Notes from
the front door.
Product updates, security write-ups and practical guides on sign-in, sessions and running a B2B product.
Latest posts
Security
·
Why your sign-in page should never say “wrong password”
Small copy decisions that stop account enumeration without making the page harder to use.
Kwame Asante
Guides
·
A practical guide to organizations and roles
How to model teams, invitations and permissions so your B2B plan doesn't need a rewrite in a year.
Aarav Mehta
Product
·
Designing a sign-in form people finish
Four details from a year of testing: field order, error timing, social buttons and remembering the last method.
Hana Sato
Engineering
·
Moving two million users off a homegrown auth system
How Kestrel migrated with password hashes intact and no forced resets, over a single weekend.
Lucía Ferrer
Guides
·
Sessions, explained without the jargon
Tokens, refresh, revocation and multi-tab sync, in plain language for the rest of the team.
Ines Moreau