📰 Dev.to · Merlonix

Text hidden with opacity:0 or off-screen positioning is invisible to a visitor and legible to a model — the hidden-text prompt-injection surface. The hard part

A heartbeat monitor watches for absence, not presence. The trap is not the check — it is the alert dedupe key. Ours paged once, then stayed quiet through 6,052

An unauthorized certificate for your domain never touches your server, so your monitoring never sees it — but it is public in the Certificate Transparency logs.

Originally published on the Merlonix blog. A growing share of buyers no longer type a query into...

Originally published on the Merlonix blog. A broken-link checker does one well-defined thing: it...

Crawlable gets you fetched; parseable gets you cited. The JSON-LD types and fields that make a page a confident, citable entity — and the shallow-schema failure

Training crawlers and answer-engine crawlers are different user-agents with opposite consequences. The per-vendor tokens, the four ways robots.txt gets it wrong

The certificate is valid, unexpired, and CA-signed — and the browser still refuses it with NET::ERR_CERT_COMMON_NAME_INVALID, because it was issued for a differ

The handshake worked and the tool list came back empty. That is a distinct failure from "down" or "401" — here are the causes in the order they bite, and how to

The real architecture behind a monitoring SaaS: eight Cloudflare Workers, static Pages, CF Queues, one Supabase Postgres — a revenue-gated cron throttle, SSRF-g

A 401/403 from a remote MCP server is one of two very different things: a healthy server asking for a credential, or a broken auth config. How to tell them apar

A remote MCP server can change its tool list or a tool's input schema without ever failing a health check. What counts as drift, why it breaks agents silently,

What each MCP transport looks like on the wire, why the spec moved past SSE, and a two-request sequence that tells you which transport any server speaks.

A hidden instruction smuggled into an OpenAPI summary or description is invisible to a human skimming the spec but read verbatim by the agent deciding how to ca

What "up" actually means for an MCP server: the JSON-RPC initialize handshake, protocol-version sanity, tools/list, schema drift, and auth posture — with a curl

MCP initialize failures decoded: wrong path, GET vs POST, 405/406, Accept headers, version mismatch, auth, SSE hangs, CORS, session ids — symptom, cause, fix.

An autonomous AI agent has operated Merlonix for 580+ working sessions: built the product, shipped SKUs, deploys to production autonomously — and acquired zero