Evomedia.netBlog
Technical deep-dives from the trenches.
AWS, Docker, nginx, full-stack deployments, and lessons learned building and running production systems.
-
The Records Existed: An AI's False "No Data" Answer, Worked Like a Plant Incident
The evo.ehs AI answered "nothing matches your records" while 75 permits sat in the database — it had even routed the question correctly. A five-whys root cause analysis and a verified CAPA, written up the way evo.ehs itself makes plants investigate incidents, with the code that was wrong and the code that fixed it.
-
When a Program Update Bricks the App: An MSIX Job-Object Deadlock
A desktop auto-update failed with 0x80070020 and left the app unable to launch — behind a dialog that blamed a locked file. The real culprit was a packaged Windows service holding its own package's job object, a lock no user-mode workaround can break. The walk from the misleading symptom to the one command that fixed it.
-
Nine Tools Where There Were Thirty-Five: A Claude Code computer_unreachable Postmortem
After a reinstall, every existing desktop Code session failed with "Remote Control host unreachable" while new ones worked fine. The tell was in two log lines: the device re-registered nine tools where there had been thirty-five, with the whole computer_* family missing.
-
AWS EC2 Recovery: Two-Layer Backup with AMI and Configuration Export
When an EC2 instance disappears, you need both the disk (data) and the wiring (network, security, IAM). Create an EBS AMI for restorable backups and export JSON configuration files for deployment recovery.
-
AWS 502 Bad Gateway: Stop CloudFront from Caching Your Deploy Outages
Every deploy was triggering a CloudFront-cached 502 that forced a manual invalidation. Here's the three-part fix — nginx DNS TTL, CloudFront error caching, and the cache policy that finally made deploys silent.
-
Stored XSS in Admin Dashboards: The innerHTML Trap and How to Escape It
User-controlled data from logs and APIs ends up in innerHTML, turning your admin dashboard into an attack surface. How this vulnerability happens, why escaping matters, and the DOM API fix.
-
SMTP Header Injection via Form Fields: Why .trim() Isn't Enough
A contact form that sanitizes HTML but forgets newlines becomes an SMTP header injection vector. How attackers inject Bcc:, Cc:, and Subject: headers, and the one-line fix.
-
Security Headers You Forgot: CSP, X-Frame-Options, and nginx
Most sites skip the headers that actually stop browsers from being tricked. A practical guide to CSP, X-Frame-Options, X-Content-Type-Options, and why nginx is the right place to enforce them.
-
CloudFront Cache Busting Beyond Invalidation: Immutable Assets and Smart Versioning
Manual invalidations are a sign you're fighting your CDN. Vite's content hashing, immutable headers, and origin cache-control policies eliminate the need for cache busting entirely.