Wigley Studios Blog

Expert insights on AI-powered UI generation, media deduplication, UI kit design, and developer tools.

Guides

Proving the Ban Lands: fail2ban Config You Can Actually Verify

Ours was installed, configured, and enabled — and dead for 95 days, because “enabled” describes what systemd intends at boot, not what survived it, and an empty firewall chain looks identical to a working one. The four-command drill that proves a ban reaches the kernel, why “grep for your f2b chain” turns out not to be a readiness test at all, the five clocks to read together, and the two honest side effects of testing on a live box.

Read Article
August 21, 2026 11 min read
Products

Six Tools That Never Send Anything — and the Ninety-Second Way to Check

Every tool page promises "your data never leaves your browser." A promise is not a receipt. The six free-resources scripts — 1,592 lines re-audited on publish morning — contain no network primitive at all; here's the DevTools drill that proves your input stays in the tab, the full inventory of what the pages do load (CDN engines, icons on every page, first-party analytics, and the one form that sends what you type when you submit it), and what blocking the CDN actually costs.

Read Article
August 20, 2026 10 min read
Engineering

How to Fetch a URL a Stranger Typed: SSRF, DNS Rebinding, and the Transport That Pins

Four of our public checkers fetch whatever URL a stranger submits — the textbook SSRF setup, operated on purpose. Why "validate the hostname, then fetch the hostname" fails to DNS rebinding, the httpx transport that pins the validated IP while SNI and the Host header keep the typed name, why refusing redirects is the half everyone omits — and the honest census: one guard, four copies, and the browser path where the pattern ends.

Read Article
August 19, 2026 11 min read
Insights

The Expiry Date Someone Else Set: Building Against a Deadline You Don't Own

Shopify shuts off legacy checkout ScriptTags for non-Plus stores on August 26 — eight days after this publishes. Inside the app built for that date, the deadline lives two ways: as data read by a function that takes the clock as an argument (whose Plus arm was born already flipped), and as English prose — a plan card, a scan line, two marketing headings — that will sit in the wrong tense the morning after. A census of both, recomputed on publication morning.

Read Article
August 18, 2026 10 min read
Comparisons

Old Glory vs the FTC "All or Virtually All" Standard: What a Scanner Can Flag, and What Only Your Records Can Prove

The FTC says an unqualified Made in USA claim needs competent and reliable evidence before it goes up — and nothing that reads a storefront can supply that. What the scanner actually reads (five fields and your declared origin data, under a ruleset dated 2026-06-05), the FTC-charged phrase its keyword layer misses, why one qualified phrase stands it down at the product level — and the executive order, April sweep, and July warning letters that made this the year to keep records.

Read Article
August 17, 2026 12 min read
Guides

Knowing It Broke Before Your Users Do: The Fourth Leg of a VPS Deploy

Deploy, migrate, restore — and then the box sits unwatched. The recurring process the series never built: a five-minute watcher that dedupes its own alerts (four ticks, one mail, one all-clear), the phantom unit that paged 187 times about a service that didn't exist, cron's compiled-in thin PATH and the single binary it broke, the expired cert an edge served over a healthy origin — and the greenest checkmark on the box, guarding a truncated file. All production, all dated.

Read Article
August 14, 2026 12 min read
Products

Inside AgeProof: How a Checkout Block Survives a Shopper With DevTools

The age-gate cart attribute is buyer-writable — one console POST rewrites it — so the block verifies a signed token in Shopify's Function sandbox with hand-written, vector-pinned crypto (50/50 tests this morning). The honest spine: the mint endpoint was fail-open until this month, we found it auditing our own claims, and the fix — fail-closed verdict, merchant-owned minimum age, server-side age check — is the best illustration of the design principle the product is built on. Plus the metafield cliff, the fail-open/fail-closed merchant switch, and the boundary no cryptography moves.

Read Article
August 13, 2026 12 min read
Engineering

How to Verify a Webhook Chain: Declared, Registered, Delivered, Recorded

Webhooks die in the gap between configuration and reality, and that gap is four separate links proven at four different surfaces. Worked against two live systems — a TOML-declared Shopify app and a FastAPI service taking Stripe events — including the retry-storm signature, the 401 you're required to return, and the uncomfortable truth: the registered link can't be checked from your own infrastructure, and silence never answers it.

Read Article
August 12, 2026 12 min read
Insights

Seven Apps, No Order or Customer Scopes: What Least Privilege Actually Costs

18 permission slots, 12 distinct scopes, zero order or customer access — recomputed from the config files on publication morning. What each refusal cost and how every capability came back a different way: a theme extension instead of theme edits, an app-owned metafield instead of a write scope, a crawler where a permission would have been — plus the places the boundary is thinner than the scope list suggests.

