[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f38bo933vfdzro":3,"$fanuq43nlrv5g":55},{"slug":4,"title":5,"body":6,"summary":7,"tags":8,"author":14,"cover_url":15,"published_at":16,"seo_title":17,"seo_description":18,"reading_minutes":19,"related":20},"claude-code-permission-rules-yes-to-all","'Yes to all' is a permission policy: writing Claude Code allow, ask and deny rules that hold up against compound commands and wildcards","\u003Cp>There is a \u003Ca href=\"https:\u002F\u002Fx.com\u002Ftowernter\u002Fstatus\u002F2110716232777294211\">post doing the rounds on X\u003C\u002Fa> about clicking \"Yes\" to everything Claude Code asks. It's funny because it's how a lot of us work. Every \"Yes, and don't ask again\" writes a rule to disk, though. So you already have a permission policy, just not one you chose. This guide turns that habit into a \u003Ccode>.claude\u002Fsettings.json\u003C\u002Fcode> you can read, review and commit. Every rule shape and behaviour below comes from the \u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fpermissions\">Claude Code permissions docs\u003C\u002Fa>, quoted where precision matters.\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad30b6602d67a73cf1eadb6\">\u003Cvideo src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad30b6702d67a73cf1eadbc-0-1e99206d.mp4\" autoplay muted loop playsinline preload=\"metadata\">\u003C\u002Fvideo>\u003C\u002Ffigure>\n\n\u003Ch2>What \"Yes to all\" actually saves\u003C\u002Fh2>\n\n\u003Cp>When you pick \"Yes, and don't ask again\" for a Bash command or a WebFetch domain, the docs say Claude Code \"saves the rule to \u003Ccode>.claude\u002Fsettings.local.json\u003C\u002Fcode> at the root of the git repository\". File edits are different: that approval \"lasts until the session ends\".\u003C\u002Fp>\n\n\u003Cp>Compound commands are split before saving: \"approving \u003Ccode>git status && npm test\u003C\u002Fcode> saves a rule for \u003Ccode>npm test\u003C\u002Fcode>\". The docs add that \"Up to 5 rules may be saved for a single compound command.\" Open your \u003Ccode>settings.local.json\u003C\u002Fcode> now. The rules in there are your current policy.\u003C\u002Fp>\n\n\u003Ch2>The one rule to remember: deny, then ask, then allow\u003C\u002Fh2>\n\n\u003Cp>The docs:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad2fd1802d67a73cf1eaa29\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad2fd1802d67a73cf1eaa2e-0-1f1f342d.png\" alt=\"The hierarchy of permissions: deny, then ask, then allow.\" loading=\"lazy\">\u003Cfigcaption>The hierarchy of permissions: deny, then ask, then allow.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\n\u003Cblockquote>\u003Cp>Rules are evaluated in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order.\u003C\u002Fp>\u003C\u002Fblockquote>\n\n\u003Cp>Two consequences matter. First, \"An allow rule can't carve an exception out of a deny rule\": a deny of \u003Ccode>Bash(aws *)\u003C\u002Fcode> blocks \u003Ccode>aws s3 ls\u003C\u002Fcode> even if you allowed exactly that. Second, the same holds between ask and allow: \"a matching ask rule prompts even when a more specific allow rule also matches the same call.\" So write deny and ask rules for what must never slip through, and keep allow rules narrow.\u003C\u002Fp>\n\n\u003Ch2>Why \u003Ccode>Bash(git * main)\u003C\u002Fcode> also allows \u003Ccode>git push\u003C\u002Fcode>\u003C\u002Fh2>\n\n\u003Cp>A \u003Ccode>*\u003C\u002Fcode> in a Bash rule \"matches any text, including spaces\". What limits a rule is the literal text before the first \u003Ccode>*\u003C\u002Fcode>: \"Claude Code matches everything before the first \u003Ccode>*\u003C\u002Fcode> as written, so those words are what limit the rule.\" The docs' matching table shows what goes wrong with a wildcard in the middle:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad2fd1802d67a73cf1eaa33\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad2fd1802d67a73cf1eaa38-0-53c5a7f6.png\" alt=\"A misplaced wildcard can grant more access than intended.\" loading=\"lazy\">\u003Cfigcaption>A misplaced wildcard can grant more access than intended.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\n\u003Cul>\n\u003Cli>\u003Ccode>Bash(git * main)\u003C\u002Fcode> matches \u003Ccode>git merge main\u003C\u002Fcode>, \u003Ccode>git push origin main\u003C\u002Fcode> and \u003Ccode>git -c core.fsmonitor=<script> diff main\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>\u003Ccode>Bash(git log * main)\u003C\u002Fcode> matches \u003Ccode>git log --oneline main\u003C\u002Fcode> but not \u003Ccode>git push origin main\u003C\u002Fcode>.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Cp>The \u003Ccode>-c\u003C\u002Fcode> case is the nasty one. The docs point out it \"makes git run a program you name\". The advice is direct: \"Put the \u003Ccode>*\u003C\u002Fcode> after the subcommand.\" Claude Code also \"warns at startup about an allow rule with a \u003Ccode>*\u003C\u002Fcode> before the subcommand, such as \u003Ccode>Bash(git * main)\u003C\u002Fcode>.\"\u003C\u002Fp>\n\n\u003Cp>Two smaller details from the same table:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>The space matters.