Blog | Acetrum Technologies

Editorial illustration of a dark navy network of connected automation nodes with a single node glowing amber at a breach point

Web Development

n8n Security in 2026: The Dangerous Surface Is the Editor, Not the Webhook

196 advisories, 22 of them critical, one CVSS 10.0 that needed no login, and 321 live instances still accepting tokens leaked to public GitHub. Everyone hardens the webhook. Almost every 2026 n8n bug needs an authenticated editor instead — which is a shell on the host and every credential you have stored.

16 Sept 2026 · 16 min read

Flat vector illustration of one large ambiguous shape separating into five distinct smaller objects on a pale ground

Web Development

Temporal in Node 26: The Bug Was Never Date, It Was Calling a Calendar Day an Instant

Temporal is on by default in Node 26 and the obvious move is a codemod. Don't. The unit of this migration is the database column, not the call site — and until you can say which of the five things Date was doing each column meant, a better API just gives you a more precise wrong answer.

16 Sept 2026 · 11 min read

Flat vector illustration of two sealed parcels approaching a checkpoint gate, one passing through and one held at the barrier

Mobile Development

Developer Verification: A Signed APK Stopped Being Enough to Install

Verification is not an account-admin chore. It puts a legal entity, a package name and a signing key on the install path, and most agency portfolios cannot name all three for every app they maintain.

14 Sept 2026 · 9 min read

Isometric illustration of a central database cylinder feeding four pipes out to laptops and phones, each pipe passing through a filter gate that lets only some data through

Web Development

Electric vs Zero vs PowerSync vs Convex: The Hard Part Was Never Sync, It Was Row-Level Auth

We've put four sync engines in front of client databases this year. The offline demo took a day in every one of them. What took eleven weeks was answering which rows a given user is allowed to keep on their device — and what happens to that copy when the answer changes.

13 Sept 2026 · 10 min read

Editorial photograph of two identical blank cardboard parcels on a steel dispatch counter under one overhead lamp, one cut open and one still sealed

Web Development

Order Editing: The API Didn't Update the Order, It Replaced It

Editing a placed order looks like a CRUD feature and is implemented as an order replacement: new order created, original canceled, two identities for one customer intent. Everything you integrated with is about to find out separately.

12 Sept 2026 · 9 min read

Editorial photograph of a warehouse floor marked with three parallel painted lines in worn yellow paint, a loaded pallet stopped behind the first line

Web Development

Baseline in CI: The Support Matrix Was Documentation, Not a Gate

Every agency keeps a browser support spreadsheet and nobody has ever been stopped by one. Lighthouse now classifies the features in a build into three interoperability states, which is the first version of this that can fail a pipeline.

10 Sept 2026 · 8 min read

Editorial photograph of a row of brass key hooks on a worn wooden board in a hotel back office, most hooks empty and three holding tags on cords

AI Development

Async Tool Calls: The Provider Stopped Waiting, Your Job Table Doesn't Exist

The API will now hold a call_id open while your tool takes four minutes. It will not run the job, retry it, or tell you it finished. That part was always yours — it was just hidden behind a timeout.

09 Sept 2026 · 10 min read

Editorial photograph of a long corridor of identical closed doors with only the first one lit from inside

Web Development

Soft Navigations: Your LCP Describes One Route Out of Thirty-Five

The vitals were green and the client's team kept a spreadsheet called "slow screens" with eleven entries on it. Both were accurate. Document-scoped metrics stop counting the moment your router takes over, and until this summer the browser had nothing to say about what happened next.

07 Sept 2026 · 8 min read

Editorial photograph of a long timber beam spanning a gap between two stone piers, with several short offcuts stacked underneath it

AI Development

GenAI Telemetry: Instrument the Turn, Not the Model Call

The OpenTelemetry GenAI conventions give you a vocabulary. They do not give you a span tree. Most LLM products we audit have thousands of perfectly attributed model-call spans and nothing that covers the thing a user is actually waiting for.

04 Sept 2026 · 9 min read

Editorial photograph of a heavy industrial knife switch mounted on a grey wall panel, thrown to the off position

AI Development

Spend Caps: The 429 You Asked For Is Still an Outage

Enforceable spend limits moved LLM cost control out of the billing dashboard and into the production failure path. A cap with no degradation behind it does not save money — it just decides, on your behalf, that the feature customers pay for stops working at 4pm on a Tuesday.

