Fixing SSR Cookie Handling & CSP on Tavus Portal Calls — September 2, 2026

Today I tackled a couple of significant issues that were threatening the functionality of my agentic web platform. In just about an hour, I shipped two crucial fixes: one addressing the server-side rendering (SSR) cookie handling for anonymous requests and another dealing with the content security policy (CSP) regarding the Tavus portal calls. Both were essential to ensure that the user experience remains seamless and secure, which is my top priority as I build this platform toward a billion-dollar valuation.

The first fix I implemented was related to the gp_theme cookie. I realized that the shared Nginx page caches were not varying on the gp_theme cookie, which led to a potential cache-poisoning issue. Essentially, when an anonymous visitor accessed the site, their theme preference could inadvertently bake a dark-variant page that was then served to everyone else. This could confuse users and degrade their experience, so it was imperative to fix this. I modified the theme handling logic to ensure that the cookie is never SSR for anonymous requests. This way, the page served remains consistent and accurate for all users, regardless of their cookie state.

The second fix involved the daily-js call machine, which is responsible for handling portal calls in the Tavus system. I encountered a CSP issue that was causing every portal call to fail at the join stage. The enforced CSP allowed wasm-unsafe-eval but not unsafe-eval, and the default loader for daily-js was using eval() to fetch the call-machine bundle. This was a significant blocker, as it meant that none of the portal calls could execute successfully. To remedy this, I updated the loading mechanism to avoid using eval and instead utilized a more secure method that complies with the CSP. This fix not only resolved the immediate issue but also strengthens the overall security posture of the platform.

Reflecting on these fixes, it’s clear that every hour spent on debugging and refining the platform is crucial. While I often wish I had a larger team to bounce ideas off or to share the workload, I find that these challenges also provide valuable opportunities for learning and growth. Working solo with Claude Code in VS Code has allowed me to maintain a high degree of control over the project, but it also means that I need to be vigilant about every aspect of development. Each bug I encounter teaches me something new about the architecture of my platform and how to better structure my code.

As I continue to refine the hashtag.org platform, I’m reminded that every detail matters. The agentic web is about creating a seamless, interactive experience for users, and that requires attention to the smallest elements, such as cookie management and security policies. The fixes I rolled out today are foundational, ensuring that the platform remains robust as I add more features and capabilities in the future.

Going forward, I plan to keep a close eye on user feedback and analytics to ensure that these changes resonate positively with users. I also intend to dive deeper into optimizing the performance of the portal calls and exploring additional security measures that can fortify the platform against potential vulnerabilities. Each small step, like today's fixes, brings me closer to realizing my vision of a one-man-show that delivers a billion-dollar valuation.

In summary, while today was spent fixing critical issues, it’s a reminder of the importance of diligence and precision in the development process. As I build this platform, I remain committed to continuous improvement, ensuring that every user interaction is smooth and satisfying. With each fix, I am not just patching bugs; I am laying down the groundwork for a powerful, user-centric agentic web experience that I believe can truly stand out in the market.