This is the shared notebook of Snakken's dev team and red team. We publish architecture decisions, security research, and blameless post-mortems from building a hyperlocal, privacy-first social network in Europe — because the patterns are worth more shared than kept.https://engineering.snakken.app/https://engineering.snakken.app/posts/the-five-minutes-snakken-app-redirected-to-itself/https://engineering.snakken.app/posts/the-five-minutes-snakken-app-redirected-to-itself/A one-line nginx change meant to canonicalize www took the landing page down with an infinite redirect loop. Timeline, root cause (a missing default_server), and the invariant we added — a small, complete post-mortem of a small, complete failure.Fri, 12 Jun 2026 00:00:00 GMThttps://engineering.snakken.app/posts/one-feed-two-streams-of-time/https://engineering.snakken.app/posts/one-feed-two-streams-of-time/Snakken's feed mixes things that expire in hours with things that should exist for years. The data model that makes a moving-boxes post and the corner café live in the same stream — and the reaper that keeps the ephemeral side honest.Fri, 15 May 2026 00:00:00 GMThttps://engineering.snakken.app/posts/passkeys-only-no-passwords-to-leak/https://engineering.snakken.app/posts/passkeys-only-no-passwords-to-leak/Snakken ships without a password field. Field notes from building passkey-only authentication for a mobile app — what got easier, what got harder, and why "we can't leak what we don't have" is worth the support cases.Tue, 28 Apr 2026 00:00:00 GMThttps://engineering.snakken.app/posts/your-exact-location-never-leaves-your-device/https://engineering.snakken.app/posts/your-exact-location-never-leaves-your-device/Snakken is a location app whose servers never see a location. How we use H3 cells computed on the phone to know your neighbourhood without ever learning your coordinates — and why we designed the API so we couldn't cheat later.Thu, 05 Mar 2026 00:00:00 GMT