Blog

Managed auth, backend-as-a-service, framework-native, or rolled by hand — what each actually costs you, and the migration traps that make auth the hardest thing to change later.

Postgres RLS, Firestore rules, and app-layer authorization compared — how each fails, why RLS breaks your admin tooling, and how to test policies before they cost you.

Why the roles enum you ship in week one becomes a permissions table by month six — and how to model roles, permissions, and multi-tenancy so the migration doesn't hurt.

Hashing, prefixes, scoping, and rotation for API keys — plus why storing keys like passwords breaks the one feature every customer eventually asks for.

Managed Postgres, backend-as-a-service, or self-hosted — what connection pooling, backups, and the serverless connection limit actually cost you before you pick.

Expand-contract, lock-free column adds, and backfilling large tables — why the dangerous migrations are the ones that look trivial.

Cache-aside, HTTP caching, and CDN edge caching compared — plus the invalidation strategies that actually work and the stampede that takes you down at the worst moment.

Server-sent events, hosted realtime, and raw WebSockets compared — including why the reconnect gap loses messages and how presence quietly becomes your hardest problem.

Postgres tsvector, hosted search, and Elasticsearch compared — where Postgres genuinely runs out, why typo tolerance changes everything, and the index-sync problem nobody warns you about.

PaaS, containers, and serverless compared on the things that matter at 2am — rollback speed, health checks, migration ordering, and why zero-downtime deploys break on database changes.

GitHub Actions, platform-native, and self-hosted CI compared — caching that actually hits, why flaky tests destroy the pipeline's value, and securing secrets on forked PRs.

A, CNAME, ALIAS, and the apex domain restriction that breaks naive setups — plus TLS provisioning, propagation reality, and picking one canonical hostname.

Node functions, edge runtimes, and background jobs compared — connection exhaustion, cold starts, the 10-second timeout, and why fire-and-forget silently drops work.

CSS variables, the three-state theme problem, and the blocking script that prevents the white flash — plus why system, light, and dark is three states, not two.

Schema validation shared between client and server, when to validate on blur vs submit, and why client-side validation is a UX feature that guarantees nothing.

Presigned URLs, direct-to-storage uploads, and the validation that matters — why content-type headers lie, and how uploads become an XSS vector.

Server state, URL state, and client state are three different problems — why putting API data in Redux causes most state bugs, and what belongs where.

Resource design, pagination that survives inserts, error shapes, and versioning — the decisions that determine whether adding a field breaks someone's integration.

Checkout vs Payment Intents, why the redirect is not confirmation, webhook idempotency, and treating Stripe as the source of truth for subscription state.

SPF, DKIM, and DMARC in plain terms, transactional vs marketing separation, and why sending from your main domain risks everything you send.

Signature verification, idempotency, retry with backoff, and why receiving webhooks means accepting duplicate and out-of-order delivery as normal.

Finding the actual bottleneck with profiling, query plans, and p99 latency — why averages hide the problem and N+1 queries are almost always the answer.

Testing behaviour instead of implementation, what to mock and what not to, and why 100% coverage on a codebase with no integration tests proves almost nothing.

Structured logging, error tracking, and alerting that means something — grouping, source maps, scrubbing PII, and why alerting on every error trains you to ignore alerts.