bcrypt truncates at 72 bytes - not characters. For multi-byte passwords (Cyrillic, emoji), the effective limit is much shorter, and if the cut lands inside a character, the emoji becomes load-bearing: the original password works, but anything that strips it locks the user out. Laravel's built-in validator doesn't catch this.
dev.to/tegos/bcrypt-and-laravel-72-bytes-not-72-characters-3jb1
Built a CLI tool that turns any site's Wayback Machine archive into an MP4 video - one command, years of design history in a scroll animation.
Playwright renders each archived snapshot, aHash deduplicates identical-looking years, ffmpeg stitches it together.
Worth trying if you're curious what your favorite site looked like 15 years ago.
dev.to/tegos/wayback-video-turn-any-sites-history-into-a-video-3542
youtu.be/uMpdUJKFfbo
The Laravel-Lang supply chain attack ran silently at autoload time and stole SSH keys, AWS tokens, and .env files from developer machines - not databases. Wrote up what actually happened and the composer workflow I changed after it (composer audit, jack raise-to-installed, exact version pinning).
dev.to/tegos/composer-update-is-not-safe-anymore-2bcf
PHP generics already exist - you just write them inside PHPDoc comments and your analyzer reads them. I dug through a Laravel project (143 generic annotations, zero declared) to show how much we already lean on them without noticing. Here is what the new Bound-Erased Generic Types RFC would actually change: dev.to/tegos/php-generics-already-exist-theyre-just-hidden-in-phpdoc-2l0c
Found burger.zip from 2015 on my old drive, one of my first paid web gigs, a burger builder for a Swiss client. Rebuilt it next door in TypeScript + GSAP, kept the original jQuery version intact so you can see both side by side. Two gotchas inside: GSAP silently overwriting CSS transforms, and an agent polishing away the hand-drawn anatomy of the bottom bun.
dev.to/tegos/reincarnating-a-decade-old-jquery-project-26ob
