#[AsAllowedCallable] in TYPO3 v14: fixing userFunc errors
After the v14 upgrade, TypoScript userFunc calls fail with AllowedCallableException. Why TYPO3 now wants an explicit opt-in, how to find every call, and when a DataProcessor is better.
Composer for TYPO3 projects: path repos, platform and audit
Local extensions belong in Composer too: a path repository for your own extensions, config.platform.php for production, composer audit in CI and abandoned packages.
Claude Code permissions: allowlists, deny rules and sandboxing
Approving every command is tiring, approving everything is dangerous. A settings.json for a TYPO3 project in DDEV, rules I never add, and how hooks and the sandbox fit in.
A tiny MCP server that exposes read-only project checks
Instead of giving an agent a shell, give it three safe tools. A small MCP server in TypeScript that runs composer validate, PHPStan and a frontend smoke check, registered in .mcp.json.
PHP2Shell: check your servers with a few shell scripts
Two critical bugs in the PHP interpreter allow code execution without login. What PHP2Shell is, and five shell scripts to check versions, settings and logs.
Content Security Policy in TYPO3 v13 and v14
A CSP header set by hand in .htaccess fights with the one TYPO3 already sends for the backend. Use the core API instead: feature flags, csp.yaml per site, extension mutations and nonces.
A Claude Code hook that blocks DB writes without a fresh dump
During my TYPO3 migration the agent could run commands that change the database. A PreToolUse hook makes it take a dump first. The script, the registration and how I test it.