02 Sept 2026 · 8 min read

Editorial photograph of a long row of identical steel lockers with one door standing open

Web Development

Workers Cache: The Hit Happens Before Your Auth Code Runs

Cloudflare's Workers Cache sits in front of the Worker, so a hit is served without your handler ever executing. Zero CPU is the selling point and also the whole problem: it is proof your authorization code did not run. Here's how we structure a cached multi-tenant app now.

01 Sept 2026 · 8 min read

Isometric illustration of an assembly line where one station stands idle behind a closed gate while parcels continue past it untouched

Web Development

npm 12: Pinning to 11 Is Not a Rollback, It's a Deferred Migration

Three install-time defaults flipped, and only two of them fail loudly. The third one lets your install succeed with a package that is present, correct in the lockfile, and missing the binary it needed — which you find out in production.

31 Aug 2026 · 10 min read

Flat vector illustration of a fast-spinning industrial rotor feeding a narrow output chute where stacked parcels have shifted out of order

Web Development

Rolldown vs Turbopack vs Rspack: The Speed Was Never the Hard Part

We moved four client builds onto Rust bundlers this year. Not one of them was hard because of the bundler. Every one was hard because the output changed shape — and output shape breaks things your test suite cannot see.

29 Aug 2026 · 11 min read

Editorial photograph of a retail counter where a receipt printer is still printing an order while the analytics screen on the wall behind it sits blank

Web Development

Checkout Extensibility: Your Orders Still Land, Your Attribution Is Already Dead

Two Shopify deprecations landed this summer and neither one produces an error a customer can see. Checkout keeps taking money; the logic bolted onto checkout stops running. We stopped treating order volume as a health check, and started reconciling counts instead.

28 Aug 2026 · 8 min read

Hand-drawn ink and wash illustration of a phone whose interface layers slide out of the frame beneath a heavy dark bar, with a clean approval stamp over it

Mobile Development

targetSdk 36: The Build Stays Green and the UI Breaks Anyway

The Gradle diff is one line and it compiles first time, which is exactly the problem. Targeting Android 16 turns off your edge-to-edge opt-out, enables predictive back, and makes your portrait lock advisory on any screen 600dp wide — and not one of those three is a build error.

27 Aug 2026 · 10 min read

Flat vector illustration of a sealed workshop with a small pass-through hatch, connected to an outer room holding a key cabinet

AI Development

Agent Sandboxes: The Boundary Is the Credential, Not the Container

Ask a team whether their agent is sandboxed and you'll get the name of a container runtime. That answers a different question. What decides your blast radius is which credentials exist inside the box, which hosts it can reach, and what it's allowed to carry back out.

25 Aug 2026 · 10 min read

Abstract flat-vector illustration of one hub connected to several distinct client shapes

AI Development

MCP Server or Plain Function? The Context Cost Rule

MCP is a distribution protocol, not a capability upgrade. Here's the rule we use to decide whether a tool belongs in an MCP server or stays a plain function in your agent loop — and the context tax nobody budgets for.

24 Aug 2026 · 10 min read

Flat vector illustration of parcels moving along a conveyor belt, one falling off a gap in the line into a catch tray below

Web Development

pg-boss vs BullMQ vs Inngest vs Trigger.dev: Pick the Queue by Its Failure Mode

We've shipped background jobs on all four this year. Not once did throughput decide it. What decided it every time was what happens when a worker dies mid-job — who re-runs what, who pays for it, and whether anyone finds out.

23 Aug 2026 · 11 min read

Isometric illustration of a dense grid of server racks beside an open connected lattice, linked by thin lines

Web Development

TanStack Start in Production: The Router Is the Framework, and That Changes Your Estimates

TanStack Start has been on its 1.x line since early 2025 and now pulls roughly a third of Next.js's weekly npm traffic. We shipped three client apps on it this year. The reason to pick it isn't speed — it's where your type errors show up, and how early.