Read Article
August 11, 2026 11 min read
Guides

Backups You've Actually Tested: The Third Leg of a VPS Deploy

A backup nobody has restored is a belief, not a backup — so we ran the rehearsal against our own four production databases while writing this, and one of them does not restore. The dump flags that matter, the scratch-schema procedure, the timing number nobody knows, and the errno 150 that passed every artifact check for months.

Read Article
August 7, 2026 11 min read
Products

Inside Cited: How to Ask Three AI Models Whether They Know Your Store

The Inside series reaches the other shelf. Eight deterministic buyer questions, three web-grounded providers queried concurrently (never bare models — that would measure training memory), substring scoring that never asks an AI to judge an AI — and the disclaimer the app doesn't say yet: one run is a sample, not a verdict.

Read Article
August 6, 2026 10 min read
Engineering

How to Handle File Uploads in FastAPI: Validation, Limits, and the Traps

An upload endpoint is the one place strangers hand your server arbitrary bytes to keep. The validation gauntlet in the order an attacker defeats it — with production constants, the decompression-bomb guard, the re-encode that strips GPS data, and the .read() trap our own oldest handler still walks into.

Read Article
August 5, 2026 12 min read
Insights

What $918 of Ads Bought: A Distribution Post-Mortem

A year of arguing that building is the easy part, and here is the receipt: $918.50 of marketplace ads, 17 installs, zero customers. The bid experiment that proved neither bids nor budget was the constraint — impression supply was — and the narrow lesson that beats “ads don't work.”

Read Article
August 4, 2026 9 min read
Guides

Adding Alembic to a ShipKit Project: The Migration Layer It Doesn't Ship

Last Friday's deploy guide told you the schema was your problem and declined to solve it. The follow-through, written in the order that matters: retrofitting onto a database that already has data — the stamp-versus-upgrade trap, the first autogenerate's destructive diff, and the MySQL behaviors that break Postgres habits.

Read Article
July 31, 2026 12 min read
Insights

Stale by Tuesday: Why Your Product Claims Rot Faster Than Your Code

Your code has tests, CI, and a deploy gate. The sentences about your code have nothing — and they decay silently, because no build goes red when a claim stops being true. Four false claims from our own site last week, the one mechanism behind all of them, and the certificate-renewal fix.

Read Article
July 28, 2026 9 min read
Comparisons

UI Kit Packs vs shadcn/ui: Buying Components vs Copying Them

Both sides say “you own the code” and mean different things by it. shadcn/ui is free, excellent, and the right default on React + Tailwind — we say so plainly. The honest axis is framework lock-in: what your project is built on decides this before taste does.

Read Article
July 27, 2026 9 min read
Insights

Nobody Agrees What "Production-Ready" Means. Here's the Bar.

The phrase appears on thirty pages of this site, including the homepage — and means something different to everyone who reads it. It isn't a property of your code; it's a property of what happens when things go wrong. Four checkable questions, and permission to ship when you can't clear them.

Read Article
July 21, 2026 9 min read
Products

The Wigley Studios Lineup, Mid-2026: What Ships Today

A mid-year catalog of every Wigley Studios developer tool that ships today — what each one is, its current price, and who it's for. The design pipeline, the backend pipeline, and the standalones (PicSift, PostPilot, Chiave), grounded entirely in the live product pages.

Read Article
July 15, 2026 10 min read
Engineering

How to Run Zero-Downtime Database Migrations with Alembic

A schema change shouldn't take your site down. Where autogenerate lies (renames become data loss), the expand-contract pattern step by step, why additive migrations run before the code, and the MySQL-vs-Postgres DDL gotchas that bite. SQLAlchemy + Alembic.

Read Article
July 14, 2026 11 min read
Insights

Software You Can Finish: The Case for Done

The industry reads “last commit 8 months ago” as a death certificate — but some software is simply done. Finishability is a design property: a bounded problem, few dependencies, a stable platform underneath. The case for building things that can actually be finished.

Read Article
July 13, 2026 9 min read
Insights

The Maintenance Tax: What Software Really Costs After You Ship

Launch day isn't the finish line — it's day zero of a bill nobody prices in: dependency churn, security patches, breaking upgrades, and bit-rot. The recurring cost of keeping software alive, and why you should choose tools by their maintenance surface. The tax trilogy's closer.

Read Article
July 10, 2026 9 min read
Insights

The Hidden Cost of Free Developer Tools

Free developer tools extract value in ways that aren’t always obvious. Data, lock-in, feature gates, and ecosystem dependency — how to evaluate total cost of ownership.

Read Article
Apr 1, 2026 10 min read

Stay Updated

Get the latest articles on AI UI generation, photo management, and frontend design delivered to your inbox.