Engineering essays from the bench.
War stories, architecture decisions, and the occasional tirade. Written by the engineers who shipped it.
Is Your Supabase Data Public? RLS Checks Before Launch
Test whether your Supabase tables are readable with your public key, turn on RLS the right way, close the bypasses, and fix 42501 before October 30.
Braid: One Download, Every Network You Have
Braid splits one download across Wi-Fi, Ethernet and your phone's 5G at once, hashes every chunk as it lands, and survives a crash without losing the file. Free software for macOS, Windows and Linux, with an Android companion.
wontfit: Find the Element That Breaks Your Mobile Layout
wontfit shows your app at phone widths side by side, names the element that overflows and by how many pixels, and fails CI when a layout breaks.
Vector Search in Postgres: When pgvector Is Enough
Run vector search in Postgres with pgvector: schema, HNSW vs IVFFlat, filtered queries with iterative scans, hybrid search, sizing, and when to move on.
Axios npm Supply Chain Attack: How It Works and How to Respond
How the March 2026 Axios npm attack compromised a 100M-download package to deploy a cross-platform RAT, plus detection and remediation steps.
Model Context Protocol (MCP): Building AI Integrations That Scale
Build MCP servers and clients, connect AI agents to enterprise tools, and deploy Model Context Protocol in production with security and observability.
Next.js Performance Optimization for the App Router
Speed up a Next.js App Router app: Server Components, streaming, caching and revalidation, next/image, next/font, and fixing LCP, INP and CLS in the field.
Multi-Tenant SaaS Architecture: Patterns That Scale
Multi-tenant SaaS architecture in practice: pool, bridge and silo models, Postgres row-level security, tenant routing, noisy neighbors, SSO and billing.
WebSockets vs SSE: Building Real-Time Apps That Scale
When to use WebSockets or Server-Sent Events, with server and client code for auth, resume after reconnect, Redis fan-out, proxies and graceful deploys.
API Security Best Practices: A Production Checklist
API security best practices that hold up in production: object-level authorization, full token validation, strict schemas, rate limits and logging, with code.