\u003C\u002Fstrong> \u003Ccode>Bash(ls *)\u003C\u002Fcode> matches \u003Ccode>ls -la\u003C\u002Fcode> and \u003Ccode>ls\u003C\u002Fcode>, but not \u003Ccode>lsof\u003C\u002Fcode>. \u003Ccode>Bash(ls*)\u003C\u002Fcode> matches \u003Ccode>lsof\u003C\u002Fcode> too.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>No \u003Ccode>*\u003C\u002Fcode> means exact.\u003C\u002Fstrong> \u003Ccode>Bash(npm run build)\u003C\u002Fcode> does not match \u003Ccode>npm run build --watch\u003C\u002Fcode>.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Ch2>How compound commands are split\u003C\u002Fh2>\n\n\u003Cp>From the docs: \"The recognized command separators are \u003Ccode>&&\u003C\u002Fcode>, \u003Ccode>||\u003C\u002Fcode>, \u003Ccode>;\u003C\u002Fcode>, \u003Ccode>|\u003C\u002Fcode>, \u003Ccode>|&\u003C\u002Fcode>, \u003Ccode>&\u003C\u002Fcode>, and newlines. A rule must match each subcommand independently.\" So \u003Ccode>Bash(npm run test *)\u003C\u002Fcode> does not approve this:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad2fd1802d67a73cf1eaa3d\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad2fd1802d67a73cf1eaa42-0-bf0c63a8.png\" alt=\"Compound commands are broken down into individual rules.\" loading=\"lazy\">\u003Cfigcaption>Compound commands are broken down into individual rules.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\n\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">npm run \u003Cspan class=\"hljs-built_in\">test\u003C\u002Fspan> && git push origin main\u003C\u002Fcode>\u003C\u002Fpre>\n\n\u003Cp>The first half matches the allow rule. The second half has to clear the rules on its own. With the config below it hits an ask rule, so you get a prompt.\u003C\u002Fp>\n\n\u003Cp>Deny and ask rules work the other way: they \"apply when any subcommand matches them, including a command nested inside a subshell, a command substitution, or a control-flow body such as a \u003Ccode>for\u003C\u002Fcode> loop.\" The docs' example: an ask rule \u003Ccode>Bash(git clean *)\u003C\u002Fcode> \"still prompts you for \u003Ccode>cd \u002Ftmp && git clean -f\u003C\u002Fcode> or \u003Ccode>echo \"$(git clean -f)\"\u003C\u002Fcode>\". One edge case: a dangling operator such as \u003Ccode>npm test &&\u003C\u002Fcode> is treated as unparseable, so \u003Ccode>Bash(npm *)\u003C\u002Fcode> won't approve it.\u003C\u002Fp>\n\n\u003Cp>A few wrappers are stripped before matching (\u003Ccode>timeout\u003C\u002Fcode>, \u003Ccode>time\u003C\u002Fcode>, \u003Ccode>nice\u003C\u002Fcode>, \u003Ccode>nohup\u003C\u002Fcode>, \u003Ccode>stdbuf\u003C\u002Fcode>, \u003Ccode>command\u003C\u002Fcode>, \u003Ccode>builtin\u003C\u002Fcode>, zsh's \u003Ccode>noglob\u003C\u002Fcode>, and bare \u003Ccode>xargs\u003C\u002Fcode>), so \u003Ccode>Bash(npm test *)\u003C\u002Fcode> matches \u003Ccode>timeout 30 npm test\u003C\u002Fcode>. Runners like \u003Ccode>npx\u003C\u002Fcode>, \u003Ccode>docker exec\u003C\u002Fcode> and \u003Ccode>devbox run\u003C\u002Fcode> are not stripped. The docs warn that \u003Ccode>Bash(devbox run *)\u003C\u002Fcode> matches \"whatever comes after \u003Ccode>run\u003C\u002Fcode>, including \u003Ccode>devbox run rm -rf .\u003C\u002Fcode>\".\u003C\u002Fp>\n\n\u003Ch2>What a deny rule is not\u003C\u002Fh2>\n\n\u003Cp>The docs are blunt here. A Bash deny or ask rule \"covers the invocation Claude usually produces and isn't a security boundary around the program.\" \u003Ccode>Bash(git push *)\u003C\u002Fcode> stops \u003Ccode>git push origin main\u003C\u002Fcode> but not \u003Ccode>git -C . push origin main\u003C\u002Fcode> or \u003Ccode>git 'push' origin main\u003C\u002Fcode>. \u003Ccode>Bash(rm *)\u003C\u002Fcode> doesn't stop \u003Ccode>\u002Fbin\u002Frm -rf build\u002F\u003C\u002Fcode> or \u003Ccode>bash -c 'rm -rf build\u002F'\u003C\u002Fcode>. Your other rules and the permission mode decide those cases. For enforcement that doesn't depend on command text, the docs point to the sandbox, covered below.\u003C\u002Fp>\n\n\u003Cp>The same goes for \u003Ccode>Read\u003C\u002Fcode> deny rules. They cover Claude's file tools and commands Claude Code recognises, like \u003Ccode>cat\u003C\u002Fcode>, but not \"a Python or Node script that opens files itself\".\u003C\u002Fp>\n\n\u003Ch2>The settings.json\u003C\u002Fh2>\n\n\u003Cp>Put this in \u003Ccode>.claude\u002Fsettings.json\u003C\u002Fcode> and commit it. Settings files \"are strict JSON: a \u003Ccode>\u002F\u002F\u003C\u002Fcode> comment or a trailing comma is a syntax error\". List keys such as \u003Ccode>permissions.allow\u003C\u002Fcode> merge across files, so your \u003Ccode>settings.local.json\u003C\u002Fcode> rules still apply alongside these.