DEV Community: Sangyoon Lee

Figma plugin UI has a null origin: how I read a Google Sheet without a server or API key

Sangyoon Lee — Thu, 15 Oct 2026 02:27:40 +0000

I was building a Figma plugin that pulls rows from a public Google Sheet. It looked easy: fetch the CSV, parse it, done. It did not work, and the reason is easy to miss.

The problem

A Figma plugin UI runs in an iframe with a null origin. The Figma docs say this means the plugin can only call APIs that return Access-Control-Allow-Origin: *.

I built a sandboxed iframe with a null origin and tested each way to read the sheet.

Path	Result
docs.google.com gviz/tq?tqx=out:csv	blocked
docs.google.com export?format=csv	blocked
sheets.googleapis.com v4	works, but needs an API key
gviz/tq?tqx=out:json;responseHandler:cb loaded with a script tag	works, no key, no server

Why the export URL fails

The final response of the export URL does have the allow header. But the first answer is a 307 redirect, and that redirect has no allow header. The browser checks the first one and stops.

What worked

A script tag is not subject to CORS. So I ask Google for the JSON-with-callback format and load it as a script:

window.cb = (data) => { /* data.table.rows */ };
const s = document.createElement("script");
s.src = "https://docs.google.com/spreadsheets/d/<ID>/gviz/tq?tqx=out:json;responseHandler:cb&headers=0";
document.body.appendChild(s);

Add headers=0, otherwise Google guesses which row is the header and may eat your first data row.

Lesson

Before writing any code that reads someone else's API from a browser extension or plugin, check with curl whether the API sends Access-Control-Allow-Origin: *. If there is a redirect, look at the headers of the first response, not the last one.

The built-in browser pane of my tool could not run nested sandbox iframes, so I had to do this test in a real Chrome. Testing in the real environment saved me from shipping a plugin that fails on first load.

Have you hit a null-origin problem in another plugin platform, and how did you get around it?

I'm a full-stack developer, 13 years, based in Korea (UTC+9). I work in writing only, and use AI translation, so my English is simple. CV: https://cv.namubase.com

Available for remote contract work: 13-year full-stack dev (billing, admin, payments)

Sangyoon Lee — Wed, 07 Oct 2026 00:10:56 +0000

I'm Sangyoon Lee, a full-stack developer in Seoul with 13 years of experience, and I'm available for remote contract work starting now.

A note up front: I don't speak English well. I communicate in writing and use AI translation for every message, so please expect written replies (within 24 hours, weekends included), not calls or video.

What I build and fix

Admin dashboards and back-office tools (members, orders, settlement, permissions, change history)
Billing, settlement and payment integrations (PG, recurring payments, kiosk/card terminals)
Backends for web and mobile apps, plus Flutter apps shipped to iOS and Android
Stack: Laravel and CodeIgniter, Spring Boot, Node.js/TypeScript, React, Vue, MySQL/PostgreSQL/Redis, AWS, Docker

Things you can check

I replaced a production app's backend (serverless to Spring Boot WebFlux) without forcing a user app update.
I built a multi-channel settlement reconciliation engine (Java 17, idempotent reprocessing, rollback).
I shipped three new services in two months as the only developer, all on schedule.

How I work
Remote only. Scope and acceptance criteria are agreed in a document before I start, progress is written up every week, and I reply within 24 hours, weekends included. Everything stays in writing, so nothing gets lost.

Instead of an interview, the first small task is free
We agree on the scope in writing first (up to about 10 hours of work), and I deliver within a week with a short written update every day. If you like the result, we continue on a paid basis. If not, you've lost nothing. One free task per company.

If you have a backend, admin or integration task that keeps slipping, send me a short description and I'll reply with a plan.

Portfolio: https://cv.namubase.com

I ran my own SEO checker on my own sites. It called every Korean page "thin"

Sangyoon Lee — Mon, 05 Oct 2026 07:57:54 +0000

I built SearchLink, a small tool that checks a web page for SEO problems. A few weeks ago I ran it on my own 21 sites as a QA pass. All 21 answered with 200 OK, but the checker itself had three bugs.

1. Korean pages were marked "not enough text".
It counted words by splitting on spaces. Korean, Chinese and Japanese don't work like that, so a full Korean page looked almost empty. Fix: for CJK text, count every 2 characters as one word.

2. Title and description limits were English only.
Korean characters are wider, so they get cut off in search results earlier. I split the limits: 33 characters for titles and 85 for descriptions when the page is Korean.

3. It nagged pages I hid on purpose.
If a page is noindex or blocked by robots.txt, the checker now just says "hidden on purpose" and stops scoring it.

What I took from this: the best test data was my own real sites, in my own language. English samples would never have shown me bug #1. After the fixes, 110 tests on the paid build and 18 on the free build pass.

If you build anything that reads text, try it on a language that doesn't use spaces. It is a cheap way to find assumptions you didn't know you had.

About me: full-stack developer in South Korea, 13 years, open to remote contracts. I work fully in writing (async), so everything stays documented.
CV: https://cv.namubase.com
SearchLink: https://searchlink.namubase.com

I ship backends alone, in writing: 12 years, 6 products live right now

Sangyoon Lee — Fri, 25 Sep 2026 00:38:29 +0000

I am Lee Sangyoon, a full-stack engineer in South Korea. Twelve years, mostly in small teams where one person takes a feature from the spec to production and then answers for it afterwards. I am open to remote contract work and remote roles.

