Learning in public
The fundamentals still matter in the AI era.
AI can draft code faster than anyone can read it. What lasts is the discipline underneath: understanding how things actually work, keeping them secure, and maintaining them over time. This blog is me learning to hold both, and writing down what makes it click.
- AI
- Vibe coding
- Fundamentals
- Security
- Maintenance
Writing
Latest articles.
- Sep 10, 2026 7 min read
Give everything only the keys its job needs
One of the biggest card breaches in history started with an air-conditioning contractor who had far more access than they needed. The principle that would have stopped it is simple: every user, token, and piece of code gets only what it needs, nothing more. Here is least privilege, and why it is really a bet on the day something leaks.
- Sep 10, 2026 7 min read
Ship the code, reveal the feature later: what feature flags really do
The scariest part of shipping is that deploy and launch happen at the same instant. Feature flags split them apart: the code goes to production switched off, and you turn it on later, for a few users first, and off again in a second if it breaks. Here is how they work and the debt they quietly build.
- Sep 10, 2026 5 min read
What the version number is actually trying to tell you
You update a package and your app breaks, or you are too scared to update anything at all. The three numbers in 2.14.3 were telling you whether that update was safe, if you knew how to read them. Here is semantic versioning, the caret and tilde that trip everyone up, and why the whole promise rests on trust.
- Sep 10, 2026 8 min read
Why clicking pay twice should not charge you twice
Your payment request times out. Did it go through? If you hit retry, will you be billed twice? The answer to that everyday panic is one word, idempotency, and it is a fundamental every backend needs. Here is what it means and how it is actually made safe.
- Sep 10, 2026 7 min read
Your password is not encrypted, and that is a good thing
Encoding, encryption, and hashing all turn readable data into gibberish, so people use the words interchangeably. They do opposite jobs, and mixing them up is behind real breaches. Here is the difference, why a good site hashes your password instead of encrypting it, and why Base64 is not a lock.