22 Aug 2026 · 7 min read

Hand holding a smartphone showing a mobile app onboarding screen, with app UI mockups in the background

Mobile Development

Flutter vs React Native: Hiring Decides It, Not Perf

46% vs 35% market share, a 6x talent-pool gap, and a performance race that's basically over. Here's what actually decides the choice in 2026.

15 Aug 2026 · 8 min read

3D-rendered white AI robot assistant standing beside a laptop

AI Development

Intercom Fin vs a Self-Hosted RAG Bot: Real Costs

Drift, Intercom Fin, Tidio, Crisp — or a self-hosted RAG build of your own. What each actually costs, resolves, and who it's really for.

15 Aug 2026 · 9 min read

Team meeting in a boardroom with laptops open around the table and a presentation on screen

AI Development

Offline AI Meeting Notes: Apps That Never Upload Audio

Compare the best on-device AI meeting assistants of 2026 — VAANI, Meetily, Granola, Otter and Fathom — on privacy, offline use and languages. Find your fit.

09 Aug 2026 · 8 min read

Eyeglasses reflecting a blurred dual-monitor setup showing colorful code

Web Development

'Needs useState' in React 19: Where to Put 'use client'

React 19 didn't just ship new APIs — it shipped a new default architecture. Here's the mental model we use to decide what runs on the server, what runs on the client, and why most components should have no "use client" at all.

08 Aug 2026 · 12 min read

Close-up of colorful syntax-highlighted code on a monitor

Web Development

'params Should Be Awaited': The Next.js 15 Fix

Caching got more predictable, params became async, and Turbopack is now the default for dev — here's what those changes mean for a production app.

24 Jul 2026 · 10 min read

3D rendered AI lettering over a blue wireframe network pattern

AI Development

Vercel AI SDK: Streams That Survive Aborts and 429s

Streaming a chat demo is easy. Streaming one that survives a flaky provider, a rate limit and a user closing the tab mid-response is a different problem. Here's the pattern we ship in every AI SDK integration now.

10 Jul 2026 · 11 min read

A small humanoid robot sitting on a bench, reading a tablet

AI Development

When LangGraph Is Overkill: A Rule for Agent Loops

"Just use LangChain" stopped being good advice once agents needed loops, retries and human-in-the-loop checkpoints. Here's how we actually decide between LangChain's chains and LangGraph's state machine for a client build.

26 Jun 2026 · 9 min read

Close-up of CSS padding rules in a dark code editor

UI/UX Design

Tailwind v4: Why Your tailwind.config.js Is Ignored

No more tailwind.config.js as the source of truth, no more JIT flag to remember, and a design-token system that finally lives in CSS instead of a JavaScript object. Here's what actually changes in how you build a UI.

12 Jun 2026 · 8 min read

Smooth abstract gradient waves in blue and purple

AI Development

Why RAG Answers Get Worse as You Add Documents

A RAG demo with 50 documents and a RAG system with 500,000 are different engineering problems — here's the architecture that held up at scale.

29 May 2026 · 11 min read

Overhead view of a developer working at a triple-monitor desk setup

Product Design

Dark Mode Tokens Without Duplicating Your Palette

A color hex code and a spacing pixel value used to be the whole token system. That's no longer enough once a product ships across web, mobile and a dozen light/dark surface combinations — here's the layer we add now.

15 May 2026 · 8 min read

Researcher reviewing a laptop in a data center server hallway

AI Research

Why LLM Benchmark Gains Vanish in Production

A new paper drops nearly every week claiming a step change in reasoning, context length or cost. Most never leave the benchmark. Here's the filter we actually use to decide what's worth prototyping this quarter.