\u003C\u002Fp>\n\n\u003Cpre class=\"code-block\" data-lang=\"json\">\u003Ccode class=\"hljs language-json\">\u003Cspan class=\"hljs-punctuation\">{\u003C\u002Fspan>\n  \u003Cspan class=\"hljs-attr\">"$schema"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-string\">"https:\u002F\u002Fjson.schemastore.org\u002Fclaude-code-settings.json"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n  \u003Cspan class=\"hljs-attr\">"permissions"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-punctuation\">{\u003C\u002Fspan>\n    \u003Cspan class=\"hljs-attr\">"allow"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-punctuation\">[\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(npm run lint)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(npm run test *)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(npm run build)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(git diff *)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(git add *)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(git commit *)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Edit(\u002Fsrc\u002F**)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Edit(\u002Ftests\u002F**)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"WebFetch(domain:code.claude.com)"\u003C\u002Fspan>\n    \u003Cspan class=\"hljs-punctuation\">]\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n    \u003Cspan class=\"hljs-attr\">"ask"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-punctuation\">[\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(git push *)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(git clean *)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(git reset *)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(npm install *)"\u003C\u002Fspan>\n    \u003Cspan class=\"hljs-punctuation\">]\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n    \u003Cspan class=\"hljs-attr\">"deny"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-punctuation\">[\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(git push --force *)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(git push * --force)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(rm -rf *)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(curl *)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Bash(wget *)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Read(.\u002F.env)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Read(.\u002F.env.*)"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-string\">"Read(.\u002Fsecrets\u002F**)"\u003C\u002Fspan>\n    \u003Cspan class=\"hljs-punctuation\">]\u003C\u002Fspan>\n  \u003Cspan class=\"hljs-punctuation\">}\u003C\u002Fspan>\n\u003Cspan class=\"hljs-punctuation\">}\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>\n\n\u003Cp>Why each block looks the way it does:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>allow\u003C\u002Fstrong>: every Bash rule puts its \u003Ccode>*\u003C\u002Fcode> after the subcommand. Commands like \u003Ccode>ls\u003C\u002Fcode>, \u003Ccode>cat\u003C\u002Fcode>, \u003Ccode>grep\u003C\u002Fcode> and read-only \u003Ccode>git\u003C\u002Fcode> are missing on purpose. Claude Code already runs its built-in read-only set \"without a permission prompt in every mode\".\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Edit paths\u003C\u002Fstrong>: in project settings, a leading \u003Ccode>\u002F\u003C\u002Fcode> anchors at the primary working directory, so \u003Ccode>Edit(\u002Fsrc\u002F**)\u003C\u002Fcode> means your project's \u003Ccode>src\u002F\u003C\u002Fcode>, not the filesystem root. For absolute paths the docs use \u003Ccode>\u002F\u002F\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>ask\u003C\u002Fstrong>: \u003Ccode>git push *\u003C\u002Fcode> prompts even inside compound commands, because ask rules match any subcommand.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>deny\u003C\u002Fstrong>: blocking \u003Ccode>curl\u003C\u002Fcode> and \u003Ccode>wget\u003C\u002Fcode> while allowing \u003Ccode>WebFetch(domain:...)\u003C\u002Fcode> follows the docs' own advice for URL filtering. Force-push is denied in both flag positions, and the deny wins over the \u003Ccode>git push *\u003C\u002Fcode> ask rule because deny is checked first. As the section above says, none of this stops \u003Ccode>git -C . push --force\u003C\u002Fcode>.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Cp>Check what loaded with \u003Ccode>\u002Fpermissions\u003C\u002Fcode>. It \"lists all permission rules and the \u003Ccode>settings.json\u003C\u002Fcode> file each rule comes from\".\u003C\u002Fp>\n\n\u003Ch2>dontAsk, sandbox or bypassPermissions?\u003C\u002Fh2>\n\n\u003Cp>If clicking \"Yes\" was really about not being interrupted, look at a mode instead of a broader wildcard.\u003C\u002Fp>\n\n\u003Cp>\u003Cstrong>\u003Ccode>dontAsk\u003C\u002Fcode>\u003C\u002Fstrong> \"Auto-denies every call that would otherwise prompt\", while still running reads, read-only commands and your allow rules. The modes page lists it as best for \"Locked-down CI and scripts\", with this example:\u003C\u002Fp>\n\n\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">claude -p \u003Cspan class=\"hljs-string\">"run the test suite"\u003C\u002Fspan> --permission-mode dontAsk --allowedTools \u003Cspan class=\"hljs-string\">"Bash(npm test)"\u003C\u002Fspan> \u003Cspan class=\"hljs-string\">"Read"\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>\n\n\u003Cp>\u003Cstrong>The sandbox\u003C\u002Fstrong> is an OS-enforced boundary around shell commands. You turn it on with \u003Ccode>\u002Fsandbox\u003C\u002Fcode> or \u003Ccode>\"sandbox\": {\"enabled\": true}\u003C\u002Fcode>. In its auto-allow mode, Claude Code \"approves a command automatically, with no prompt, when the command runs inside the sandbox.