Blog
Articles on AI, software fundamentals, security, and maintenance.
- Sep 10, 2026 7 min read
Give everything only the keys its job needs
One of the biggest card breaches in history started with an air-conditioning contractor who had far more access than they needed. The principle that would have stopped it is simple: every user, token, and piece of code gets only what it needs, nothing more. Here is least privilege, and why it is really a bet on the day something leaks.
- Sep 10, 2026 7 min read
Ship the code, reveal the feature later: what feature flags really do
The scariest part of shipping is that deploy and launch happen at the same instant. Feature flags split them apart: the code goes to production switched off, and you turn it on later, for a few users first, and off again in a second if it breaks. Here is how they work and the debt they quietly build.
- Sep 10, 2026 5 min read
What the version number is actually trying to tell you
You update a package and your app breaks, or you are too scared to update anything at all. The three numbers in 2.14.3 were telling you whether that update was safe, if you knew how to read them. Here is semantic versioning, the caret and tilde that trip everyone up, and why the whole promise rests on trust.
- Sep 10, 2026 8 min read
Why clicking pay twice should not charge you twice
Your payment request times out. Did it go through? If you hit retry, will you be billed twice? The answer to that everyday panic is one word, idempotency, and it is a fundamental every backend needs. Here is what it means and how it is actually made safe.
- Sep 10, 2026 7 min read
Your password is not encrypted, and that is a good thing
Encoding, encryption, and hashing all turn readable data into gibberish, so people use the words interchangeably. They do opposite jobs, and mixing them up is behind real breaches. Here is the difference, why a good site hashes your password instead of encrypting it, and why Base64 is not a lock.
- Sep 08, 2026 8 min read
The one-page note that answers 'why did we build it this way?'
Your code shows what a project does. It never shows why you chose this database, this framework, this shape. An Architecture Decision Record is a short file that captures that why, once, so nobody has to guess or re-argue it later. Here is what goes in one, when to bother, and the single rule that makes them worth keeping.
- Sep 08, 2026 8 min read
AI writes the code fast, but the security is still your job
AI-generated code looks finished and often is not safe. Recent analysis found nearly half of it ships an OWASP Top 10 flaw. This is the beginner's security baseline: the handful of things you have to check yourself, because the AI will not add them for you.
- Sep 08, 2026 12 min read
The 15-year-old checklist that still catches your deployment bugs
The Twelve-Factor App is a list of twelve habits for building software that runs the same everywhere. It was written in 2011 and still explains most of why an app breaks in production. Here is the whole thing in plain terms, grouped so it sticks, plus the four factors that show their age in 2026.
- Sep 06, 2026 7 min read
Adding AI to an app without it becoming the weak point
Calling a model from your app takes ten lines. Doing it so the key stays safe, the answer streams, the cost stays sane, and a stranger cannot hijack it takes a pattern. The final stop on the full-stack roadmap: AI as one more part of the stack, handled like a professional.
- Sep 06, 2026 6 min read
The interface is where people decide whether to trust the AI
The same model can feel brilliant or broken depending on the screen around it. The sixth stop on the AI roadmap: streaming, showing your sources, admitting uncertainty, and the handful of patterns that make an AI feature feel trustworthy.