Hugo

I rebuilt the GitHub tools docs. The structure, the design and the illustrations all changed. The structure now follows the order you’d learn it in: the basics first, then one concept per page, then guides and reference. You shouldn’t need to know what you’re looking for before you can find it. The look is new too, with a new landing page, a new docs home and a new sidebar. And almost every page now opens with a small animated figure. I’ve come to think this matters as much as the writing. A paragraph tells you what happens, but you have to rebuild the sequence in your head. A figure shows it in a few seconds, and the text underneath only has to fill in the details. github-tools.com/docs

So much free, rare, and truly valuable content here 👇

Public apology to @atinux, who's been yapping about @AmpCode for weeks while I kept saying "yeah yeah, I'll try it". I tried it. It's like good, like really good. He was right, which is the worst part.

Just made some huge updates to github-tools.com today and your agent is going to hate it: it just got onboarded like a new hire at a big company. It only gets the repos and branches you give it, and the GitHub permissions of whoever asked for the work. It spends its first days shadowing, in dry run on your real repos, so you can read what it would have done. Small things you asked for, it handles on its own, with a note saying why. Anything bigger goes through you. It also did the security training. It reads issues the way they look on the page, without the hidden instructions, and keeps any token it comes across out of what it posts. For you, all of that is a few lines in one file.

Working on my portfolio is so enjoyable now. The light follows the day, the hour moves, a chime strikes every quarter hour. It lives while I work on it. The last piece is the 404, a drawing of my watch. Take your time with it, look closely, and be gentle hugorcd.com/404

evlog.dev is now downloaded more than 1 million times a week. Thank you ❤️

Few packages in your app see as much as your logger. Every request, every header, every error, and sometimes a password nobody meant to log. With the state npm is in right now, I really didn't want evlog to be the weak link. So I worked on two things: making evlog a package you can trust, and making the apps that use it safer without anyone having to think about it. Both ship today in evlog 2.x and 3.0. For the package itself: - no dependencies, so npm i evlog adds exactly one package - only its release workflow on GitHub can publish it, no npm token can - no version goes live until I approve it with 2FA - every version has provenance you can check with npm audit signatures - the evlog command runs the CLI released with your version, never whatever is latest For your app: a lot of leaks aren't attacks, just a log line nobody looked at twice. So in production, evlog redacts before the console and before any drain: - GitHub, npm, AWS, Stripe, Slack, OpenAI and Anthropic credentials, recognised by their shape whatever the field is called - private keys and passwords inside database URLs - any key ending in password, secret or token, at any depth - emails, card numbers, IPs and JWTs, masked so a***@***.com still helps you debug And whatever the environment, it never: - collects Authorization, Cookie or API key headers - puts an error's internal details in the HTTP response - records AI prompts, outputs, tool inputs or agent messages unless you ask - lets a malicious header fake a line in your terminal - writes log files other users can read There's nothing to configure for any of it. You shouldn't have to be a security expert to keep a password out of your logs. When you do need an audit trail, it's built in: who did what, denied attempts included, and signed() can sign each entry with your secret, so an edited one no longer matches its signature. None of this makes evlog impossible to attack. It leaves far fewer ways in, and you can check every claim yourself.

If you want your PRs to look like this: npx skills add hugorcd.com --skill pr-writing Then add one line to your AGENTS.md so your agent loads it every time.

As agents write more of our code, we'll read less of it, and the pull request becomes most of what we judge a change by. So every PR I open now says who did what, shows the change with real evidence (before/after, both outputs, measured numbers), and ends in plain words. I wrote up how it works, what it doesn't fix, and a skill to do the same. hugorcd.com/writing/what-my-…

Louder

My favourite detail on my new portfolio is the hour in the top right corner. Lift the corner of the page and you'll find what keeps it: a watch movement, drawn as a plan, running at 21,600 beats an hour. That's the beat of the hand-wound movement in the Santos-Dumont I wear every day. That watch was my dream for years. I bought it when I joined @vercel. It was a huge step in my career, and I wanted to mark that moment with something I'd keep forever. So my site and my wrist keep time at the same pace. hugorcd.com

No words can describe how gorgeous this font is, the goat did it again @evilrabbit_ 🤌

No brainer

Another insane ship by the goat himself @antfu7

New post on why I redesigned my portfolio the way I did. There's a lot behind making it simple, complex, and genuinely mine. Proud of this one. hugorcd.com/writing/how-i-re…

Thanks you all 💚

ℋ

evlog, recently: - One evlog.config.ts, read by any framework, eve and the CLI, shareable across projects - 1.98 MB → 906 kB on disk - 4.6× faster per request - Effect support in beta, by @justyannicc and @just_be_dev And the first 3.0 beta is tagged → evlog.dev

One of the coolest and most beautiful @nuxt_js projects I've seen!