\" This answers \"stop asking me about every shell command\" better than a wildcard does, because the limit no longer depends on how the command is spelled. Two caveats: \"The sandbox covers shell commands only,\" so file tools still follow your permission rules. And to stop Claude retrying a failed command outside the sandbox, set \u003Ccode>\"allowUnsandboxedCommands\": false\u003C\u002Fcode>.\u003C\u002Fp>\n\n\u003Cpre class=\"code-block\" data-lang=\"json\">\u003Ccode class=\"hljs language-json\">\u003Cspan class=\"hljs-punctuation\">{\u003C\u002Fspan>\n  \u003Cspan class=\"hljs-attr\">"sandbox"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-punctuation\">{\u003C\u002Fspan>\n    \u003Cspan class=\"hljs-attr\">"enabled"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-literal\">\u003Cspan class=\"hljs-keyword\">true\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n    \u003Cspan class=\"hljs-attr\">"allowUnsandboxedCommands"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-literal\">\u003Cspan class=\"hljs-keyword\">false\u003C\u002Fspan>\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n    \u003Cspan class=\"hljs-attr\">"network"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-punctuation\">{\u003C\u002Fspan>\n      \u003Cspan class=\"hljs-attr\">"allowedDomains"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-punctuation\">[\u003C\u002Fspan>\u003Cspan class=\"hljs-string\">"github.com"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan> \u003Cspan class=\"hljs-string\">"*.npmjs.org"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">]\u003C\u002Fspan>\n    \u003Cspan class=\"hljs-punctuation\">}\u003C\u002Fspan>\n  \u003Cspan class=\"hljs-punctuation\">}\u003C\u002Fspan>\n\u003Cspan class=\"hljs-punctuation\">}\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>\n\n\u003Cp>\u003Cstrong>\u003Ccode>bypassPermissions\u003C\u002Fcode>\u003C\u002Fstrong> \"Skips permission prompts, except for the actions no mode auto-approves\", including writes to protected paths like \u003Ccode>.git\u003C\u002Fcode> and \u003Ccode>.claude\u003C\u002Fcode>. The docs' instruction is: \"Only use this mode in isolated environments like containers or VMs where Claude Code can't cause damage.\" It also can't be switched on from a repo: setting it as \u003Ccode>defaultMode\u003C\u002Fcode> in \u003Ccode>.claude\u002Fsettings.json\u003C\u002Fcode> or \u003Ccode>.claude\u002Fsettings.local.json\u003C\u002Fcode> \"doesn't take effect\", and the session starts in Manual mode.\u003C\u002Fp>\n\n\u003Ch2>Ten-minute checklist\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Open \u003Ccode>.claude\u002Fsettings.local.json\u003C\u002Fcode> and read every rule your past \"Yes\" clicks saved.\u003C\u002Fli>\n\u003Cli>Rewrite any rule with a \u003Ccode>*\u003C\u002Fcode> before the subcommand, and heed the startup warning if you see it.\u003C\u002Fli>\n\u003Cli>Add deny rules for things that must never run, and ask rules for things you want to see first.\u003C\u002Fli>\n\u003Cli>Commit the shared rules in \u003Ccode>.claude\u002Fsettings.json\u003C\u002Fcode>. Check them in \u003Ccode>\u002Fpermissions\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>If you're still clicking \"Yes\" all day, turn on the sandbox rather than widening the wildcards.\u003C\u002Fli>\n\u003C\u002Fol>\n\n\u003Ch2>Sources\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fpermissions\">Configure permissions\u003C\u002Fa> (Claude Code docs)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fpermission-modes\">Choose a permission mode\u003C\u002Fa> (Claude Code docs)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fsandboxing\">Configure the sandboxed Bash tool\u003C\u002Fa> (Claude Code docs)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fsettings\">Settings files and precedence\u003C\u002Fa> (Claude Code docs)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fx.com\u002Ftowernter\u002Fstatus\u002F2110716232777294211\">The \"Yes to all\" post on X\u003C\u002Fa> (could not be fetched; not quoted)\u003C\u002Fli>\n\u003C\u002Ful>\n","Every 'Yes, and don't ask again' writes a rule. Turn that habit into a reviewed .claude\u002Fsettings.json: deny beats ask beats allow, why Bash(git * main) also allows git push, how compound commands are split, and when dontAsk or the sandbox beats bypassPermissions.",[9,10,11,12,13],"claude-code","permissions","security","developer-tools","ai-assisted","if.codes","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad2fd1602d67a73cf1eaa23-0-68817e09.png","2026-10-17T23:06:09.746Z","Claude Code permission rules that survive wildcards","A copyable .claude\u002Fsettings.json: deny then ask then allow, wildcard traps like Bash(git * main), compound command splitting, dontAsk and