Agentic Web AEO Enhancements and Security Fixes — August 24, 2026

Today, I focused on enhancing the AEO capabilities of my agentic web platform while tightening security protocols. After a solid 5-hour session, I shipped ten features and improvements along with one critical fix. The work was driven by the need to optimize how our portal interacts with AI and to ensure a smoother user experience overall. I expanded our portal directory with a new endpoint for the /llms-full.txt, which now serves a complete public portal directory along with a cost and industry URL matrix. This is crucial since agents are increasingly probing this endpoint, and I want to ensure they get the best and most relevant information right away.

In addition to the AEO enhancements, I made significant strides in security. One of the highlights was implementing a full nonce-less baseline policy for Content Security Policy (CSP). This change helps prevent script injection and ensures that cached HTML can never go stale against a policy with no nonce. It was a bit of a rabbit hole — I had to dig deep into how the old policy was structured and what was holding it back since the last major update. The original setup was overly complicated, and the transition to a more streamlined approach took longer than expected but ultimately resulted in a much more secure environment.

I also tackled some persistent bugs that had been causing issues for users. The fix for the /api/auth/me endpoint was particularly rewarding. Previously, it returned a 200 status with a user:null response for anonymous users, which cluttered the console with errors on every page load. Now, it correctly returns a 401 status for unauthorized access, making the experience cleaner for users and reducing confusion. This fix was a reminder of how small oversights can cascade into larger issues, especially when you’re working solo.

On the SEO front, I optimized the sitemap by stopping the hourly regeneration of lastModified timestamps on static routes. This was an interesting challenge because I had to balance the need for accurate indexing with the risk of teaching Google to distrust the lastModified field. The change should help maintain the integrity of our evergreen routes and ensure that Google recognizes when real updates occur. I learned a lot about how search engines interpret these signals, which is invaluable for our ongoing efforts in agentic SEO.

Another area I improved was the handling of 404 errors. Previously, a catch-all redirect turned every dead or mistyped URL into a soft-404, which flooded Google Search Console with noise. I’ve now implemented a real 404 page that returns the correct status, guiding users back to relevant content without dead ends. This switch not only benefits our users but also enhances our indexing strategy, as search engines will get an accurate picture of our site structure.

The session also included some housekeeping tasks, such as auditing dependencies through npm. I managed to reduce the number of advisories from 60 down to 34, which felt like a small victory. While I still have to tackle the remaining advisories tied to major version bumps, this cleanup is essential for maintaining a stable and secure codebase. I co-authored many of these changes with Claude Fable, which has been a fantastic support in this solo venture.

Overall, today’s work reinforced the importance of continuous improvement and vigilance in both SEO and security. As I build this platform toward a billion-dollar valuation, every enhancement and fix counts. The lessons learned today will not only help in the immediate term but also contribute to the long-term success of the project. With each commit, I feel more confident in our direction and the capabilities we’re building into this agentic web platform. There’s still a long way to go, and I’m looking forward to tackling whatever comes next.