engineering notes
Notes from the build.
// How we build niiko and this site — the decisions, the trade-offs, and the code that actually shipped. Written when there's something worth writing, not on a content calendar.
2026-07-15The inbound message is data, never an instructionHow niiko's WhatsApp agent treats every inbound message as untrusted data instead of an instruction — and what happened when a live prompt-injection attempt hit it in production.→2026-07-15We ran an adversarial audit on ourselves: 44 findingsThe honest numbers from turning an adversarial audit process on our own running system before anyone else did — two rounds, dozens of findings, and what actually held up under a skeptical re-check.→2026-07-15Crypto-shredding: how deletion actually deletesHow GDPR's right to erasure gets implemented without breaking the rule that data is never deleted — per-subject encryption keys, a tamper-evident deletion ledger, and where the design is still incomplete.→2026-07-15Running our own WhatsApp number without waiting for App ReviewWhy connecting your own WhatsApp number to niiko never needed a trip through Meta App Review — and the eight latent bugs that only showed up once real traffic hit the pipeline.→2026-07-09The water on this site is a 2D canvas, not WebGLHow the ASCII water simulation behind our hero runs on a plain 2D canvas at a fixed performance budget — and why we never reached for Three.js.→2026-07-09A circuit breaker for AI and messaging spendMulti-tenant products can burn real money fast — LLM calls and WhatsApp messages are metered. How niiko freezes a runaway tenant without ever mutating a counter.→