sandbox.",7,[21,33,44],{"slug":22,"title":23,"type":24,"summary":25,"tags":26,"author":14,"cover_url":31,"published_at":32,"updated_at":32},"go-1-27-http1-connection-reuse-body-draining","710 ms to 150 ms for 100 requests: what Go 1.27's HTTP\u002F1 connection reuse fixes, and the body-draining habit to keep for older clients","blog","Go 1.27 drains unread HTTP\u002F1 response bodies for you, so a closed-but-unread body no longer kills connection reuse. A runnable test that counts reused connections, the two patterns that broke reuse, and a capped drain helper for Go 1.26 and older.",[27,28,29,30,13],"go","http","performance","networking","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad1d8da69fb9bde4cc895fb-0-e539bbf2.png","2026-10-16T23:32:12.783Z",{"slug":34,"title":35,"type":24,"summary":36,"tags":37,"author":14,"cover_url":41,"published_at":42,"updated_at":43},"claude-code-subagent-prompt-cache-ttl","Claude Code subagents get a 5-minute cache even on a subscription: when to set it to 1h, and how to check","On a subscription your main Claude Code conversation gets a one-hour prompt cache, but subagents, workflows and compaction stay at five minutes. The settings that change it, the precedence order, when the pricier 1h write pays off, and how to verify the TTL you got.",[9,38,39,40,13],"prompt-caching","subagents","llm-costs","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad0968473d443ad8fa7adbe-0-f2f3fe8c.png","2026-10-15T22:21:15.624Z","2026-10-15T22:21:15.625Z",{"slug":45,"title":46,"type":24,"summary":47,"tags":48,"author":14,"cover_url":52,"published_at":53,"updated_at":54},"postgres-slow-vps-benchmark-the-disk-first","Postgres feels slow on your VPS? Benchmark the disk before you touch postgresql.conf","ClickHouse measured the same Postgres box at 16,030 TPS on local NVMe and 1,734 TPS on a baseline gp3 volume, with most of the gap spent waiting on storage. A 15-minute fio and pg_test_fsync check tells you which side of that table your VPS is on.",[49,50,29,51,13],"postgres","self-hosting","databases","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acdb5d473d443ad8fa7555c-0-dd05a138.png","2026-10-13T05:44:15.759Z","2026-10-13T05:44:15.76Z",[56,58,61,63,66,78,89,100,112,123,135,146,157,166,176,189,203,213,224,235,246,254,265,276,285,296,306,315,324],{"slug":4,"title":5,"type":24,"summary":7,"tags":57,"author":14,"cover_url":15,"published_at":16,"reading_minutes":19,"updated_at":16},[9,10,11,12,13],{"slug":22,"title":23,"type":24,"summary":25,"tags":59,"author":14,"cover_url":31,"published_at":32,"reading_minutes":60,"updated_at":32},[27,28,29,30,13],6,{"slug":34,"title":35,"type":24,"summary":36,"tags":62,"author":14,"cover_url":41,"published_at":42,"reading_minutes":60,"updated_at":43},[9,38,39,40,13],{"slug":45,"title":46,"type":24,"summary":47,"tags":64,"author":14,"cover_url":52,"published_at":53,"reading_minutes":65,"updated_at":54},[49,50,29,51,13],5,{"slug":67,"title":68,"type":24,"summary":69,"tags":70,"author":14,"cover_url":74,"published_at":75,"reading_minutes":76,"updated_at":77},"quoted-tilde-in-path-check","A quoted ~ in your PATH runs whatever sits in .\u002F~\u002F: a one-line check for dotfiles, servers and CI images","export PATH=\"$PATH:~\u002F.local\u002Fbin\" never expands the tilde. Interactive bash hides it, but sh, zsh, env and Python search a folder literally named ~ under the current directory. The check, the fix, and where to grep.",[71,72,11,73,13],"linux","shell","devops","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acd3f0073d443ad8fa743bf-0-c8db0f5d.png","2026-10-12T23:53:16.705Z",4,"2026-10-12T23:53:16.706Z",{"slug":79,"title":80,"type":24,"summary":81,"tags":82,"author":14,"cover_url":86,"published_at":87,"reading_minutes":60,"updated_at":88},"docker-published-ports-bypass-ufw-vps-hardening","Docker publishes ports straight past UFW: hardening a fresh VPS without the firewall rule that does nothing","ufw deny 8080 does not stop a Docker container published on 8080. Docker's own docs explain why. A 15-minute fresh-VPS walkthrough: key-only SSH, ufw, then the two fixes that actually close a container port, and a scan from outside to prove it.",[83,11,84,85,13],"docker","vps","firewall","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acb12dddbaf8c2bc523d0bb-0-21ee3023.png","2026-10-11T05:42:15.363Z","2026-10-11T05:42:15.364Z",{"slug":90,"title":91,"type":24,"summary":92,"tags":93,"author":14,"cover_url":97,"published_at":98,"reading_minutes":60,"updated_at":99},"deno-deploy-shutdown-exit-guide","Deno Deploy shuts down in six months: moving a small app to Cloudflare Workers, self-hosted Deno in Docker, or Node","Deno is joining Cloudflare: Deploy has six months left and the runtime gets a year of fixes. Write your app as one fetch handler and you can run it on Workers, in a Deno container or on Node. Code for all three, plus what does not carry over.",[94,95,96,83,13],"deno","cloudflare-workers","migration","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac9c181dbaf8c2bc523a0fd-0-caa268de.png","2026-10-10T05:47:19.665Z","2026-10-10T05:47:19.666Z",{"slug":101,"title":102,"type":24,"summary":103,"tags":104,"author":14,"cover_url":109,"published_at":110,"reading_minutes":19,"updated_at":111},"durable-object-alarm-loop-guards","The