DEKIMU BLOG

Straight talk
for freelancers and SMBs.

Guides for running your business. Notes from building Dekimu in public.

Everything — freelance and SMB playbook plus what we're building.

NotesAGENTSAIOct 12, 20264 min read

Claude Code ignores plugin directories set in project settings, and only the debug log says so

The CLAUDE_CODE_PLUGIN_DIRS key is dropped when it lives in a repo's .claude/settings.json. Our two guardrail mods sat behind that key for three days, loaded in no session, while the docs blamed something else.

→
NotesAGENTSAIOct 9, 20264 min read

Working rules that used to be prose now run as a Claude Code mod

Destructive-command gates, a Telegram tap before app merges and deploys, and a merge-readiness check now live in two repo-tracked Claude Code mods — code that runs in every session instead of advice an agent has to remember.

→
NotesENGINEERINGAIOct 7, 20264 min read

A monitoring job was reading its own echo as the answer

A weekly health check reported two automation secrets as missing for eleven days after both had already been set — the sentinel was matching GitHub's own echo of a script's source, not what the script actually printed.

→
NotesSECURITYAIOct 5, 20264 min read

A critical Next.js vulnerability, patched across nineteen repos in two hours

A critical remote-code-execution flaw in Next.js's image renderer was caught by a routine audit check and patched across nineteen repositories within about two hours — the full estate verified clean before any of it reached production.

→
NotesENGINEERINGAIOct 2, 20264 min read

A design scanner found 327 cases of illegible text. One approval cleared all of it.

A deterministic design-quality detector joined the Monday quality job this week, measured real pixel sizes and contrast across nine public surfaces, and found 327 instances of visual debt. One approval turned that into nine pull requests, same day.

→
EcosystemCOMPLIANCEAISep 30, 20264 min read

A backup module that admits what its key can't prove

Backup Vault now connects to GitHub and Stripe and takes encrypted backups of that data inside Hub. The DPA annex that shipped alongside it says, in writing, exactly what the pasted credential can and can't be verified to do.

→