JWT Security Pitfalls: Algorithm Confusion, Header Injection, and the Claims Everyone Forgets to Check
JWTs are everywhere because they solve an ugly problem: how does a stateless service know who’s calling without a database
Category: Software Engineering
PostgreSQL Connection Pooling: Session vs Transaction Mode, PgBouncer, and How to Size It
Every PostgreSQL backend process is a full Unix process with its own megabytes of memory. That design choice buys you
Prometheus Metric Cardinality: How Explosions Happen and the Five Controls That Stop Them
Every Prometheus failure I’ve seen in production started the same way: someone added a label. A user ID on a
Structured Logging in Go: slog, OpenTelemetry, and the Fields That Matter in Production
At 02:14 on a Sunday, an alert fires: payment success rate dropped four percent. You run kubectl logs across a
gRPC Server Reflection in Production: Gate It, and Use Health Checks Instead
Here is a debugging story that repeats across every gRPC team. A developer runs grpcurl -plaintext localhost:50051 list against a
Continue readinggRPC Server Reflection in Production: Gate It, and Use Health Checks Instead
LLM Routing and Cascading: Send Every Query to the Cheapest Model That Can Handle It
If you run a large language model behind a product, you have probably internalized an uncomfortable trade-off. The big frontier
Continue readingLLM Routing and Cascading: Send Every Query to the Cheapest Model That Can Handle It
MVCC and VACUUM in PostgreSQL: Dead Tuples, Autovacuum Tuning, and What PG18 Changed
Every UPDATE in PostgreSQL is secretly an INSERT-plus-a-tombstone. The old row version stays on disk, fully readable to any transaction
Continue readingMVCC and VACUUM in PostgreSQL: Dead Tuples, Autovacuum Tuning, and What PG18 Changed
epoll Under the Hood: How Linux Event Loops Actually Work
Every high-concurrency network server on Linux eventually converges on the same bottleneck: not CPU, not memory, but the question of
Continue readingepoll Under the Hood: How Linux Event Loops Actually Work
Defending Against Supply Chain Attacks: An npm and PyPI Defense Playbook
When a popular npm package turns malicious, the window between publication and detection is measured in hours, and the first
Continue readingDefending Against Supply Chain Attacks: An npm and PyPI Defense Playbook
The Rust Borrow Checker Demystified: Aliasing, Memory Model, and When to Fight Back
What the borrow checker actually enforces, what Rust’s memory model promises, and which patterns — RefCell, Mutex, ownership restructuring — resolve the common contention points. … Continue readingThe Rust Borrow Checker Demystified: Aliasing, Memory Model, and When to Fight Back