Durable Object alarm that cost $10,000: guarding setAlarm() loops with backoff, idempotency and a kill switch","Durable Object alarms are at-least-once, retried, and usually rescheduled from inside the handler, which makes a billing loop easy to write. Four guards in TypeScript, a kill switch, and a Vitest test that proves the loop stops.",[105,106,107,108,13],"cloudflare","durable-objects","typescript","cost-control","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac8709b392a85804f209fb3-0-9143ed0c.png","2026-10-09T06:09:10.127Z","2026-10-09T06:09:10.128Z",{"slug":113,"title":114,"type":24,"summary":115,"tags":116,"author":14,"cover_url":121,"published_at":122,"reading_minutes":60,"updated_at":122},"cctld-hijack-counterfeit-certs-caa-accounturi-ct-watch","Counterfeit certs via hijacked ccTLDs: CAA with accounturi and a CT watch for your domains in 15 minutes","Attackers took over the .gh, .sl and .as registries and got 12 valid certificates for Google domains. CAA would not have stopped the hijack. Here is the CAA record that limits the damage afterwards, and a CT watch script that tells you within a day.",[117,118,119,120,13],"tls","caa","certificate-transparency","dns","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac75337392a85804f207d25-0-12f538ac.png","2026-10-08T22:47:12.408Z",{"slug":124,"title":125,"type":24,"summary":126,"tags":127,"author":14,"cover_url":132,"published_at":133,"reading_minutes":60,"updated_at":134},"embeddinggemma-2-qdrant-truncation-recall","EmbeddingGemma 2 in Qdrant: one 740M model for text, images and audio, and what truncating 768 to 128 dims costs your recall","Google's open multimodal embedder runs locally and truncates from 768 to 128 dims. Index one Qdrant collection at three sizes from a single encode pass, then measure recall@10 on your own queries instead of trusting a benchmark.",[128,129,130,131,13],"embeddings","qdrant","rag","open-models","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac5cceedf0d655df505306e-0-d17d0fef.png","2026-10-07T07:21:20.071Z","2026-10-07T07:21:20.072Z",{"slug":136,"title":137,"type":24,"summary":138,"tags":139,"author":14,"cover_url":143,"published_at":144,"reading_minutes":65,"updated_at":145},"cloudflare-access-strict-service-token-auth-migration","Strict service token auth in Cloudflare Access: moving your scripts and CI over before it bites","Cloudflare Access now has a strict mode for service tokens: 401\u002F403 instead of a 302 to the login page, only Service Auth policies count, and no CF_Authorization cookie. New orgs get it forced on from 5 October. A 15-minute check and switch for existing orgs.",[105,140,141,142,13],"zero-trust","ci-cd","authentication","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac4a8860956594c947bd197-0-f768b25b.png","2026-10-06T08:30:13.154Z","2026-10-06T08:30:13.155Z",{"slug":147,"title":148,"type":24,"summary":149,"tags":150,"author":14,"cover_url":154,"published_at":155,"reading_minutes":60,"updated_at":156},"cloudflare-traces-trace-rules-debug-one-customer","Why was that request blocked? Tracing one customer at 100% with Cloudflare Traces and Trace Rules","Cloudflare Traces (open beta) shows a request's path through WAF rules, transforms, cache, Workers and origin as one trace. A recipe: low baseline sampling, a 100% Trace Rule for one host or debug header, traceparent to your origin, OTLP export to your own collector, and what December pricing means.",[105,151,152,153,13],"observability","opentelemetry","tracing","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac338052cb6b40613ac2b7c-0-2294d114.png","2026-10-05T06:22:19.055Z","2026-10-05T06:22:19.056Z",{"slug":158,"title":159,"type":24,"summary":160,"tags":161,"author":14,"cover_url":164,"published_at":165,"reading_minutes":65,"updated_at":165},"copyescape-cve-2026-17106-patch-docker-cp","CopyEscape (CVE-2026-17106): patch docker cp, and stop copying out of running containers","A race in docker cp lets a malicious container write files anywhere the copying process can write on the host. That matters for CI runners and AI-agent sandboxes that copy results out. Check your versions, patch, and change copy-out jobs to stop the container first.",[83,11,162,163,13],"cve","ci","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac218ebfd770659725abe68-0-eee7c8f7.png","2026-10-04T23:51:14.689Z",{"slug":167,"title":168,"type":24,"summary":169,"tags":170,"author":14,"cover_url":173,"published_at":174,"reading_minutes":76,"updated_at":175},"protected-quick-tunnels-vs-tailscale-funnel","Share localhost with three named people: Cloudflare's Protected Quick Tunnels vs Tailscale Funnel","cloudflared 2026.9.3 adds --allowed-mail: your quick tunnel now sits behind an email one-time PIN, checked against an allow-list on your own machine, free and without a Cloudflare account. The commands, what it protects, and when Tailscale Serve or Funnel is the better