I build small software, and keep it quiet.
Founder of koative, an independent software studio in İstanbul that ships its own products first. Currently building Lumi: one card, one mood check and one line about the day, on iOS.
TypeScript end to end: React and Next in front, Bun, Express and PocketBase behind. I write about the correctness bugs that never raise an exception.
koative takes on a few client projects a year. Mail me. Replies within 48h.
Featured
Three bugs, one root cause: the label was not the identity
A rendering layer derives a human label from a machine identity. Both are strings. The type checker has nothing to say and the money path does.
Math.floor is not a floor
The obvious fix drops a step. The clever fix rounds past the input. Neither raises an exception, and only one of them spends money you don't have.
Recent Posts
Your LLM can't hallucinate a number it was never given
Anti-hallucination gets written as a prompt rule. It belongs in the code that builds the prompt, and the sharpest version of it is one line long.
Cache the prompt, not the inputs
The key listed the inputs someone believed mattered. The prompt had grown three fields since, and nothing in the system could have noticed.
The endpoint that succeeded at doing nothing
Correct status code, clean logs, zero exceptions, wrong data. What happens to the promise you deliberately didn't await.
I put a signing key in the browser on purpose
What that buys, split by what the attacker can already do, and why the property that actually protects the user is not in my code at all.