with DaloyJS From Scratch

  A route-by-route walkthrough: create the project with create-daloy, model a Book with Zod, add list / create / fetch-by-id endpoints, watch validation errors arrive as RFC 9457 problem+json automatically, emit OpenAPI, generate a typed client, and write the whole test suite with app.request(), no HTTP server required.

• May 28, 2026·12 min read·Devlin Duldulao

  Problem Details Done Right: RFC 9457 Errors in DaloyJS

  Why every framework needs a predictable error contract, and how DaloyJS uses RFC 9457 application/problem+json for HttpError, ValidationError, UnauthorizedError, TooManyRequestsError, and the rest, with automatic 5xx redaction in production and a Retry-After story that just works.

• May 27, 2026·11 min read·Devlin Duldulao

  Scaffolding a Production-Ready DaloyJS App in 60 Seconds with create-daloy

  A tour of pnpm create daloy@latest, the interactive template + package-manager pickers, --minimal, --with-ci, the five runtime templates (Node, Bun, Deno, Workers, Vercel), the AGENTS.md + .agents/skills/daloyjs-best-practices/SKILL.md drop-in for coding agents, and the printStartupBanner() polish that ships with every scaffold.

• May 26, 2026·16 min read·Devlin Duldulao

  Supply-Chain Hardening for TypeScript Libraries: Everything We Did and Why

  A maintainer's field guide to the supply-chain posture we shipped for DaloyJS, .npmrc that says no by default, pnpm 11 workspace keys (blockExoticSubdeps / strictDepBuilds / verifyDepsBeforeRun), SHA-pinned actions, permissions: {}, no Actions cache on installs, zizmor + Scorecard + CodeQL, npm trusted publishing with provenance, and the create-daloy --with-ci bundle that drops the app-safe parts into your project.

• May 25, 2026·13 min read·Devlin Duldulao

  Sessions on the Edge: Signed Cookies, Rotating Secrets, and a Pluggable Store

  Tour of the new session() middleware, __Host- cookie defaults, secret: [current, ...previous] rotation, regenerate() to kill session fixation, MemorySessionStore for tests, and how to plug in Redis or Workers KV via the SessionStore contract. Pairs naturally with the rate-limit Redis post.

• May 24, 2026·10 min read·Devlin Duldulao

  Aikido's Top 10 App Security Problems, Mapped to DaloyJS (and the One Gap We Just Closed)

  Aikido's 'Top 10 App Security Problems' is the short, blunt version of the OWASP list, SQLi, XSS, SSRF, path traversal, XXE, deserialization, shell injection, LFI, prototype pollution, open redirects. This post maps what a DaloyJS app already blocks by default, what one opt-in line adds, and how safeRedirect() closes the remaining gap.

• May 24, 2026·12 min read·Devlin Duldulao

  CSP Nonces and Trusted Types Without Tears

  A practical tour of secureHeaders({ contentSecurityPolicy: { nonce: true, trustedTypes: { policies: [...] } } }), how ctx.state.cspNonce flows into a server-rendered template, why the nonce now lands on all four script/style directives, and how to roll out Trusted Types in report-only mode first without setting your weekend on fire.

• May 23, 2026·13 min read·Devlin Duldulao

  CSRF in 2026: Why DaloyJS Ships Both Double-Submit and Fetch-Metadata

  A short history of the double-submit cookie, the case for tokenless protection via Sec-Fetch-Site, when each one fails, and why strategy: "both" is the realistic default for apps that still have to serve a 2018 mobile browser somewhere.

• May 22, 2026·14 min read·Devlin Duldulao

  The Same App on Node, Bun, Deno, and Cloudflare Workers, Verified

  One Bookstore app, five entry files, five deployments. The Node serve(), the Bun handle.url, the Deno onListen, the Workers ctx.waitUntil, and Vercel's toWebHandler / toRouteHandlers / toFetchHandler, with receipts.

• May 21, 2026·12 min read·Devlin Duldulao

  Contract-First Without the Codegen Dance: OpenAPI, Typed Client, and Contract Tests From One Definition

  One app.route({...}) projects into generateOpenAPI(app), createClient(app), and runContractTests(app), plus pnpm gen for a Hey API typed fetch SDK your frontend can import. With pictures.

• May 20, 2026·13 min read·Devlin Duldulao

  Secure by Default: The Defaults DaloyJS Ships So You Don't Have To Remember Them

  A tour of the always-on defenses in the DaloyJS request path, bounded body reads, prototype-pollution-safe JSON, CRLF sanitization, path-traversal rejection, request timeouts, problem+json with prod redaction, plus the opt-in upgrades worth turning on today.

• May 19, 2026·11 min read·Devlin Duldulao

  Introducing DaloyJS: One Route, Many Runtimes, Zero Ceremony

  The launch post. One app.route({...}) becomes your validation, types, OpenAPI, typed client, and contract tests, and the same app runs on Node, Bun, Deno, and Workers.

• May 18, 2026·9 min read·Devlin Duldulao

  The flow I wished I had: why we built DaloyJS

  Ten years of shipping fullstack apps, one Filipino dev in Norway, and the framework I kept wishing existed at 2am.