Kenji Tanaka is a RECATOOLS editorial persona focused on developer tools, cloud platforms, DevOps, CI/CD, software supply chains, and infrastructure trends. Articles under this byline help technical readers understand how tooling changes affect software delivery, security, cost, and reliability.

About this byline

Kenji Tanaka is a RECATOOLS editorial persona for developer tools, cloud, DevOps, and software supply-chain coverage. Articles are produced and reviewed under RECATOOLS editorial supervision.

Editorial responsibility for this byline rests with Jeffrey Tan (Tan Seng Fei), RECASYS, Singapore. Our Editorial Policy sets out how sources are reviewed, how AI-assisted workflows are used, and how editorial desks and personas are defined.

208
Articles
Developer Tools
Primary beat
Apr 2026
Writing since
~1664 min
Total reading
All 208 Developer Tools 73 AI & ML 53 Cybersecurity 42 Cloud & Infra 34 Cyber Threat Intel 3 Consumer Tech 2 Science 1

Articles · Developer Tools Showing 51–60 of 73

The 128-bit layouts of UUID v4 and v7 side by side, differing only in the leading 48 bits: random in a v4, a Unix millisecond timestamp in a v7.
Developer Tools

UUID v4 vs v7 in 2026: v1 Was Never the Sortable One

RFC 9562 replaced RFC 4122 in May 2024, and the advice most codebases still follow did not update with it. UUID v1 is time-based but not time-sortable: its leading field is time_low, which wraps every 429.4967 seconds — sixty v1s generated a minute apart came out 59 of 60 out of sorted order in our own run, against 0 for the same instants as v7. Plus the v4 collision arithmetic done properly (a billion a second for 100 years is 60.80%, not "less than 50%"), and the index-locality mechanism in the database vendors' own words.

25 Jul 2026 · 19 min read
A JWT split into three panels: header and payload shown decoded and readable, the signature panel hatched and padlocked as checkable only with the key.
Developer Tools

Decoding a JWT Is Not Verifying It

A decoder shows you the claims; it does not tell you whether to believe them. RFC 7519 §7.2 lists ten validation steps and a browser page can perform six — step 7, the signature, needs a key it does not have. It closes with captured container runs showing a tampered payload decoding perfectly while verification fails, an alg:none forgery and an RS256-to-HS256 key confusion sailing past a decoder, and the morning we found our own tool stamping an unsigned admin token "Valid".

25 Jul 2026 · 17 min read
A sentence encoded to base64 and decoded straight back, with a struck-through key between the two arrows marking that no key is involved.
Developer Tools

Encoding Is Not Encryption: Base64, Percent-Encoding and the Confusion That Leaks Data

The RFC that defines Base64 says in its own Security Considerations that base encoding "visually hides" a password but "does not provide any computational confidentiality" — and names the exact leak scenario. We reverse the IETF's own worked Basic-auth credential with one command and no key, measure the size tax at +33.3351% on a real 76,766-byte PNG, and then settle the quieter confusion: why + means a space in form data but a literal plus sign in a URL.

25 Jul 2026 · 16 min read
A spider web strung with dew drops — a self-hosted crawler for the open web
Developer Tools

Self-Host Firecrawl with Docker: Scrape the Web into LLM-Ready Markdown (2026)

We cloned Firecrawl v2.11.0, built its seven-service Docker stack, and scraped our own homepage into clean markdown — no API key, no cloud account.

21 Jul 2026 · 16 min read
Industrial automation line glowing orange — n8n automates the plumbing between your systems
Developer Tools

Self-Host n8n with Docker: From Zero to Your First Webhook (2026)

One container, one volume, one real webhook: we self-hosted n8n 2.30.8 with Docker on macOS and captured every command, including the teardown.

21 Jul 2026 · 14 min read
A workspace mid-install — setting up Hermes Agent takes one command
Developer Tools

How to Set Up Hermes Agent on a Mac (2026)

Executed walkthrough of installing Hermes Agent v0.18.2 on macOS: the official script, the PATH gotcha, doctor checks, and picking a model provider.

15 Jul 2026 · 9 min read
Code on a dark screen — OpenCode is a coding agent that lives in your terminal
Developer Tools

How to Set Up OpenCode on a Mac (2026)

Executed walkthrough of OpenCode v1.18.1 on macOS: Homebrew install, provider auth, free local Ollama option, first run — every command verified.

15 Jul 2026 · 9 min read
The npm logo, a white wordmark on a red background
Developer Tools

npm v12 Is Here, and It Turns Off a Default That Has Run Arbitrary Code for a Decade

npm v12 went generally available on 8 July, flipping install scripts, Git dependencies and remote-URL packages from automatic to opt-in. The default is softer than the headlines suggest — but native builds are where teams will feel it.

11 Jul 2026 · 6 min read
A man working at a desktop computer in a workspace.
Developer Tools

Apple Loses Its EU Gatekeeper Fight — What the DMA Ruling Actually Changes for Developers

On 8 July 2026, the EU General Court dismissed Apple's challenges to its Digital Markets Act gatekeeper designation for the App Store and iOS, confirming the designation and rejecting Apple's argument that its five app stores should count as separate services. But the ruling is narrower than the 'Europe forces the App Store open' headlines suggest: it confirms who the rules apply to and limits Apple's ability to challenge DMA obligations in the abstract before the Commission issues a specific enforcement decision — a procedural win, not a fresh order to open anything. For developers, it reinforces the framework behind alternative app marketplaces, anti-steering and interoperability without, on its own, delivering new access on day one.

11 Jul 2026 · 9 min read
Close-up of a retro computer screen displaying MS-DOS commands with a vibrant keyboard.
Developer Tools

DuneSlide: Two Cursor Flaws Turn a Zero-Click Prompt Injection Into Code Execution

Cato AI Labs has disclosed DuneSlide — two critical remote-code-execution flaws in Cursor (CVE-2026-50548 and CVE-2026-50549, CVSS 9.8) that let a zero-click indirect prompt injection escape the AI editor's terminal sandbox and take over a developer's machine. The flaws are patched in Cursor 3.0, released 2 April 2026, and there is no evidence of exploitation in the wild — but they show that prompt injection can reach past the model layer into classical code paths, and that a sandbox alone cannot contain an autonomous coding agent when the untrusted content it reads can steer it.

7 Jul 2026 · 8 min read
Editorial Policy →