#web-security

The S in HTTPS is TLS, and it buys three things people lump into "encryption": confidentiality, integrity, and authentication. The one nobody mentions, authentication, is the one that actually matters.

The server-client boundary is a clean idea. The runtime serialization errors it throws at 2am are not. Here's what breaks when React Server Components meet real traffic, plus the CVSS 10.0 flaw that hit the whole ecosystem in December 2025.