Ashar Islam

Software developer. I build things for the web and write about what I learn along the way.

What I do

I work across the stack — mostly TypeScript, React, and Node. Recent work and writing are linked above.

Static analysis for security rules — flags permissive matches, missing catch-alls, and writes that trust request data.

firebasesecurityclinode

A dependency-light editor with live preview, syntax-highlighted code fences, and paste-to-upload images.

reactmarkdownui

Statically exported Next.js site with a Firestore-backed dashboard for writing, publishing, and page composition.

next.jsfirebasetypescripttailwind

The interesting architecture is easier to justify after something is in production. Before that, it is a guess with extra steps.

Allowing unauthenticated writes to one field sounds harmless. Getting the rule slightly wrong turns it into an open door.

Rich text editors produce HTML you cannot reason about. Plain text with a small grammar survives every migration you will ever do.

The top line is where it exploded. The line you actually want is usually further down, in a file you wrote.