# rxj.dev

> Writing on security, AI agents and architecture by Ron Jansen.

rxj.dev is the personal site of Ron Jansen, a founder and CTO in the Netherlands. The essays cover AI agent security, agent architecture, and building software with coding agents. Every post is available as Markdown by replacing the trailing slash of its URL with `.md`. The full text of every post is at https://rxj.dev/llms-full.txt, and as schema.org JSON at https://rxj.dev/nlweb/items.json.

## Posts

- [I Replaced my Accountant by Claude](https://rxj.dev/posts/replaced-accountant-by-claude.md): Building an agentic system on top of Moneybird that processes invoices, matches bank transactions, flags what is missing and drafts the annual report. A digital twin, task-based evals, scoped API keys, and where it got dangerous.
- [Hunting Zero Days with T3MP3ST and Pi](https://rxj.dev/posts/hunting-zero-days-with-pi.md): T3MP3ST claims to beat XBOW on its own 104-challenge suite. I ported it to the Pi agent harness to run any model, cut the prompt bloat and start building my own evals. First run found three low-severity bugs for under a dollar.
- [Principles of Agent Factories](https://rxj.dev/posts/agent-factory-principles.md): Agent factories are a set of principles, not a platform. What it takes to run a fleet of AI agents reliably - orchestration, isolation, observability, human intervention points, and benchmarks built from real cases.
- [Software is a Service](https://rxj.dev/posts/software-is-a-service.md): AI made generating code cheap. The value moves to the people who keep software secure and running. SaaS becomes SiaS.
- [Breaching Your Own Security Rules](https://rxj.dev/posts/coding-agents-writing-own-rules.md): Coding agents manage their own permission files. That's a fundamental security architecture flaw, and the CVEs prove it.
- [How I use Roo Code to go beyond Cursor](https://rxj.dev/posts/why-roo-code-is-better-then-cursor.md): Roo Code modes pair role-specific instructions with the model of your choice. How I set up tech lead, backend and frontend modes with Gemini Flash to get most of what Cursor gives me for a fraction of the cost.
- [Npm Run Hack:Me - A Supply Chain Attack Journey](https://rxj.dev/posts/npm-run-hack-supply-chain-attack-journey.md): I thought I was being recruited. Instead, I gave hackers access to my system by running a simple 'npm run start'. Discover how the tech details of this supply chain attack and how to protect yourself.
- [Introducing dmn.so](https://rxj.dev/posts/introducing-dmn-so.md): Tired of domain name generators suggesting only taken domains? Discover dmn.so, my AI-powered tool that finds premium, short, available domain names—and it's free to try now!
- [1 km/hour coding sessions](https://rxj.dev/posts/1-km-coding-sessions.md): Discover how running 1 kilometer every hour during the workday can boost productivity, maintain focus, and improve physical health for remote developers.
- [The 4 hour strategic plan](https://rxj.dev/posts/4-hour-strategic-plan.md): How a simple 4-hour time-boxed approach can help you evaluate potential projects and make confident decisions without analysis paralysis.
- [The Power of Compounding](https://rxj.dev/posts/power-of-compounding.md): Beyond finance, discover how the principle of compounding can transform your knowledge, skills, relationships, and more—if you have the right systems to prevent loss over time.
- [The last bookmark manager](https://rxj.dev/posts/lastmark.md): Frustrated with bookmark managers that disappear or overcomplicate? Discover Lastmark—the minimalist, open-source solution designed to be your final bookmark home for the next 30 years.
- [Why not use HTMX?](https://rxj.dev/posts/why-not-use-htmx.md): HTMX is revolutionizing web development, but what are its downsides? Explore the trade-offs of server-driven UI, from latency issues to silent failures that might impact your project.
- [Interactivity is just a detail](https://rxj.dev/posts/interactivity-is-a-detail.md): Have we overcomplicated web development? Discover why JavaScript frameworks might be overkill for most sites and how returning to basics could save you time, complexity, and headaches.
- [A bootstrappers tech stack](https://rxj.dev/posts/bootstrap-stack.md): Forget type safety and fancy frameworks—when bootstrapping, speed is everything. Why simpler tech stacks let you validate ideas faster and avoid burning through savings.
- [Code architecture for indie devs](https://rxj.dev/posts/write-maintainable-code-as-indie-dev.md): Are you over-engineering your side project? Learn why complex architecture patterns might be slowing you down and how focusing on shipping—not scalability—is the key to indie success.
- [How to design a web app as developer](https://rxj.dev/posts/how-to-design-a-web-app-as-a-developer.md): A developer-friendly approach to web design that breaks the process into manageable phases—no Figma skills required.

## Optional

- [About Ron Jansen](https://rxj.dev/about/): bio, background and links
- [RSS feed](https://rxj.dev/index.xml): full-content feed of every post
- [Full text of every post](https://rxj.dev/llms-full.txt)
- [All posts as schema.org JSON](https://rxj.dev/nlweb/items.json): the NLWeb corpus
- [Ask this site](https://rxj.dev/ask?query={question}&streaming=false): NLWeb endpoint, returns matching posts as schema.org JSON; MCP server at https://rxj.dev/mcp