fit.",[105,171,172,11,13],"tailscale","tunnels","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac218d8fd770659725abe3a-0-40f8cb2e.png","2026-10-04T23:19:14.764Z","2026-10-04T23:19:14.765Z",{"slug":177,"title":178,"type":24,"summary":179,"tags":180,"author":14,"cover_url":186,"published_at":187,"reading_minutes":60,"updated_at":188},"si-domains-super-intelligence-data",".si after 'Super Intelligence': did one UN speech move a ccTLD?","Trump renamed AI 'super intelligence' at the UN on 22 September 2026 and Slovenia's .si went from about 190,000 names to almost 276,000 in a month. Registry numbers, prices, and 87 WHOIS checks: the obvious AI names were gone years ago; the compounds went in days.",[181,182,183,184,185,13],"domains","si","tld","data","ai","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaaee53e21d5cbd14d442d-0-d6243bc5.png","2026-10-04T22:36:14.598Z","2026-10-04T22:36:14.599Z",{"slug":190,"title":191,"type":24,"summary":192,"tags":193,"author":14,"cover_url":199,"published_at":200,"reading_minutes":201,"updated_at":202},"palantir-agent-stack-python","Steal Palantir's agent stack: typed tools, one LLM gateway, swappable models","An X thread boils Palantir's AIP docs down to four agent patterns. We check each one against the docs, then build them in one stdlib-only Python file: typed business-object tools, a gateway that masks PII, caches and retries, a model set in config, and schedule\u002Fevent\u002FAPI triggers.",[194,195,196,197,198,13],"ai-agents","llm","python","architecture","palantir","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88f9c951ea7137fa3872-0-48eb7eee.png","2026-10-01T23:05:10.531Z",10,"2026-10-01T23:05:10.532Z",{"slug":204,"title":205,"type":24,"summary":206,"tags":207,"author":14,"cover_url":209,"published_at":210,"reading_minutes":211,"updated_at":212},"claude-code-effort-levels","Effort levels in Claude Code: when max effort pays off and when it just burns tokens","Anthropic's effort deep dive (Terminal-Bench 3.0 plus three builds) shows higher effort mostly buys verification and edge-case testing, not smarter code. A rule of thumb per task type, the commands to set effort, and a script to measure cost vs pass rate on your own repo.",[9,208,195,12,13],"ai-coding","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88edc951ea7137fa3804-0-2716005a.png","2026-10-01T22:32:14.139Z",9,"2026-10-02T04:44:58.001Z",{"slug":214,"title":215,"type":24,"summary":216,"tags":217,"author":14,"cover_url":220,"published_at":221,"reading_minutes":222,"updated_at":223},"agentic-inbox-cloudflare-setup","Self-host an AI email agent on Cloudflare Workers: agentic-inbox set up and costed","Cloudflare's open-source agentic-inbox runs a full email client on Workers, with one SQLite Durable Object per mailbox and a Kimi K2.5 agent that drafts replies. Covers the post-deploy steps people miss (Access, sending, routing, mailbox first) and the cost.",[105,218,194,219,50,13],"workers","email","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88dac951ea7137fa378b-0-5b0ec96d.png","2026-10-01T08:17:18.646Z",8,"2026-10-05T05:56:11.919Z",{"slug":225,"title":226,"type":24,"summary":227,"tags":228,"author":14,"cover_url":232,"published_at":233,"reading_minutes":222,"updated_at":234},"audit-ai-agent-public-traces","Nearly a million leaked links: auditing what your AI agents leave on the public web","OpenAI's agent swarm left almost a million public shortener URLs holding credentials. Here's a tested shell + gitleaks audit to find the shortlinks, pastes and webhooks your own agents created, scan them for secrets and close the channels.",[11,229,230,231,195,13],"agents","secrets","gitleaks","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaad873e21d5cbd14d4397-0-0f4f51f7.png","2026-10-01T07:43:19.642Z","2026-10-01T08:44:43.041Z",{"slug":236,"title":237,"type":24,"summary":238,"tags":239,"author":14,"cover_url":243,"published_at":244,"reading_minutes":222,"updated_at":245},"mikrotrick-check-patch-mikrotik","MikroTrick: check and patch your MikroTik in 15 minutes","Two chained RouterOS bugs give anyone who can reach SSH full admin, no password needed, and attacks started before the patch. Find exposed SSH, check the version, grep for the published IoCs, patch and move management behind WireGuard.",[11,240,241,242,50,13],"mikrotik","routeros","ssh","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abcd9c0838b650cb96b3d10-0-6cd107e0.png","2026-10-01T07:02:15.03Z","2026-10-01T08:44:41.391Z",{"slug":247,"title":248,"type":24,"summary":249,"tags":250,"author":14,"cover_url":251,"published_at":252,"reading_minutes":222,"updated_at":253},"agent-sandbox-dns-egress-lockdown","Your agent sandbox leaks through DNS: lock down egress in 15 minutes","An OpenAI model escaped its sandbox by tunnelling questions through DNS. Here is a tested Docker Compose setup for coding agents: a DNS allowlist, a logging egress proxy and a kill switch that actually fires.",[11,83,229,120,50,13],"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaaca13e21d5cbd14d4306-0-cb93fe1b.png","2026-10-01T03:00:15.943Z","2026-10-01T08:44:43.165Z",{"slug":255,"title":256,"type":24,"summary":257,"tags":258,"author":14,"cover_url":262,"published_at":263,"reading_minutes":19,"updated_at":264},"who-blocks-ai-crawlers-robots-txt","Who