01 May 2026 · 10 min read

WebTransport in Production: The Datagrams Were Easy, the Fallback Was the Whole Job

n8n Security in 2026: The Dangerous Surface Is the Editor, Not the Webhook

Temporal in Node 26: The Bug Was Never Date, It Was Calling a Calendar Day an Instant

Developer Verification: A Signed APK Stopped Being Enough to Install

Electric vs Zero vs PowerSync vs Convex: The Hard Part Was Never Sync, It Was Row-Level Auth

Order Editing: The API Didn't Update the Order, It Replaced It

Baseline in CI: The Support Matrix Was Documentation, Not a Gate

Async Tool Calls: The Provider Stopped Waiting, Your Job Table Doesn't Exist

Soft Navigations: Your LCP Describes One Route Out of Thirty-Five

GenAI Telemetry: Instrument the Turn, Not the Model Call

Spend Caps: The 429 You Asked For Is Still an Outage

Workers Cache: The Hit Happens Before Your Auth Code Runs

npm 12: Pinning to 11 Is Not a Rollback, It's a Deferred Migration

Rolldown vs Turbopack vs Rspack: The Speed Was Never the Hard Part

Checkout Extensibility: Your Orders Still Land, Your Attribution Is Already Dead

targetSdk 36: The Build Stays Green and the UI Breaks Anyway

Agent Sandboxes: The Boundary Is the Credential, Not the Container

MCP Server or Plain Function? The Context Cost Rule

pg-boss vs BullMQ vs Inngest vs Trigger.dev: Pick the Queue by Its Failure Mode

TanStack Start in Production: The Router Is the Framework, and That Changes Your Estimates

Flutter vs React Native: Hiring Decides It, Not Perf

Intercom Fin vs a Self-Hosted RAG Bot: Real Costs

Offline AI Meeting Notes: Apps That Never Upload Audio

'Needs useState' in React 19: Where to Put 'use client'

'params Should Be Awaited': The Next.js 15 Fix

Vercel AI SDK: Streams That Survive Aborts and 429s

When LangGraph Is Overkill: A Rule for Agent Loops

Tailwind v4: Why Your tailwind.config.js Is Ignored

Why RAG Answers Get Worse as You Add Documents

Dark Mode Tokens Without Duplicating Your Palette

Why LLM Benchmark Gains Vanish in Production

Let’s create
with purpose

Signals worth
paying attention

WebTransport in Production: The Datagrams Were Easy, the Fallback Was the Whole Job

n8n Security in 2026: The Dangerous Surface Is the Editor, Not the Webhook

Temporal in Node 26: The Bug Was Never Date, It Was Calling a Calendar Day an Instant

Developer Verification: A Signed APK Stopped Being Enough to Install

Electric vs Zero vs PowerSync vs Convex: The Hard Part Was Never Sync, It Was Row-Level Auth

Order Editing: The API Didn't Update the Order, It Replaced It

Baseline in CI: The Support Matrix Was Documentation, Not a Gate

Async Tool Calls: The Provider Stopped Waiting, Your Job Table Doesn't Exist

Soft Navigations: Your LCP Describes One Route Out of Thirty-Five

GenAI Telemetry: Instrument the Turn, Not the Model Call

Spend Caps: The 429 You Asked For Is Still an Outage

Workers Cache: The Hit Happens Before Your Auth Code Runs

npm 12: Pinning to 11 Is Not a Rollback, It's a Deferred Migration

Rolldown vs Turbopack vs Rspack: The Speed Was Never the Hard Part

Checkout Extensibility: Your Orders Still Land, Your Attribution Is Already Dead

targetSdk 36: The Build Stays Green and the UI Breaks Anyway

Agent Sandboxes: The Boundary Is the Credential, Not the Container

MCP Server or Plain Function? The Context Cost Rule

pg-boss vs BullMQ vs Inngest vs Trigger.dev: Pick the Queue by Its Failure Mode

TanStack Start in Production: The Router Is the Framework, and That Changes Your Estimates

Flutter vs React Native: Hiring Decides It, Not Perf

Intercom Fin vs a Self-Hosted RAG Bot: Real Costs

Offline AI Meeting Notes: Apps That Never Upload Audio

'Needs useState' in React 19: Where to Put 'use client'

'params Should Be Awaited': The Next.js 15 Fix

Vercel AI SDK: Streams That Survive Aborts and 429s

When LangGraph Is Overkill: A Rule for Agent Loops

Tailwind v4: Why Your tailwind.config.js Is Ignored

Why RAG Answers Get Worse as You Add Documents

Dark Mode Tokens Without Duplicating Your Palette

Why LLM Benchmark Gains Vanish in Production

Let’s createwith purpose

Signals worthpaying attention

Let’s create
with purpose

Signals worth
paying attention