A note about this build log entry: I published this after the week it covers. DevNitro reconstructed a draft from work-related entries in my journal, Git commit history, and time tracking. I reviewed, edited, and approved the final post. The story reflects what I knew and built at the time.

From the Backlog to the Build Log

Week of November 28 - December 4, 2025

What I Worked On

This was a hardening week. Most of the product time went into locking down authentication security in GCT, the shared core every site I generate is built on. If the auth is weak there, it is weak everywhere, so this was worth doing carefully.

I added a centralized sign-in manager so every generated site handles login through one audited path instead of its own. I added rate limiting on the sensitive endpoints, tightened token validation, and put a fallback authorization policy in place so routes require an authenticated user by default rather than by accident.

Alongside that, I finished the .NET 10 upgrade across GCT and BlankSite, did a styling pass on DevNitro's web UI, and adopted Beads for AI-native issue tracking so the work items live where the agents can see them.

What the AI Did Well

Security work fits the write-the-test-first loop well. I had the AI add rate limiting and then write the tests that prove it triggers, add ChangePassword tests, and cover the token validation paths. When the change is "this should now be rejected," a failing-then-passing test is the clearest proof it works.

Replacing Moq in the test suite and adding paging to user search were the kind of broad, mechanical changes it moves through without much steering.

What Needed Correction

The scary one: a test wiped a real database. While reworking the test setup, the test database name collided with a real database name, so running the suite overwrote data it should never have touched. That is the kind of mistake that ends badly in production. I fixed the test database naming so the two can never share a name again, and added guards so the suite refuses to run against anything but a clearly marked test database.

I also found an authorization gap while I was in there: a record could be deleted by someone who did not own it and was not an admin. Closed it.

The .NET 10 upgrade and a styling change fought me on deploy too. Merging to main brought line-ending problems that cost about two hours of file-formatting cleanup before anything would build.

What Shipped

GCT has a centralized sign-in manager, rate limiting, stronger token validation, and a default-deny authorization policy. The authorization gap on deletes is closed. Test database safety is enforced. GCT and BlankSite are on .NET 10. DevNitro's UI got a styling pass, and I refactored the Workbench MCP into a Core.Workspace library with a thin MCP server on top.

The Numbers

Category Hours
Product / Features 26h 53m
Content 13h 14m
Community 0h 59m
Total 41h 6m

The hours read as styling and .NET 10, but the commits tell the real story: a security pass on GCT that never shows up as its own time bucket because it was woven through the upgrade and the cleanup.

Authentication security is invisible when it works and catastrophic when it does not. Spending a week on it now, before there are customers to lose, is the cheapest that work will ever be. It's amazing that even when security is a priority, it is still easy to miss a gap.

Curious how this site was built?
Watch the 5-minute walkthrough at devnitro.com →

An AI built this blog (but not this post)

This entire blog system (domain models, database, services, UI, auth, etc.) was built by DevNitro on its own in 95 minutes. I recorded every second.

    We respect your privacy. Unsubscribe at any time.

    Built with Kit