blocks AI crawlers? robots.txt vs the network edge, with numbers","I scanned robots.txt on the top 300 sites: 33 of 138 block GPTBot, 14 block training but allow AI search. What each AI bot directive controls, why robots.txt is only a request, and a copy-paste policy plus nginx rule for small SaaS sites.",[185,259,260,105,261,13],"robots-txt","seo","saas","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abcd9c1838b650cb96b3d1b-0-11f94198.png","2026-09-30T21:00:20.673Z","2026-10-01T20:47:34.092Z",{"slug":266,"title":267,"type":24,"summary":268,"tags":269,"author":14,"cover_url":273,"published_at":274,"reading_minutes":76,"updated_at":275},"bullet-time-with-first-last-frame-video","Bullet time with first\u002Flast-frame video: orbiting a frozen moment from three stills","A freeze-frame camera orbit built from generated stills: one action shot, two camera-move angles, two first\u002Flast-frame clips between them, stitched and ping-ponged. The pipeline, the seams, and where the model re-imagines the water.",[185,270,271,272],"comfyui","video-generation","flowdsl","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abae46c45201648bfd477a7-0-6f4d036e.png","2026-09-28T22:42:41Z","2026-09-28T22:42:41.6Z",{"slug":277,"title":278,"type":24,"summary":279,"tags":280,"author":14,"cover_url":282,"published_at":283,"reading_minutes":19,"updated_at":284},"an-ai-media-pipeline-that-shows-its-work","An AI media pipeline that shows its work: ComfyUI presets, FlowDSL routing and the misses","How the images on my sites are generated: four ComfyUI presets behind one Go module, job rows as state, FlowDSL flows for routing, per-post media in the admin — and the bugs and model misses I hit shipping it. This post's own images were made the same way.",[185,272,270,281],"image-generation","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6aba8ba317ceba3543925be4-0-2f6b8a5c.png","2026-09-28T15:57:50Z","2026-10-01T20:47:34.327Z",{"slug":286,"title":287,"type":24,"summary":288,"tags":289,"author":14,"cover_url":292,"published_at":293,"reading_minutes":294,"updated_at":295},"openai-embeddings-python-mongodb","Transforming Text into Vectors: OpenAI Embeddings in Python","Learn how to generate text embeddings with the OpenAI API in Python to power semantic search, recommendations, and more. Includes practical examples with MongoDB integration and cost analysis.",[290,185,196,291],"openai","mongodb","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c2d-0-2e60b732.png","2024-11-23T00:00:00Z",3,"2026-09-28T22:31:01.385Z",{"slug":297,"title":298,"type":24,"summary":299,"tags":300,"author":14,"cover_url":302,"published_at":303,"reading_minutes":304,"updated_at":305},"check-pricing-availability-ing-domains","Last Chance to Grab Short .ING Domains: The Extended List Part II","Welcome back to the second part of our exciting exploration into the .ING domain zone! This time, I've expanded our horizons to bring you an even larger selection of .ING domain names. List of over 24,000 domain names inside.",[181,301],"business","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c38-0-c55f4c8d.png","2023-12-14T00:00:00Z",1,"2026-09-28T22:31:01.453Z",{"slug":307,"title":308,"type":24,"summary":309,"tags":310,"author":14,"cover_url":311,"published_at":312,"reading_minutes":313,"updated_at":314},"impressive-ing-domains","Unveiling the Impressive .ING Domains","Discover the vast potential of the new .ING domain zone in my latest blog post! I've used AI and a Python script to unearth a treasure trove of available domain names. From budget-friendly picks to exclusive premium domains, there's something for every ambition. Plus, a special list of unique, lesser-known domains awaits.",[181,301],"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c43-0-03be24b7.png","2023-12-11T00:00:00Z",2,"2026-09-28T22:31:01.527Z",{"slug":316,"title":317,"type":24,"summary":318,"tags":319,"author":14,"cover_url":321,"published_at":322,"reading_minutes":294,"updated_at":323},"secured-web-server-in-5-minutes","Fortify Web Server Security in 5 Minutes with Tailscale","Tailscale revolutionizes secure networking with its user-friendly approach, effortlessly connecting devices across diverse networks.",[85,171,320],"webserver","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c4e-0-eae6f62d.png","2023-11-03T00:00:00Z","2026-09-28T22:31:01.597Z",{"slug":325,"title":326,"type":24,"summary":327,"tags":328,"author":14,"cover_url":331,"published_at":332,"reading_minutes":60,"updated_at":333},"lets-encrypt-free-ssl","How to Secure Your Website with Free SSL Certificates for a Lifetime","Let’s Encrypt certificates have revolutionized internet security by providing free, automated, and widely trusted SSL\u002FTLS certificates. The non-profit Certificate Authority (CA) has significantly contributed to a more secure web environment by simplifying the process of securing websites with HTTPS.",[329,330,320],"ssl","https","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c59-0-bf2a9a0a.png","2023-11-01T00:00:00Z","2026-09-28T22:39:13.555Z"]