Andrew Cates

Adversarial code review that runs the code beats adversarial code review that reads the code.

Each round found something real. The findings got smaller every time — until they stopped.

A tutorial-shaped feature request turned into a lesson about checking for prior art before designing, and about what adversarial code review actually catches that a careful first pass doesn't.

Sanitized write-up. Names/hosts/keys generalized. Not for a specific client.

I had a dozen Next.js + Supabase apps that each reinvented environment configuration — the same layered-dotenv loader forked under a handful of package scopes, inlined into a preload script in some repos, absent in others. Config that varies by environment leaked into the build as NEXT_PUBLIC_ constants, so rotating a URL meant a rebuild. I set out to make one pattern and migrate the first app end-to-end as the template.