One condition, stated first so nobody wastes time: I work in writing only. Email, chat, issue trackers, pull requests. No calls, no video interviews. If that rules me out, it rules me out early, and that is fair to both sides. What I offer in exchange is a written trail of every decision, an answer within 24 hours, and a plan you can read before you pay for anything.

And the written trail is the part I would keep even if calls were easy. Every request you make and every answer I give stays on the record. A change of scope and what it costs is written down the moment it is agreed, so it is not a memory contest three weeks later. You can search the whole history of the project, and hand it to whoever takes over from you. In my experience most disputes in contract work start with "but we said" about something nobody wrote down.

Work I was paid for

Children's news app (Flutter, iOS and Android), 2024 to 2026. Shipped to both stores. Then rebuilt the backend from AWS Amplify to Spring Boot WebFlux while the app was live, as the only engineer. Because the API boundary was GraphQL, the app shipped no forced update during the migration. Recurring subscription billing through a payment gateway, Google and Apple sign-in, refresh-token auth. After launch: realtime ratings over GraphQL subscriptions, streak rewards, article translation.

Unmanned study cafe system, 2023. The whole thing: web seat booking and passes, an Electron kiosk in the store, an admin for both, card payment with recurring billing, and a door controller wired to pass state so access reflects payment in realtime.

Healthcare platform, 2020 to 2023. Rebuilt a hospital, patient and operator platform on Laravel 8 API plus React. Three role boundaries and SSO, API documented in Swagger so the app team could work in parallel, AWS setup and deploys run by me.

Realtime chat app, 2019 to 2020. Flutter and Firebase, FCM push, SMS-verified signup, in-app purchase with server-side receipt validation. Scaled from one server to four when traffic outgrew the box.

Before that, 2014 to 2019. A gold trading platform and its app, realtime chat and browser games, an eCRF solution for academic conferences, public sector sites, and a lot of commerce builds. PHP, jQuery and the habit of running my own servers came from here.

Side projects, all live, all built and operated solo

SearchLink (https://searchlink.namubase.com). Connects Google Search Console to Claude and ChatGPT over MCP, mails a weekly report with three things to fix, and alerts when clicks drop. Cloudflare Workers, D1, OAuth, billing.
Public auction price statistics site. A daily cron pulls a government open API and generates about 350 statistics pages. Workers plus D1.
Atlassian Marketplace apps. A Jira markdown editor and dashboard gadgets, through Atlassian's security review and publicly installable. Forge and React.
Marketplace extensions published on WordPress.org, JetBrains, VS Code, Figma and Wix.
Open source. An MCP server for Search Console on npm, listed in several MCP directories.

Stack

TypeScript and Node, Python, PHP and Laravel, Java and Spring Boot (WebFlux), React, Next.js, Vue, Flutter, React Native, Electron. PostgreSQL, MySQL, Redis, SQLite, D1. AWS, Cloudflare Workers, Docker, Nginx, Linux. GraphQL and REST. Payment gateways, in-app purchase receipt validation, social login, FCM.

What I am looking for

Remote contract work or a remote role, backend or full-stack, with written communication. Data pipelines, API integrations, LLM-backed tooling and "this thing must keep running unattended" work are what I enjoy most and what I am fastest at.

Reach me at globalmatchhub@gmail.com. Tell me what is broken or what you want built, and you will get a written plan back, not a meeting invite.

Why your Search Console API impressions don't match the UI

Sangyoon Lee — Mon, 21 Sep 2026 04:38:18 +0000

I was building a small tool that pulls Google Search Console data into Claude, and the first thing that broke was trust. My impressions total was higher than the number in the Search Console UI. Not by a rounding error. Noticeably higher.

Here is what was going on, in case you hit the same thing.

The mistake: summing page rows

The obvious way to get totals is to query by page, then add up clicks and impressions across all rows.

Clicks come out close. Impressions do not.

The reason: Search Console counts impressions differently depending on how you group the data. Grouped by property, one results page counts once. Grouped by page, every one of your URLs on that results page gets its own impression. If two of your pages show up for the same search, that is one impression for the site but two when you add up the page rows.

The fix: take totals from the date dimension

If you want numbers that match the UI, query with dimensions: ["date"] and sum those rows instead. Each day is counted once at the property level, so impressions line up with what Search Console shows.

{
  "startDate": "2026-08-24",
  "endDate": "2026-09-20",
  "dimensions": ["date"]
}

Use page or query dimensions for breakdowns ("which pages lost clicks"), and the date dimension for the headline totals. Don't mix the two in the same number.

Two smaller gotchas

Data lag. The most recent two or three days are usually incomplete. If you compare "last 7 days" to "the 7 before", end both ranges a few days back, or the latest week always looks worse than it is.
Average position is not additive. You can't take a plain average of the position column across rows. Weight it by impressions, or take it from the same date-level query.

What I ended up building

I wrapped this into a small MCP server so I can ask Claude or Cursor things like "which pages lost clicks this month" without exporting a CSV first. It is read-only, runs locally, and takes totals from the date dimension.

Disclosure: I built it. It's free and MIT: https://go.namubase.com/slite?s=devto-0921

If you've found other places where the API and the UI disagree, I'd like to hear them.